VA-003 Explain encryption as a service Practice Question
Exhibit
Refer to the exhibit. ``` $ vault write -f transit/keys/payment-key Success! Data written to: transit/keys/payment-key $ vault write transit/encrypt/payment-key plaintext=$(base64 <<< "4111111111111111") Key Value --- ----- ciphertext vault:v1:abc123... $ vault write -f transit/keys/payment-key/rotate Success! Data written to: transit/keys/payment-key/rotate $ vault write transit/encrypt/payment-key plaintext=$(base64 <<< "4111111111111111") Key Value --- ----- ciphertext vault:v2:def456... $ vault write transit/decrypt/payment-key ciphertext=vault:v1:abc123... Key Value --- ----- plaintext NDExMTExMTExMTExMTExMQ== ```
After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?
⚠ Common exam trap
HashiCorp often tests the misconception that key rotation invalidates old ciphertext, but the trap here is that candidates assume the old key is deleted or replaced, when in fact Vault retains it for decryption based on ciphertext metadata.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The old key version is retained and used for decryption when the ciphertext references that version.
A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The old key version is retained and used for decryption when the ciphertext references that version.
Why this is correct
Vault retains old key versions for decryption, and the ciphertext includes the version identifier, allowing decryption with the appropriate key.
- ✗
The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.
Why it's wrong here
Old key versions are retained for decryption; they are not deleted automatically.
- ✗
The ciphertext contains the original plaintext, so decryption simply extracts it.
Why it's wrong here
Ciphertext is not plaintext; it is encrypted data that requires the correct key to decrypt.
- ✗
The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.
Why it's wrong here
Vault does not store the plaintext; it only returns the ciphertext.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.