VA-003 Explain encryption as a service Practice Question
An organization wants to ensure that even Vault administrators cannot see the plaintext of data encrypted with the transit engine, but they want to use Vault for key management. What feature should be enabled?
⚠ Common exam trap
HashiCorp often tests the distinction between server-side encryption (where Vault handles encryption/decryption) and client-side encryption (where the application handles encryption using a Vault-provided key), and candidates mistakenly choose seal wrapping or key derivation because they sound like they add security layers, but they do not prevent administrators from accessing plaintext.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client-side encryption with datakey
Client-side encryption with a datakey allows the application to encrypt data locally using a key obtained from Vault, ensuring that Vault administrators never see the plaintext. The datakey is generated by Vault and returned in both plaintext and ciphertext forms; the application encrypts data with the plaintext key and then discards it, storing only the ciphertext key alongside the encrypted data. This decouples key management from data encryption, meeting the requirement that even Vault administrators cannot access the plaintext.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Seal wrapping
Why it's wrong here
Seal wrapping is used to encrypt the master key or other keys at rest, but it does not prevent Vault administrators from accessing plaintext data during encryption/decryption operations.
- ✗
Convergent encryption
Why it's wrong here
Convergent encryption is designed for deduplication by deriving the encryption key from the plaintext itself. It does not prevent Vault administrators from seeing the plaintext because the key is derived client-side and Vault still manages the storage; administrators could potentially access the key material or the encrypted data.
- ✓
Client-side encryption with datakey
Why this is correct
Client-side encryption with a datakey allows the application to encrypt data locally using a key obtained from Vault. The plaintext key is never stored by Vault, so administrators cannot see the plaintext. This meets the requirement.
- ✗
Key deletion prevention
Why it's wrong here
Key deletion prevention protects against accidental or malicious deletion of keys, but does not affect visibility of plaintext.
- ✗
Key derivation
Why it's wrong here
Key derivation allows multiple keys to be derived from a single root key, but does not prevent administrators from accessing plaintext if they have access to the root key.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.