Drag a concept onto its matching description — or click a concept then click the description.
Concepts
Matches
Split key into shares
Use AWS Key Management Service
Use Azure Key Vault
Use Google Cloud KMS
Use hardware security module
VA-003 Assess Vault tokens Practice Question
Match each Vault seal type to its description.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shamir seal: Uses Shamir's secret sharing to split the master key into key shares distributed to operators
The correct matches are: Shamir seal uses secret sharing; AWS KMS seal uses AWS KMS; HSM seal uses a hardware module. Common confusions involve swapping cloud-based seals with Shamir or HSM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Shamir seal: Uses Shamir's secret sharing to split the master key into key shares distributed to operators
Why this is correct
Shamir seal is the default mechanism where the master key is split into shares and requires a threshold to unseal.
- ✓
AWS KMS seal: Uses AWS Key Management Service to encrypt/decrypt the master key
Why this is correct
AWS KMS seal leverages cloud-based KMS to secure the unseal key.
- ✓
HSM seal: Uses a Hardware Security Module (PKCS#11) to protect the master key
Why this is correct
HSM seal uses an external HSM for encryption, providing hardware-backed security.
- ✗
Shamir seal: Uses AWS KMS to encrypt/decrypt the master key
Why it's wrong here
Incorrect — this definition describes AWS KMS seal, not Shamir seal.
- ✗
AWS KMS seal: Uses Shamir's secret sharing to split the master key into shares
Why it's wrong here
Incorrect — this definition describes Shamir seal, not AWS KMS seal.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.