VA-003 Explain encryption as a service Practice Question
An application encrypts data using the transit engine and stores the ciphertext in a database. After a key rotation, the application can no longer decrypt the data. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that key rotation automatically deletes old keys, leading candidates to choose Option C, but the real issue is the `min_decryption_version` parameter that explicitly blocks decryption with older key versions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The `min_decryption_version` was set to a value higher than the old key version
The `min_decryption_version` parameter in Vault's transit engine specifies the minimum key version that can be used for decryption. After a key rotation, if this value is set higher than the old key version, the engine will refuse to decrypt data encrypted with that older version, even if the old key data is still present in the key ring. This is a common misconfiguration that leads to decryption failures post-rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ciphertext was generated with a different key
Why it's wrong here
Possible but less likely given the timing with rotation.
- ✗
The token used for decryption has been revoked
Why it's wrong here
This would affect all operations, not just after rotation.
- ✗
The key was rotated and the old version was automatically deleted
Why it's wrong here
Vault retains old versions by default; they are not deleted automatically.
- ✓
The `min_decryption_version` was set to a value higher than the old key version
Why this is correct
This prevents decryption with older versions, a common misconfiguration.
- ✗
The transit engine was disabled
Why it's wrong here
Would affect all operations, not just decrypt.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.