How should I use these Explain encryption as a service practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Explain encryption as a service questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Explain encryption as a service domain.

VA-003 · topic practice

Explain encryption as a service practice questions

Practise HashiCorp Vault Associate VA-003 Explain encryption as a service practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Explain encryption as a service

Practice 10 questions Browse domain →

What the exam tests

What to know about Explain encryption as a service

Explain encryption as a service questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Explain encryption as a service exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Explain encryption as a service questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Explain encryption as a service explanation →

Which TWO capabilities are required in a Vault policy to allow a client to encrypt data using a key named 'app-key' in the transit engine? (Assume the key already exists.)

Trap 1: read on /transit/keys/app-key

The 'read' capability on `/transit/keys/app-key` is not required for encryption; it only allows reading key metadata, which is not necessary to perform the encrypt operation.

Trap 2: update on /transit/keys/app-key

The 'update' capability on `/transit/keys/app-key` allows modifying the key configuration, which is not needed for encryption.

Trap 3: create on /transit/keys/app-key

The 'create' capability on `/transit/keys/app-key` is for creating new keys, not for using existing ones for encryption.

Study all Explain encryption as a service common traps →

A
read on /transit/keys/app-key
Why wrong: The 'read' capability on `/transit/keys/app-key` is not required for encryption; it only allows reading key metadata, which is not necessary to perform the encrypt operation.
B
encrypt on /transit/encrypt/app-key
The 'encrypt' capability on `/transit/encrypt/app-key` is the specific permission needed to submit data for encryption with the named key.
C
update on /transit/keys/app-key
Why wrong: The 'update' capability on `/transit/keys/app-key` allows modifying the key configuration, which is not needed for encryption.
D
create on /transit/keys/app-key
Why wrong: The 'create' capability on `/transit/keys/app-key` is for creating new keys, not for using existing ones for encryption.
E
list on /transit/keys/app-key
Why wrong: The 'list' capability on `/transit/keys/app-key` is for listing keys, which is unrelated to performing encryption.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Explain encryption as a service explanation →

An application needs to encrypt credit card numbers. The encryption must be deterministic for indexing purposes but also support key rotation. Which approach should be used?

Trap 1: Use Vault's cubbyhole

Cubbyhole is for temporary tokens, not long-term encryption.

Trap 2: Use Vault's transformations engine

Transformations are for formats like masking, not encryption with rotation.

Trap 3: Use datakey encryption

Datakey is for envelope encryption; it does not inherently enforce determinism.

Study all Explain encryption as a service common traps →

A
Use Vault's cubbyhole
Why wrong: Cubbyhole is for temporary tokens, not long-term encryption.
B
Use Vault's transformations engine
Why wrong: Transformations are for formats like masking, not encryption with rotation.
C
Use datakey encryption
Why wrong: Datakey is for envelope encryption; it does not inherently enforce determinism.
D
Use convergent encryption with key rotation
Convergent encryption allows deterministic output and supports key rotation via rewrapping.
E
Use standard encryption and re-encrypt all data on rotation
Why wrong: Re-encrypting all data is costly and requires access to plaintext.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full Explain encryption as a service explanation →

A company is using Vault Transit to encrypt files before uploading them to an S3 bucket. They notice that for a given plaintext file, the ciphertext output is always identical, even when encrypting at different times. They are using the `encrypt` endpoint with the default AES-GCM algorithm. The team is concerned about security because the repeated ciphertext leaks information (e.g., file equality). What is the most likely cause of this behavior?

Trap 1: They are using the wrong key

Using the wrong key would result in different (invalid) ciphertexts, not consistent ones.

Trap 2: They are using a deterministic encryption scheme

While this is true, convergent encryption is the specific feature in Vault that causes this; option B is more precise.

Trap 3: They are not providing an encryption context

Missing context does not make encryption deterministic; Vault still generates a random nonce.

Study all Explain encryption as a service common traps →

A
They are using the wrong key
Why wrong: Using the wrong key would result in different (invalid) ciphertexts, not consistent ones.
B
They are using a deterministic encryption scheme
Why wrong: While this is true, convergent encryption is the specific feature in Vault that causes this; option B is more precise.
C
They are using convergent encryption
Convergent encryption derives the key from the plaintext, resulting in identical ciphertexts for identical plaintexts.
D
They are not providing an encryption context
Why wrong: Missing context does not make encryption deterministic; Vault still generates a random nonce.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Explain encryption as a service explanation →

A healthcare application needs to encrypt sensitive patient data before storing it in a legacy database that does not support encryption. The team wants to use Vault's encryption as a service. However, the application is running on a restricted network that cannot make outbound HTTP requests to Vault. Which solution should the team implement?

Trap 1: Set up Vault replication from a central Vault to a local Vault…

Replication does not eliminate the need for outbound calls.

Trap 2: Use Vault's HTTP API from the application to encrypt data directly.

The application cannot make outbound HTTP requests.

Trap 3: Enable the transit secrets engine and call Vault's encrypt endpoint.

Same network issue; requires outbound calls.

Study all Explain encryption as a service common traps →

A
Set up Vault replication from a central Vault to a local Vault instance.
Why wrong: Replication does not eliminate the need for outbound calls.
B
Deploy Vault Agent in sidecar mode with a configured encrypt stanza to handle encryption locally.
Vault Agent can process encryption locally via a Unix socket.
C
Use Vault's HTTP API from the application to encrypt data directly.
Why wrong: The application cannot make outbound HTTP requests.
D
Enable the transit secrets engine and call Vault's encrypt endpoint.
Why wrong: Same network issue; requires outbound calls.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Explain encryption as a service explanation →

A DevOps team uses Vault's transit engine to encrypt secrets in CI/CD pipelines. They report that encryption operations are failing with 'permission denied' errors. The team has a policy granting 'create' and 'update' capabilities on the transit key path. What is the most likely missing capability?

Trap 1: The 'read' capability is missing.

Read is for key metadata, not encrypt.

Trap 2: The 'delete' capability is missing.

Delete is not needed for encryption.

Trap 3: The 'list' capability is missing.

List is for enumerating keys.

Study all Explain encryption as a service common traps →

A
The 'read' capability is missing.
Why wrong: Read is for key metadata, not encrypt.
B
The 'encrypt' capability is missing.
Encrypt capability is required for encryption operations.
C
The 'delete' capability is missing.
Why wrong: Delete is not needed for encryption.
D
The 'list' capability is missing.
Why wrong: List is for enumerating keys.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Explain encryption as a service explanation →

A developer wants to encrypt data using Vault's transit engine with a key named 'payment-key'. The key already exists and is set to allow encryption. Which API path should the developer use to encrypt the data?

Trap 1: POST /v1/transit/decrypt/payment-key

Path for decryption.

Trap 2: POST /v1/transit/rewrap/payment-key

Path for rewrapping.

Trap 3: POST /v1/transit/keys/payment-key

Path for key management.

Study all Explain encryption as a service common traps →

A
POST /v1/transit/decrypt/payment-key
Why wrong: Path for decryption.
B
POST /v1/transit/rewrap/payment-key
Why wrong: Path for rewrapping.
C
POST /v1/transit/keys/payment-key
Why wrong: Path for key management.
D
POST /v1/transit/encrypt/payment-key
Correct path for encryption.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Explain encryption as a service explanation →

An organization wants to encrypt data at rest in a cloud storage bucket. They plan to use Vault's transit engine to generate a data key and then encrypt the data locally. Which transit endpoint should they use to get a data key?

Trap 1: POST /v1/transit/encrypt/my-key

Encrypts data, not generate a key.

Trap 2: POST /v1/transit/decrypt/my-key

Decrypts data.

Trap 3: POST /v1/transit/datakey/ciphertext/my-key

Returns only ciphertext key.

Study all Explain encryption as a service common traps →

A
POST /v1/transit/datakey/plaintext/my-key
Returns both plaintext and ciphertext data key.
B
POST /v1/transit/encrypt/my-key
Why wrong: Encrypts data, not generate a key.
C
POST /v1/transit/decrypt/my-key
Why wrong: Decrypts data.
D
POST /v1/transit/datakey/ciphertext/my-key
Why wrong: Returns only ciphertext key.

Full breakdown with real-world context →

Question 8hardmulti select

Read the full Explain encryption as a service explanation →

Which TWO statements are true about Vault's encryption as a service using the transit engine?

Trap 1: Encryption keys cannot be rotated once created

Encryption keys can be rotated in the transit engine, so this statement is false.

Trap 2: Vault stores the plaintext data for audit purposes

Vault does not store plaintext data; it only processes encryption/decryption requests.

Trap 3: Clients can provide their own key material when creating a key

Clients cannot provide their own key material; Vault generates keys internally. Even exportable keys are generated by Vault.

Study all Explain encryption as a service common traps →

A
Encryption keys cannot be rotated once created. [wrong]
Why wrong: Encryption keys can be rotated in the transit engine, so this statement is false.
B
Data encrypted with a key can be decrypted with a later version of the same key if the key is rotated. [CORRECT]
When a key is rotated, Vault creates a new version but retains old versions for decryption, so data encrypted with an earlier version can still be decrypted.
C
The transit engine supports convergent encryption. [CORRECT]
Convergent encryption is supported in the transit engine, allowing deterministic encryption for deduplication.
D
Vault stores the plaintext data for audit purposes. [wrong]
Why wrong: Vault does not store plaintext data; it only processes encryption/decryption requests.
E
Clients can provide their own key material when creating a key. [CORRECT]
Why wrong: Clients cannot provide their own key material; Vault generates keys internally. Even exportable keys are generated by Vault.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Explain encryption as a service explanation →

A multinational corporation uses Vault Enterprise with the transit engine to encrypt sensitive financial data across multiple cloud regions. Each region has its own Vault cluster, and they use performance replication to synchronize transit keys. Recently, the team in the Asia-Pacific region reports that encryption operations are slower than in other regions. They also notice that some decryption requests for data encrypted with a key that was rotated in the primary region are failing with 'key version not found' errors. The transit key is named 'fin-key' and has been rotated three times. The Asia-Pacific cluster is up-to-date with replication according to the replication status dashboard. Which action should the operations team take to resolve the decryption failures?

Trap 1: Increase the performance standby count in the Asia-Pacific cluster.

Addresses performance, not decryption errors.

Trap 2: Manually copy the key material from the primary to the secondary…

Replication should handle this.

Trap 3: Re-encrypt all data encrypted with version 1 of 'fin-key' using the…

Re-encryption doesn't address missing key version.

Study all Explain encryption as a service common traps →

A
Verify that the policy in the Asia-Pacific cluster grants 'decrypt' capability on the key path for older key versions.
Policy might be missing decrypt on older versions.
B
Increase the performance standby count in the Asia-Pacific cluster.
Why wrong: Addresses performance, not decryption errors.
C
Manually copy the key material from the primary to the secondary cluster.
Why wrong: Replication should handle this.
D
Re-encrypt all data encrypted with version 1 of 'fin-key' using the current version.
Why wrong: Re-encryption doesn't address missing key version.

Full breakdown with real-world context →

Question 10easymultiple choice

Read the full Explain encryption as a service explanation →

A DevOps team needs to encrypt sensitive configuration data before storing it in a version control system. They want to use Vault's encryption as a service to encrypt the data using a named encryption key. Which Vault path should they use to perform the encryption?

Trap 1: POST /v1/transit/sign/my-key

This path is used for signing data, not encryption.

Trap 2: POST /v1/transit/hmac/my-key

This path computes an HMAC, not encryption.

Trap 3: POST /v1/transit/random

This endpoint generates random bytes, not encrypts data.

Study all Explain encryption as a service common traps →

A
POST /v1/transit/encrypt/my-key
The encryption endpoint is /encrypt under the transit engine path, providing encryption as a service.
B
POST /v1/transit/sign/my-key
Why wrong: This path is used for signing data, not encryption.
C
POST /v1/transit/hmac/my-key
Why wrong: This path computes an HMAC, not encryption.
D
POST /v1/transit/random
Why wrong: This endpoint generates random bytes, not encrypts data.
E
POST /v1/transit/decrypt/my-key
Why wrong: This path is used for decryption, not encryption.

Full breakdown with real-world context →

Question 11mediummulti select

Read the full Explain encryption as a service explanation →

Which TWO statements correctly describe Vault's encryption as a service using the Transit secrets engine?

Trap 1: Ciphertext is stored within Vault for later retrieval.

Transit does not store ciphertext; it returns the ciphertext to the client and does not persist it.

Trap 2: Encryption always produces a unique ciphertext even with the same…

By default, Transit uses nonce-based encryption producing unique ciphertext, but convergent encryption can produce deterministic ciphertext.

Trap 3: Key rotation is not supported; the key version is fixed.

Vault supports key rotation in Transit, allowing new versions of the key to be used for encryption while old versions can decrypt existing data.

Study all Explain encryption as a service common traps →

A
Ciphertext is stored within Vault for later retrieval.
Why wrong: Transit does not store ciphertext; it returns the ciphertext to the client and does not persist it.
B
Data is encrypted and decrypted on the server side without the client having direct access to the encryption key.
Transit encrypts data server-side using a managed key, never exposing the key to clients.
C
Encryption always produces a unique ciphertext even with the same plaintext and key.
Why wrong: By default, Transit uses nonce-based encryption producing unique ciphertext, but convergent encryption can produce deterministic ciphertext.
D
Key rotation is not supported; the key version is fixed.
Why wrong: Vault supports key rotation in Transit, allowing new versions of the key to be used for encryption while old versions can decrypt existing data.
E
The encryption key can be derived per context using key derivation, ensuring unique ciphertext per context.
Transit supports key derivation where the key is derived per context, providing uniqueness.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Explain encryption as a service explanation →

After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?

Exhibit

Refer to the exhibit.

```
$ vault write -f transit/keys/payment-key
Success! Data written to: transit/keys/payment-key

$ vault write transit/encrypt/payment-key plaintext=$(base64 <<< "4111111111111111")
Key        Value
---        -----
ciphertext vault:v1:abc123...

$ vault write -f transit/keys/payment-key/rotate
Success! Data written to: transit/keys/payment-key/rotate

$ vault write transit/encrypt/payment-key plaintext=$(base64 <<< "4111111111111111")
Key        Value
---        -----
ciphertext vault:v2:def456...

$ vault write transit/decrypt/payment-key ciphertext=vault:v1:abc123...
Key          Value
---          -----
plaintext    NDExMTExMTExMTExMTExMQ==
```

Trap 1: The old key version is automatically deleted after rotation, but…

Old key versions are retained for decryption; they are not deleted automatically.

Trap 2: The ciphertext contains the original plaintext, so decryption…

Ciphertext is not plaintext; it is encrypted data that requires the correct key to decrypt.

Trap 3: The plaintext is stored in Vault during encryption, so decryption…

Vault does not store the plaintext; it only returns the ciphertext.

Study all Explain encryption as a service common traps →

A
The old key version is retained and used for decryption when the ciphertext references that version.
Vault retains old key versions for decryption, and the ciphertext includes the version identifier, allowing decryption with the appropriate key.
B
The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.
Why wrong: Old key versions are retained for decryption; they are not deleted automatically.
C
The ciphertext contains the original plaintext, so decryption simply extracts it.
Why wrong: Ciphertext is not plaintext; it is encrypted data that requires the correct key to decrypt.
D
The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.
Why wrong: Vault does not store the plaintext; it only returns the ciphertext.

Full breakdown with real-world context →

Question 13mediummulti select

Read the full Explain encryption as a service explanation →

A DevOps team needs to implement encryption as a service for application data stored in a PostgreSQL database. They want to use Vault's transit secrets engine to encrypt sensitive fields before storage. Which TWO actions should the team take to ensure the encryption keys are rotated automatically and securely?

Trap 1: Set 'min_decryption_version' to the latest key version to force…

Setting 'min_decryption_version' too high would prevent decryption of data encrypted with older keys, causing data loss.

Trap 2: Disable key rotation and rely on manual key updates using the…

Disabling automatic rotation defeats the purpose of automated security management.

Trap 3: Restrict access to the decryption capability to prevent adversaries…

Decryption does not expose key material; key rotation is independent of this.

Study all Explain encryption as a service common traps →

A
Set 'min_decryption_version' to the latest key version to force re-encryption of old data.
Why wrong: Setting 'min_decryption_version' too high would prevent decryption of data encrypted with older keys, causing data loss.
B
Use a key derivation function with a unique context per application context to ensure each encryption produces distinct ciphertext.
Key derivation per context ensures that even if a ciphertext is exposed, it cannot be used across different contexts.
C
Disable key rotation and rely on manual key updates using the transit key/rotate endpoint.
Why wrong: Disabling automatic rotation defeats the purpose of automated security management.
D
Restrict access to the decryption capability to prevent adversaries from learning the key material.
Why wrong: Decryption does not expose key material; key rotation is independent of this.
E
Configure a key rotation period using the 'auto_rotate_period' parameter when creating or tuning the encryption key.
Automatic rotation ensures keys are rotated without manual intervention.

Full breakdown with real-world context →

Question 14easymultiple choice

Read the full Explain encryption as a service explanation →

A financial technology company uses Vault Enterprise to manage encryption keys for its payment processing system. The system uses the transit secrets engine to encrypt credit card numbers before storing them in a legacy database. The security team mandates that all encryption keys must be automatically rotated every 30 days. The operations team configures the key 'payment-cards' with 'auto_rotate_period' set to 30 days. After the first rotation, the payment processing application starts failing with 'permission denied' errors when trying to decrypt previously encrypted data. The application uses a token with a policy that grants 'create' and 'update' capabilities on 'transit/decrypt/payment-cards'. The application does not use the 'rewrap' endpoint. The Vault audit logs show that the decryption requests are being made to the correct path. What is the most likely cause of the failure?

Trap 1: The key rotation changed the encryption algorithm, making old…

Key rotation does not change the algorithm; it only creates a new key version.

Trap 2: The application's token has expired after the key rotation,…

Token expiration is unrelated to key rotation; the token should still be valid unless its TTL has passed.

Trap 3: The application must use the 'rewrap' endpoint to re-encrypt all…

Rewrapping is optional; the application can still decrypt using the old key version if it specifies the correct ciphertext context.

Study all Explain encryption as a service common traps →

A
The key rotation changed the encryption algorithm, making old ciphertexts incompatible with the new key.
Why wrong: Key rotation does not change the algorithm; it only creates a new key version.
B
The application's token has expired after the key rotation, requiring a new token with updated policies.
Why wrong: Token expiration is unrelated to key rotation; the token should still be valid unless its TTL has passed.
C
The application must use the 'rewrap' endpoint to re-encrypt all ciphertexts with the new key version before decryption.
Why wrong: Rewrapping is optional; the application can still decrypt using the old key version if it specifies the correct ciphertext context.
D
The application is not specifying the key version in the decryption request, and Vault defaults to the latest key version which cannot decrypt data encrypted with the old version.
By default, Vault uses the latest key version for decryption. To decrypt with an older version, the ciphertext must include a version reference, or the application must use the 'rewrap' endpoint.

Full breakdown with real-world context →

Question 15mediumdrag order

Read the full Explain encryption as a service explanation →

Drag and drop the steps to configure Vault's AWS secrets engine to generate IAM credentials into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Enable the AWS secrets engine, then configure the root IAM…

This order is incorrect because you must create a role before generating credentials; the role defines the permissions for the generated credentials.

Trap 2: Enable the AWS secrets engine, then create a role, then configure…

This order is incorrect because you need to configure the root IAM credentials before creating a role, as the role configuration may depend on the root credentials.

Trap 3: Configure the root IAM credentials, then enable the AWS secrets…

This order is incorrect because you must enable the secrets engine before configuring any settings for it.

Study all Explain encryption as a service common traps →

A
Enable the AWS secrets engine, then configure the root IAM credentials, then create a role, then generate IAM credentials, then rotate root credentials.
This is the correct order because you must first enable the engine, then configure the root credentials to allow Vault to interact with AWS, then define a role for generating credentials, then generate the actual IAM credentials, and finally rotate the root credentials for security.
B
Enable the AWS secrets engine, then configure the root IAM credentials, then generate IAM credentials, then create a role, then rotate root credentials.
Why wrong: This order is incorrect because you must create a role before generating credentials; the role defines the permissions for the generated credentials.
C
Enable the AWS secrets engine, then create a role, then configure the root IAM credentials, then generate IAM credentials, then rotate root credentials.
Why wrong: This order is incorrect because you need to configure the root IAM credentials before creating a role, as the role configuration may depend on the root credentials.
D
Configure the root IAM credentials, then enable the AWS secrets engine, then create a role, then generate IAM credentials, then rotate root credentials.
Why wrong: This order is incorrect because you must enable the secrets engine before configuring any settings for it.

Full breakdown with real-world context →

Question 16mediummatching

Read the full Explain encryption as a service explanation →

Match each Vault response wrapping feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Lifetime of the wrapping token

Single-use token to unwrap response

Token-scoped storage for wrapped data

Retrieve the original response

Trap 1: Response Wrapping Token: A token that never expires and can be used…

Incorrect — response wrapping tokens are single-use and have an expiration (TTL).

Trap 2: Cubbyhole: A secret storage engine that replicates to all nodes in…

Incorrect — cubbyhole is per-token and does not replicate; it is local to the token.

Trap 3: TTL: The number of times a wrapped response can be unwrapped before…

Incorrect — TTL is a time duration, not a usage count.

Study all Explain encryption as a service common traps →

A
Response Wrapping Token: A single-use token that encapsulates a response, used to securely transfer secrets.
Response wrapping tokens are designed for one-time use to securely deliver secrets.
B
Cubbyhole: A space within the token's response that stores the secret, only accessible by the token holder.
Cubbyhole is a per-token secret storage that is automatically destroyed with the token.
C
TTL (Time-to-Live): The duration for which the wrapped response is valid before it expires.
TTL controls how long the wrapped response remains usable before expiration.
D
Response Wrapping Token: A token that never expires and can be used multiple times.
Why wrong: Incorrect — response wrapping tokens are single-use and have an expiration (TTL).
E
Cubbyhole: A secret storage engine that replicates to all nodes in a cluster.
Why wrong: Incorrect — cubbyhole is per-token and does not replicate; it is local to the token.
F
TTL: The number of times a wrapped response can be unwrapped before it expires.
Why wrong: Incorrect — TTL is a time duration, not a usage count.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full Explain encryption as a service explanation →

A developer wants to encrypt a password before storing it in a database. The encryption must be deterministic so that the same plaintext always produces the same ciphertext. Which encryption mode should be used in the transit secrets engine?

Trap 1: chacha20-poly1305

ChaCha20-Poly1305 also uses a random nonce, producing different ciphertexts.

Trap 2: aes128-gcm96

AES128-GCM96 is a variant of AES-GCM and still non-deterministic.

Trap 3: aes-gcm

AES-GCM uses a random nonce, making ciphertext non-deterministic.

Study all Explain encryption as a service common traps →

A
chacha20-poly1305
Why wrong: ChaCha20-Poly1305 also uses a random nonce, producing different ciphertexts.
B
convergent-encryption
Convergent encryption derives the nonce from the plaintext and context, making output deterministic.
C
aes128-gcm96
Why wrong: AES128-GCM96 is a variant of AES-GCM and still non-deterministic.
D
aes-gcm
Why wrong: AES-GCM uses a random nonce, making ciphertext non-deterministic.
E
padding
Why wrong: Padding is not an encryption mode; it's an option for some encryption operations.

Full breakdown with real-world context →

Question 18easymultiple choice

Read the full Explain encryption as a service explanation →

A DevOps team needs to encrypt large files (several GB) using Vault's transit engine. What is the recommended approach?

Trap 1: Use Vault's batch encryption

Batch encryption is for multiple small payloads, not for large files.

Trap 2: Use Vault's seal-wrapping feature

Seal-wrapping is for encrypting Vault data at rest, not for application data encryption.

Trap 3: Encrypt the file directly with Vault's transit encrypt API

Sending several GB through the API is inefficient and may hit size limits.

Study all Explain encryption as a service common traps →

A
Use Vault's batch encryption
Why wrong: Batch encryption is for multiple small payloads, not for large files.
B
Use Vault's seal-wrapping feature
Why wrong: Seal-wrapping is for encrypting Vault data at rest, not for application data encryption.
C
Use Vault's datakey endpoint to get a data encryption key, encrypt locally, then wrap with Vault
Envelope encryption: the data key is used locally and its ciphertext is stored alongside the encrypted file.
D
Encrypt the file directly with Vault's transit encrypt API
Why wrong: Sending several GB through the API is inefficient and may hit size limits.
E
Split the file into chunks and encrypt each chunk via transit
Why wrong: Still involves excessive API calls and network overhead.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Explain encryption as a service explanation →

A team has set up automatic key rotation on a transit key. After rotation, encrypted data that was encrypted with the previous key version can no longer be decrypted. What is the most likely cause?

Trap 1: The key was deleted

If the key is deleted, decryption would fail entirely, but rotation typically does not delete old versions.

Trap 2: The key's min_encryption_version is set too high

min_encryption_version affects encryption, not decryption.

Trap 3: The team used the 'rewrap' operation incorrectly

Rewrapping updates ciphertext to a newer version; incorrect use would not prevent decryption of old ciphertext.

Study all Explain encryption as a service common traps →

A
The key was deleted
Why wrong: If the key is deleted, decryption would fail entirely, but rotation typically does not delete old versions.
B
The key's min_decryption_version is set too high
If min_decryption_version is higher than the version used for encryption, decryption requests are rejected.
C
The key's min_encryption_version is set too high
Why wrong: min_encryption_version affects encryption, not decryption.
D
The team used the 'rewrap' operation incorrectly
Why wrong: Rewrapping updates ciphertext to a newer version; incorrect use would not prevent decryption of old ciphertext.
E
The key is not exportable
Why wrong: Exportable is unrelated to decryption capability; it controls key extraction.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Explain encryption as a service explanation →

What is the primary purpose of the Vault transit secrets engine?

Trap 1: Token generation

Token generation is a core Vault function, not specific to transit.

Trap 2: Certificate management

Certificate management is handled by PKI secrets engine.

Trap 3: Dynamic database credentials

Database credentials are provided by database secrets engine.

Study all Explain encryption as a service common traps →

A
Encryption and decryption as a service
Transit engine is designed for cryptographic operations.
B
Token generation
Why wrong: Token generation is a core Vault function, not specific to transit.
C
Certificate management
Why wrong: Certificate management is handled by PKI secrets engine.
D
Dynamic database credentials
Why wrong: Database credentials are provided by database secrets engine.
E
Secure storage of secrets
Why wrong: Secure storage is handled by KV secrets engine.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Explain encryption as a service sessions

Start a Explain encryption as a service only practice session

Every question in these sessions is drawn from the Explain encryption as a service domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Explain encryption as a service questions →Mixed VA-003 session

Frequently asked questions

What does the VA-003 exam test about Explain encryption as a service?: Explain encryption as a service questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Explain encryption as a service questions in a focused session?: Yes — the session launcher on this page draws every question from the Explain encryption as a service domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other VA-003 topics?: Use the topic links above to move to related areas, or go back to the VA-003 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the VA-003 exam covers. They are not copied from any real exam or dump site.

Explain encryption as a service only

10 questions 20 questions 30 questions 50 questions

Mixed VA-003 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All VA-003 questions Explain encryption as a service domain overview VA-003 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Explain encryption as a service practice questions

What to know about Explain encryption as a service

Common Explain encryption as a service exam traps

Explain encryption as a service questions

Which TWO capabilities are required in a Vault policy to allow a client to encrypt data using a key named 'app-key' in the transit engine? (Assume the key already exists.)

An application needs to encrypt credit card numbers. The encryption must be deterministic for indexing purposes but also support key rotation. Which approach should be used?

A DevOps team uses Vault's transit engine to encrypt secrets in CI/CD pipelines. They report that encryption operations are failing with 'permission denied' errors. The team has a policy granting 'create' and 'update' capabilities on the transit key path. What is the most likely missing capability?

A developer wants to encrypt data using Vault's transit engine with a key named 'payment-key'. The key already exists and is set to allow encryption. Which API path should the developer use to encrypt the data?

An organization wants to encrypt data at rest in a cloud storage bucket. They plan to use Vault's transit engine to generate a data key and then encrypt the data locally. Which transit endpoint should they use to get a data key?

Which TWO statements are true about Vault's encryption as a service using the transit engine?

A DevOps team needs to encrypt sensitive configuration data before storing it in a version control system. They want to use Vault's encryption as a service to encrypt the data using a named encryption key. Which Vault path should they use to perform the encryption?

Which TWO statements correctly describe Vault's encryption as a service using the Transit secrets engine?

After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?

Exhibit

Drag and drop the steps to configure Vault's AWS secrets engine to generate IAM credentials into the correct order.

Match each Vault response wrapping feature to its description.

A developer wants to encrypt a password before storing it in a database. The encryption must be deterministic so that the same plaintext always produces the same ciphertext. Which encryption mode should be used in the transit secrets engine?

A DevOps team needs to encrypt large files (several GB) using Vault's transit engine. What is the recommended approach?

A team has set up automatic key rotation on a transit key. After rotation, encrypted data that was encrypted with the previous key version can no longer be decrypted. What is the most likely cause?

What is the primary purpose of the Vault transit secrets engine?

Track your progress over time

Start a Explain encryption as a service only practice session

Related VA-003 topic practice pages

Compare authentication methods practice questions

Assess Vault tokens practice questions

Create Vault policies practice questions

Manage Vault leases practice questions

Compare and configure secrets engines practice questions

Utilize Vault CLI and API practice questions

Explain Vault architecture practice questions