VA-003 Explain encryption as a service Practice Question
An organization wants to encrypt sensitive fields in their database using Vault. They have multiple applications that need to encrypt different types of data. What approach should they take?
⚠ Common exam trap
HashiCorp often tests the distinction between secret storage (KV engine) and encryption-as-a-service (Transit engine), leading candidates to incorrectly choose Option B because they confuse storing keys with performing encryption operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a separate transit key per application
The Vault Transit Secrets Engine provides encryption-as-a-service, allowing each application to have its own named encryption key. This ensures cryptographic isolation: if one key is compromised, only the data encrypted with that specific key is at risk. Using separate keys per application also simplifies key rotation and access control, as each application can only use its designated key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the PKI engine to issue certificates for each application
Why it's wrong here
PKI is for certificates, not data encryption.
- ✗
Use the KV engine to store encryption keys
Why it's wrong here
The KV engine stores static secrets but lacks the cryptographic operations needed for field-level encryption; Vault’s Transit secrets engine performs encryption and decryption of data in transit without exposing the key material, which is the requirement here. This option is tempting because KV is commonly used for securely storing static secrets like API keys or database passwords, and in a scenario where the goal is merely to protect encryption keys at rest rather than to encrypt application data dynamically, KV would be the correct choice.
- ✓
Create a separate transit key per application
Why this is correct
Isolates encryption domains; follows least privilege principle.
- ✗
Use a single key for all applications to simplify management
Why it's wrong here
If a single key is compromised, all data is at risk.
- ✗
Encrypt data in the database using a static key stored in Vault
Why it's wrong here
This bypasses Vault's encryption service and is less secure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.