Match each Vault secret engine to its primary purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Key-value storage with versioning
Dynamic AWS IAM credentials
X.509 certificate generation
Encryption as a service
Dynamic database credentials
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
KV: Stores arbitrary secrets as key-value pairs.
Correct matches: KV -> static secrets, AWS -> dynamic AWS credentials, PKI -> certificates. Common confusions involve swapping purposes between engines.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
KV: Stores arbitrary secrets as key-value pairs.
Why this is correct
The KV secret engine is designed for static storage of secrets like passwords and API keys.
AWS: Generates dynamic AWS IAM credentials.
Why this is correct
The AWS secret engine dynamically creates temporary IAM credentials for accessing AWS services.
PKI: Issues X.509 certificates.
Why this is correct
The PKI secret engine manages the lifecycle of X.509 certificates for TLS.
KV: Generates dynamic database credentials.
Why it's wrong here
This describes the Database secret engine, not KV. KV stores static secrets.
AWS: Issues X.509 certificates.
Why it's wrong here
AWS engine handles IAM credentials; certificate issuance is the role of the PKI engine.
Transit: Manages SSH keys.
Why it's wrong here
The Transit engine provides encryption as a service; SSH key management is handled by the SSH engine.
Go deeper
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.