VA-003 Explain Vault architecture Practice Question
A security team is configuring Vault's seal mechanism. They want to ensure that in the event of a data center outage, the Vault cluster can be unsealed without human intervention, but still require approval from multiple administrators to rekey the master key. Which seal type should they use?
⚠ Common exam trap
A common trap in the Vault exam is confusing the unseal process with the rekey process. Auto-unseal (e.g., using AWS KMS) allows the cluster to unseal automatically after an outage, but rekeying the master key is a separate operation that can require MFA or approval from multiple administrators. Candidates may incorrectly assume that any seal requiring manual steps for rekey must also require manual intervention for unseal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication for any key usage.
Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication (MFA) for any key usage meets the requirements: the Vault cluster can automatically unseal after a data center outage (since the unseal key is stored in KMS and accessible without human intervention), while rekeying the master key requires approval from multiple administrators (enforced by the MFA requirement on the KMS key policy). This decouples the unseal process from the rekey process, allowing automated recovery while maintaining administrative control over key rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shamir seals with auto-unseal using a cloud KMS.
Why it's wrong here
Shamir seals require manual unseal.
- ✗
HSM seal with a quorum of smart cards.
Why it's wrong here
Still requires manual intervention.
- ✗
Transit seal with a key that requires manual approval from a quorum of operators.
Why it's wrong here
Transit seal requires a running Vault to unseal.
- ✓
Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication for any key usage.
Why this is correct
Auto-unseal with KMS allows automatic unseal and MFA for rekey.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.