VA-003 Explain encryption as a service Practice Question
An organization uses the transit engine with key rotation. They want to ensure that data encrypted with an older key version can be decrypted by Vault, but only if the key has not been deleted. Which of the following must be true?
⚠ Common exam trap
HashiCorp often tests the distinction between key deletion and key archiving, where candidates mistakenly assume that as long as a key is not deleted, older versions remain decryptable, overlooking that archiving also removes access to all versions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The key must not have been archived
In Vault's transit engine, key rotation creates new key versions while preserving older ones. The ability to decrypt data encrypted with an older key version depends on whether that version is still available in the key's version history. Archiving a key removes all versions from the active key ring, making decryption of data encrypted with any version of that key impossible. Therefore, the key must not have been archived to allow decryption of data encrypted with an older key version, provided the key itself has not been deleted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The key's `min_decryption_version` must be set to 1
Why it's wrong here
Setting to 1 allows all versions, but this is not required; the default (0) allows all versions. More importantly, if the version is archived, it still won't decrypt.
- ✗
The key must have the `allow_plaintext_backup` setting enabled
Why it's wrong here
This setting is for backing up key material, not for decryption availability.
- ✗
The key must have a `deletion_allowed` set to false
Why it's wrong here
This prevents deletion of the entire key, but does not affect decryption of existing ciphertext.
- ✗
The key's `latest_version` must be greater than 0
Why it's wrong here
This is always true if key exists, but doesn't ensure older versions are available.
- ✓
The key must not have been archived
Why this is correct
Archived key versions are removed from the decryption set and cannot be used.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.