How Does Vault's Transit Engine Handle Decryption After Key Rotation?
Which TWO statements are true about Vault's encryption as a service using the transit engine?
Quick Answer
The answer is that Vault retains older key versions specifically to allow decryption of data encrypted before a rotation. This is correct because the transit engine’s key rotation creates a new version for encryption while preserving all previous versions solely for decryption, ensuring that ciphertext encrypted with an older key remains readable. On the HashiCorp Vault Associate VA-003 exam, this concept tests your understanding that rotation does not invalidate past ciphertext—a common trap is assuming rotation breaks backward compatibility. Instead, remember that decryption always uses the original key version that encrypted the data, so the engine never needs to re-encrypt old data. A useful memory tip: “Rotate to encrypt, retain to decrypt.”
⚠ Common exam trap
HashiCorp often tests the misconception that key rotation invalidates previous ciphertext, but Vault's transit engine retains old key versions specifically to allow decryption of data encrypted before rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data encrypted with a key can be decrypted with a later version of the same key if the key is rotated. [CORRECT]
Options B and C are correct. Option B is correct because the transit engine retains old key versions after rotation, allowing decryption of data encrypted with previous versions. Option C is correct because the transit engine supports convergent encryption, which allows encrypting the same plaintext with the same key to produce the same ciphertext, enabling deduplication. Option A is incorrect because keys can be rotated. Option D is incorrect because Vault does not store plaintext data; it only performs encryption/decryption without storing data. Option E is incorrect because Vault does not allow clients to provide their own key material; keys are generated internally by Vault.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encryption keys cannot be rotated once created. [wrong]
Why it's wrong here
Encryption keys can be rotated in the transit engine, so this statement is false.
- ✓
Data encrypted with a key can be decrypted with a later version of the same key if the key is rotated. [CORRECT]
Why this is correct
When a key is rotated, Vault creates a new version but retains old versions for decryption, so data encrypted with an earlier version can still be decrypted.
- ✓
The transit engine supports convergent encryption. [CORRECT]
Why this is correct
Convergent encryption is supported in the transit engine, allowing deterministic encryption for deduplication.
- ✗
Vault stores the plaintext data for audit purposes. [wrong]
Why it's wrong here
Vault does not store plaintext data; it only processes encryption/decryption requests.
- ✗
Clients can provide their own key material when creating a key. [CORRECT]
Why it's wrong here
Clients cannot provide their own key material; Vault generates keys internally. Even exportable keys are generated by Vault.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VA-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?
hard- ✓ A.The old key version is retained and used for decryption when the ciphertext references that version.
- B.The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.
- C.The ciphertext contains the original plaintext, so decryption simply extracts it.
- D.The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.
Why A: A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.