The answer is that KV v2 supports versioning, check-and-set (CAS) operations, and metadata storage. Versioning is the core feature that distinguishes KV v2 from KV v1, allowing you to retrieve, delete, and undelete specific secret versions. Check-and-set provides optimistic locking by requiring a `cas` parameter that matches the current version number, preventing concurrent overwrites and ensuring data integrity during updates. Metadata, such as created time, deletion time, and version count, is stored separately from the secret data and can be accessed via the `/metadata` path. On the HashiCorp Vault Associate VA-003 exam, this question tests your ability to differentiate KV v2’s advanced features from simpler key-value stores; a common trap is confusing CAS with simple version rollback or assuming metadata is stored inline with the secret. Remember the mnemonic “VCM” for Versioning, CAS, and Metadata—if a feature isn’t one of these three, it’s likely not a core KV v2 capability.
VA-003 Compare and configure secrets engines Practice Question
This VA-003 practice question tests your understanding of compare and configure secrets engines. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE of the following are true about the KV v2 secrets engine? (Select exactly 3.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It supports check-and-set operations for concurrent updates.
Option B is correct because KV v2 supports check-and-set (CAS) operations via the `cas` parameter in the write path. CAS ensures that a write only succeeds if the current version matches the expected value, preventing concurrent overwrites and providing optimistic locking for secret updates.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
It does not support deletion of secrets.
Why it's wrong here
KV v2 supports deletion by creating a delete version.
✓
It supports check-and-set operations for concurrent updates.
Why this is correct
KV v2 supports CAS using the cas parameter.
Related concept
Read the scenario before looking for a memorised answer.
It supports metadata like created_time and deletion_time.
Why this is correct
KV v2 stores metadata for each version.
Related concept
Read the scenario before looking for a memorised answer.
✓
It supports versioning of secrets.
Why this is correct
KV v2 keeps a configurable number of versions.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
HashiCorp often tests the misconception that KV v2 cannot delete or undo changes, when in fact it supports soft delete, destroy, and version rollback, and the trap is that candidates confuse KV v2 with the older KV v1 engine which lacks versioning and CAS.
Detailed technical explanation
How to think about this question
Under the hood, KV v2 stores each secret as a versioned key-value pair in a backend storage path like `secret/data/foo` with metadata in `secret/metadata/foo`. The CAS mechanism uses the `version` field in the response to enforce atomic updates; if the provided `cas` value does not match the current version, the write is rejected with a 400 error. In real-world scenarios, CAS is critical for preventing race conditions in CI/CD pipelines where multiple agents might update the same secret concurrently.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Compare and configure secrets engines — This question tests Compare and configure secrets engines — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: It supports check-and-set operations for concurrent updates. — Option B is correct because KV v2 supports check-and-set (CAS) operations via the `cas` parameter in the write path. CAS ensures that a write only succeeds if the current version matches the expected value, preventing concurrent overwrites and providing optimistic locking for secret updates.
What should I do if I get this VA-003 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator runs the commands shown in the exhibit. Later, they run 'vault kv delete kv-v2/secret' and then 'vault kv undelete -versions=1 kv-v2/secret' to recover the secret. Which command must the administrator run to verify that the secret is now readable?
hard
A.vault kv list kv-v2/secret
B.vault read kv-v2/data/secret
✓ C.vault kv get kv-v2/secret
D.vault kv metadata get kv-v2/secret
Why C: Option C is correct because 'vault kv get' is the standard command to read and display the latest version of a secret from a KV v2 secrets engine. After running 'vault kv undelete -versions=1', version 1 is restored from a deleted state, and 'vault kv get kv-v2/secret' will retrieve and show that version's data, confirming it is readable.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.