VA-003 Transit secrets engine Practice Question
Exhibit
$ vault secrets enable -path=transit transit $ vault write -f transit/keys/my-key type=aes256-gcm96 $ vault write transit/encrypt/my-key plaintext=$(base64 <<< "secretdata") $ vault write transit/decrypt/my-key ciphertext=$CIPHER
Refer to the exhibit. After executing these commands, what is the expected behavior?
⚠ Common exam trap
Candidates may think decryption works without specifying key version, but Vault Transit requires the key version to be specified when decrypting data that was encrypted with a previous key version.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The decryption command requires the key version to be specified
In the Vault Transit secrets engine, when a key has multiple versions (e.g., after rotation), the decryption command requires the key version to be specified to ensure the correct key is used. If the version is not specified, Vault defaults to the latest version, which may not match the version used for encryption, leading to decryption failure. Therefore, option C is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The key is automatically rotated every 30 days
Why it's wrong here
Key rotation is not automatic every 30 days; rotation must be manually triggered via CLI or API.
- ✗
The ciphertext is base64 encoded, and the plaintext is base64 decoded automatically
Why it's wrong here
While ciphertext is base64 encoded, the plaintext is not automatically decoded; the Transit engine returns base64-encoded plaintext that the client must decode separately.
- ✓
The decryption command requires the key version to be specified
Why this is correct
Correct. When decrypting data encrypted with a previous key version, the key version must be specified in the decryption request, otherwise the latest version is used and decryption may fail.
- ✗
The encryption operation will fail because the key type 'aes256-gcm96' is incorrect
Why it's wrong here
The key type 'aes256-gcm96' is valid in Vault Transit, so encryption will succeed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.