VA-003 Compare and configure secrets engines Practice Question
Which TWO of the following are correct statements about Vault secrets engines?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Transit secrets engine performs encryption operations without storing the encrypted data.
The Transit secrets engine performs encryption operations such as encrypt, decrypt, sign, and verify without storing the encrypted data. Option C is correct: dynamic secrets engines (e.g., database, AWS) generate credentials on demand with a configurable Time-to-Live (TTL). Option A is incorrect because each secrets engine instance is mounted at a single path; however, the same engine type can be enabled at multiple paths. Option D is incorrect because a KV engine is either version 1 (unversioned) or version 2 (versioned), not both simultaneously. Option E is incorrect because static secrets, such as database static roles, do support rotation to rotate passwords periodically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Secrets engines are enabled at a path, and each engine can be mounted at multiple paths.
Why it's wrong here
Each engine instance mounts at one path; multiple instances can exist for the same type at different paths.
- ✓
The Transit secrets engine performs encryption operations without storing the encrypted data.
Why this is correct
Transit acts as an encryption service; it stores keys but not the data payloads.
- ✓
Dynamic secrets engines generate credentials on demand and have a Time-to-Live (TTL).
Why this is correct
Dynamic engines like database and AWS produce ephemeral credentials with a TTL.
- ✗
The KV secrets engine can be configured to store both versioned and unversioned data simultaneously.
Why it's wrong here
A KV engine is either v1 (unversioned) or v2 (versioned); you cannot mix modes in one mount.
- ✗
Static secrets engines do not support rotation.
Why it's wrong here
Static secrets can be rotated; e.g., database static roles allow rotation periods.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.