How Does Vault's Transit Engine Handle Decryption After Key Rotation?
Exhibit
Refer to the exhibit. ``` $ vault write -f transit/keys/payment-key Success! Data written to: transit/keys/payment-key $ vault write transit/encrypt/payment-key plaintext=$(base64 <<< "4111111111111111") Key Value --- ----- ciphertext vault:v1:abc123... $ vault write -f transit/keys/payment-key/rotate Success! Data written to: transit/keys/payment-key/rotate $ vault write transit/encrypt/payment-key plaintext=$(base64 <<< "4111111111111111") Key Value --- ----- ciphertext vault:v2:def456... $ vault write transit/decrypt/payment-key ciphertext=vault:v1:abc123... Key Value --- ----- plaintext NDExMTExMTExMTExMTExMQ== ```
After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?
⚠ Common exam trap
HashiCorp often tests the misconception that key rotation invalidates old ciphertext, but the trap here is that candidates assume the old key is deleted or replaced, when in fact Vault retains it for decryption based on ciphertext metadata.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The old key version is retained and used for decryption when the ciphertext references that version.
A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The old key version is retained and used for decryption when the ciphertext references that version.
Why this is correct
Vault's key ring retains prior key versions after rotation. Ciphertext stores the version used at encryption, so decryption retrieves that retained version rather than the new key, which is why data encrypted under v1 still decrypts successfully.
- ✗
The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.
Why it's wrong here
Rotation retains all previous key versions in the keyring, so v1 ciphertext still decrypts; versions are not deleted on rotation. This option is tempting because ciphertext does embed its key version, but that metadata enables lookup of the retained old key, not decryption by the new one.
- ✗
The ciphertext contains the original plaintext, so decryption simply extracts it.
Why it's wrong here
Vault's transit engine never stores ciphertext alongside recoverable plaintext; decryption succeeds because the old key version remains in the keyring, letting Vault derive it for v1 ciphertext. The option confuses encryption with reversible obfuscation, which would be the case only for encoding schemes like Base64, not cryptographic ciphers.
- ✗
The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.
Why it's wrong here
Vault's transit secrets engine performs cryptographic operations without persisting plaintext; the old key version is retained in the keyring so v1 ciphertext still decrypts. Storing plaintext would defeat the purpose of encryption and is what a password manager or KV secrets store does, not a transit engine.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.