VA-003 Compare and configure secrets engines Practice Question
A team is using Vault's KV v2 secrets engine to store API keys for multiple microservices. They have enabled versioning and need to ensure that when a secret is deleted, it can be recovered within 30 days. Additionally, they want to keep a history of all versions for compliance. The team has noticed that some secrets are being permanently removed immediately instead of moving to a deleted state. Which configuration change should they make to enforce this behavior?
⚠ Common exam trap
HashiCorp often tests the distinction between parameters that control version retention ('max_versions' and 'delete_version_after') versus those that control write safety ('check-and-set'), and the trap here is that candidates confuse 'max_versions' (which limits total versions) with the soft-delete retention period, leading them to pick option D instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the 'delete_version_after' parameter to 30 days on the KV v2 mount
The 'delete_version_after' parameter on a KV v2 secrets engine mount specifies the time window (in seconds or as a duration like '30d') during which a deleted version remains in a soft-deleted state and can be recovered via the 'undelete' endpoint. Setting this to 30 days ensures that when a secret is deleted, it is not permanently removed until after that period, preserving the ability to restore it and maintaining a full version history for compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'check-and-set' on the secrets path to prevent unintended overwrites
Why it's wrong here
Check-and-set prevents concurrent overwrites but does not affect deletion retention.
- ✓
Set the 'delete_version_after' parameter to 30 days on the KV v2 mount
Why this is correct
This ensures that after soft-deletion, versions are kept for 30 days before permanent removal.
- ✗
Write a custom script that calls the 'undelete' endpoint immediately after deletion
Why it's wrong here
This would not prevent permanent deletion; it would revert deletion but not enforce a retention period.
- ✗
Set 'max_versions' to 1 to limit the number of retained versions
Why it's wrong here
This limits total versions but does not control how long deleted versions are kept; it may cause older versions to be removed automatically.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.