VA-003 Explain encryption as a service Practice Question
A user receives an error 'invalid ciphertext' when trying to decrypt data. The ciphertext was created by another Vault instance. What is the most likely issue?
⚠ Common exam trap
HashiCorp often tests the misconception that 'invalid ciphertext' errors are caused by permission issues or key name mismatches, when in fact the error is specifically triggered by a version mismatch in the ciphertext header that prevents the decryption key from being derived.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ciphertext includes key version info that doesn't match
Vault's transit secrets engine appends key version information to the ciphertext by default. When decrypting, Vault checks that the key version embedded in the ciphertext matches a version of the key that exists in the destination Vault instance. If the ciphertext was created by a different Vault instance with a different key version history, the version embedded in the ciphertext will not correspond to any known key version, causing the 'invalid ciphertext' error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Different key names
Why it's wrong here
A different key name would usually result in a permission error, not invalid ciphertext.
- ✗
The Vault instance is sealed
Why it's wrong here
A sealed Vault would return a seal error, not invalid ciphertext.
- ✗
Different key types
Why it's wrong here
Key type mismatch might cause errors during encryption, but decryption with wrong key type would likely also say invalid ciphertext? Actually it might, but version mismatch is more common.
- ✓
The ciphertext includes key version info that doesn't match
Why this is correct
Transit ciphertext is tied to a specific key version; if that version is missing, decryption fails.
- ✗
The user lacks permissions to decrypt
Why it's wrong here
Permission errors are explicit, not 'invalid ciphertext'.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.