VA-003 Compare and configure secrets engines Practice Question
An organization uses the Transit secrets engine to encrypt sensitive files. They want to rotate the encryption key regularly without re-encrypting all existing files. Which feature allows this?
⚠ Common exam trap
HashiCorp often tests the distinction between key rotation (which preserves access to old ciphertext via versioning) and key expiration (which invalidates the key entirely), leading candidates to confuse 'key ttl' with a rotation mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key versioning
The Transit secrets engine in Vault supports key versioning, which allows you to rotate the encryption key by creating a new version while keeping older versions available for decryption of existing ciphertext. This means you can regularly rotate the key without needing to re-encrypt all previously encrypted files, as each ciphertext is tagged with the key version used to encrypt it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Key versioning
Why this is correct
Key versioning lets the Transit secrets engine retain prior key versions, so ciphertext keeps a reference to the version that encrypted it. New writes use the latest version, while existing files decrypt under their original version — satisfying rotation without re-encrypting stored data.
- ✗
Key derivation
Why it's wrong here
Key derivation produces new cryptographic keys from a base key and context, used for per-tenant or per-purpose key separation, not rotation of existing ciphertext. It is tempting because it generates fresh keys, but the scenario needs rewrap, which re-encrypts data keys under a new key version without re-encrypting stored files.
- ✗
Key ttl
Why it's wrong here
Key TTL sets an automatic expiry after which Vault deletes or rotates a key, but it does not preserve prior key versions for decrypting existing ciphertext. It is tempting because it enforces rotation schedules, yet the requirement is rewrap, which re-encrypts data keys under a new key version while old versions remain available.
- ✗
Convergent encryption
Why it's wrong here
Convergent encryption derives identical ciphertext from identical plaintext, enabling deduplication rather than key rotation; it does not retain old key versions for decryption. It is tempting because it removes duplicate ciphertext, but the correct feature is rewrap, which re-encrypts data keys under a new key version without touching stored ciphertext.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.