VA-003 Explain encryption as a service Practice Question
Which THREE of the following best practices should be followed when using Vault's encryption as a service with the transit engine?
⚠ Common exam trap
HashiCorp often tests the misconception that key deletion is a safe cleanup practice, but in the transit engine, deletion is irreversible and can cause data loss, whereas disabling or archiving keys is the correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a unique encryption key per application
Using a unique encryption key per application ensures cryptographic isolation: if one application's key is compromised, other applications' data remains secure. Vault's transit engine supports this by allowing you to create and manage multiple named keys, each with its own policy and rotation schedule, preventing cross-application data exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow deletion of keys to clean up unused keys
Why it's wrong here
Deleting keys can cause data loss; use archiving instead.
- ✓
Use a unique encryption key per application
Why this is correct
Provides isolation and limits blast radius.
- ✓
Enable key rotation automatically
Why this is correct
Automatic rotation reduces operational burden and improves security.
- ✓
Use encryption context to bind encrypted data to its intended use
Why this is correct
Encryption context provides additional authenticated data, preventing misuse of ciphertext.
- ✗
Store the key name in the application code for easy access
Why it's wrong here
Key names should be externalized, not hardcoded.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.