VA-003 Explain encryption as a service Practice Question
An organization wants to encrypt sensitive fields in their database using Vault. They have multiple applications that need to encrypt different types of data. What approach should they take?
⚠ Common exam trap
HashiCorp often tests the distinction between secret storage (KV engine) and encryption-as-a-service (Transit engine), leading candidates to incorrectly choose Option B because they confuse storing keys with performing encryption operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a separate transit key per application
The Vault Transit Secrets Engine provides encryption-as-a-service, allowing each application to have its own named encryption key. This ensures cryptographic isolation: if one key is compromised, only the data encrypted with that specific key is at risk. Using separate keys per application also simplifies key rotation and access control, as each application can only use its designated key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the PKI engine to issue certificates for each application
Why it's wrong here
The PKI engine issues X.509 certificates for TLS and identity, not symmetric keys for field-level encryption, so it cannot produce the data encryption keys required. It is tempting because PKI is a legitimate Vault secrets engine for mutual TLS between applications, which would be the right choice for authenticating service-to-service traffic rather than encrypting database fields.
- ✗
Use the KV engine to store encryption keys
Why it's wrong here
The KV engine stores static secrets but lacks the cryptographic operations needed for field-level encryption; Vault’s Transit secrets engine performs encryption and decryption of data in transit without exposing the key material, which is the requirement here. This option is tempting because KV is commonly used for securely storing static secrets like API keys or database passwords, and in a scenario where the goal is merely to protect encryption keys at rest rather than to encrypt application data dynamically, KV would be the correct choice.
- ✓
Create a separate transit key per application
Why this is correct
Separate transit keys per application enforce cryptographic isolation: each key's material and rotation schedule stay independent, so one application's compromise cannot decrypt another's ciphertext. This satisfies the stem's requirement that multiple applications encrypt different data types, since Vault's transit engine never exposes key material and supports per-key rotation and policy scoping.
- ✗
Use a single key for all applications to simplify management
Why it's wrong here
A single shared key removes per-application isolation, so any application's compromise exposes every other application's data and rotation cannot be scoped. It is tempting because consolidated key management reduces administrative overhead, and it would suit one application encrypting one uniform data type rather than multiple applications with differing data.
- ✗
Encrypt data in the database using a static key stored in Vault
Why it's wrong here
A static key stored in Vault never rotates and is shared across applications, so compromise or staff departure exposes all encrypted fields permanently. It is tempting because storing keys centrally in Vault is genuinely correct practise, and it would suffice for a single low-sensitivity dataset with no rotation or separation requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.