VA-003 Compare and configure secrets engines Practice Question
A team wants to store static secrets like database passwords and rotate them periodically. Which secrets engine should they enable?
⚠ Common exam trap
HashiCorp often tests the distinction between secrets engines that generate dynamic secrets (like AWS or PKI) versus those that store static secrets (like KV v2), leading candidates to confuse 'rotation' with 'dynamic generation' and pick a dynamic engine instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
KV v2 secrets engine
The KV v2 secrets engine is designed for static secrets like database passwords, offering versioning, configurable deletion, and periodic rotation via lease management or external automation. It stores secrets as key-value pairs with metadata, making it ideal for static credentials that need controlled lifecycle management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS secrets engine
Why it's wrong here
AWS generates dynamic AWS credentials, not for storing arbitrary static secrets.
- ✗
PKI secrets engine
Why it's wrong here
PKI issues certificates, not for static secrets.
- ✗
Transit secrets engine
Why it's wrong here
Transit provides encryption as a service, not static secret storage.
- ✓
KV v2 secrets engine
Why this is correct
KV v2 supports versioning and can store static secrets with rotation capabilities.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.