Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
VA-003 Explain Vault architecture Practice Question
Drag and drop the steps to configure Vault's PKI secrets engine to issue certificates into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate
The correct sequence to configure Vault's PKI secrets engine for issuing certificates is: first enable the PKI secrets engine, then generate a root certificate (self-signed CA), then create a role that defines certificate parameters, and finally issue a certificate using that role. Enabling the engine mounts it at a path, generating the root CA establishes the trust anchor, the role configures certificate properties, and the issuance step produces the actual certificate. Common mistakes include attempting to generate the root or create a role before enabling the engine, or creating the role before generating the root CA, which leads to errors or missing configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate
Why this is correct
This is the correct order because you must first enable the engine, then set up the CA, define a role that specifies certificate parameters, and finally issue certificates using that role.
- ✗
Generate a root certificate, then enable PKI secrets engine, then create a role, then issue a certificate
Why it's wrong here
This is incorrect because you cannot generate a root certificate before the PKI secrets engine is enabled; the engine must be mounted first.
- ✗
Create a role, then enable PKI secrets engine, then generate a root certificate, then issue a certificate
Why it's wrong here
This is incorrect because you cannot create a role before the PKI secrets engine is enabled; the role depends on the engine being mounted and configured.
- ✗
Enable PKI secrets engine, then create a role, then generate a root certificate, then issue a certificate
Why it's wrong here
This is incorrect because the role should be created after generating the root certificate; otherwise, the role lacks a CA to reference and issuing will fail until the CA exists.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.