Courseiva
Explain encryption as a servicehardMultiple ChoiceObjective-mapped

VA-003 Explain encryption as a service Practice Question

An organization uses the transit engine with key rotation. They want to ensure that data encrypted with an older key version can be decrypted by Vault, but only if the key has not been deleted. Which of the following must be true?

⚠ Common exam trap

HashiCorp often tests the distinction between key deletion and key archiving, where candidates mistakenly assume that as long as a key is not deleted, older versions remain decryptable, overlooking that archiving also removes access to all versions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The key must not have been archived

In Vault's transit engine, key rotation creates new key versions while preserving older ones. The ability to decrypt data encrypted with an older key version depends on whether that version is still available in the key's version history. Archiving a key removes all versions from the active key ring, making decryption of data encrypted with any version of that key impossible. Therefore, the key must not have been archived to allow decryption of data encrypted with an older key version, provided the key itself has not been deleted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The key's `min_decryption_version` must be set to 1

    Why it's wrong here

    Setting to 1 allows all versions, but this is not required; the default (0) allows all versions. More importantly, if the version is archived, it still won't decrypt.

  • The key must have the `allow_plaintext_backup` setting enabled

    Why it's wrong here

    This setting is for backing up key material, not for decryption availability.

  • The key must have a `deletion_allowed` set to false

    Why it's wrong here

    This prevents deletion of the entire key, but does not affect decryption of existing ciphertext.

  • The key's `latest_version` must be greater than 0

    Why it's wrong here

    This is always true if key exists, but doesn't ensure older versions are available.

  • The key must not have been archived

    Why this is correct

    Archived key versions are removed from the decryption set and cannot be used.

About these practice questions

Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.