VA-003 Compare and configure secrets engines Practice Question
An administrator is configuring the Transit secrets engine for encryption as a service. Which TWO configuration options are valid?
⚠ Common exam trap
HashiCorp often tests the distinction between key rotation (which is supported) and key TTL (which is not), leading candidates to incorrectly assume that keys have an expiration time like tokens or leases.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enabling automatic key derivation per context
The Transit secrets engine supports key derivation, which allows a base key to be combined with a user-supplied context value to generate a unique encryption key per context. This enables multiple parties to use the same base key while deriving distinct keys for different data sets, enhancing security without managing separate keys. Option D is correct because the Transit engine allows administrators to set a rotation period for encryption keys, automatically rotating the key after a specified interval to comply with cryptographic best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using the engine to generate one-time passwords
Why it's wrong here
Transit does not generate OTPs; that is for SSH or One-Time Password engines.
- ✗
Configuring the engine to export the key in plaintext
Why it's wrong here
Exporting keys is not a standard configuration; by default keys are non-exportable.
- ✓
Enabling automatic key derivation per context
Why this is correct
You can enable derived keys so that each context gets a unique encryption key.
- ✓
Setting the encryption key rotation period
Why this is correct
Transit supports key rotation via the rotation_period parameter.
- ✗
Setting a TTL on the key itself
Why it's wrong here
Transit keys have a min_decryption_version but no TTL.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.