VA-003 Explain encryption as a service Practice Question
What is the primary purpose of the Vault transit secrets engine?
⚠ Common exam trap
HashiCorp often tests the distinction between 'encryption as a service' (transit engine) and 'secure storage of secrets' (KV engine), leading candidates to mistakenly choose Option E because they conflate encrypting data at rest with storing secrets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption and decryption as a service
The Vault transit secrets engine is designed to provide encryption and decryption as a service, allowing applications to encrypt and decrypt data without managing cryptographic keys directly. It offloads the cryptographic operations to Vault, which securely stores and rotates the encryption keys, ensuring that plaintext data never leaves the application unencrypted. This enables centralized key management and policy-based access control for encryption operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encryption and decryption as a service
Why this is correct
The transit secrets engine performs cryptographic operations on data in transit without storing it, so Vault handles encryption and decryption as a centralised service. Keys remain inside Vault, satisfying the requirement that applications never handle raw key material directly.
- ✗
Token generation
Why it's wrong here
Token generation is performed by the token auth method and Vault's identity system, not transit, which neither issues nor manages tokens. It tempts because Vault tokens underpin authentication to every engine, so this would be correct when the requirement is issuing client tokens or managing token lifecycle.
- ✗
Certificate management
Why it's wrong here
Certificate management belongs to the PKI secrets engine, which issues and revokes X.509 certificates; transit never handles certificate lifecycles. It tempts because Vault does manage certificates, but via a dedicated engine, so this would be correct only when the requirement is automated certificate issuance or revocation.
- ✗
Dynamic database credentials
Why it's wrong here
The transit engine performs cryptographic operations — encryption, decryption, signing, and hashing — without storing the data, so it does not generate database credentials. It is tempting because both are Vault secrets engines, but dynamic database credentials are produced by the database secrets engine.
- ✗
Secure storage of secrets
Why it's wrong here
Transit performs cryptographic operations on data sent to it, returning ciphertext without persisting the plaintext; the kv secrets engine provides secure storage. It tempts because Vault is known as a secrets store, so this would be correct when the requirement is reading and writing static secret values.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.