VA-003 Compare and configure secrets engines Practice Question
Which TWO of the following are valid secrets engines in Vault? (Select exactly 2.)
⚠ Common exam trap
HashiCorp often tests the distinction between 'auth methods' and 'secrets engines' — candidates confuse LDAP (an auth method) with a secrets engine, or assume SSH is not a secrets engine because it is commonly used for authentication, but SSH is indeed a valid secrets engine for credential management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active Directory
Options A (Active Directory) and C (SSH) are both valid secrets engines in Vault. Option B (AWS) is also a secrets engine but not one of the two required answers. Option D (LDAP) is an auth method, not a secrets engine. Option E (Transit) is also a valid secrets engine, but the question expects the two that are most directly related to credential management, hence A and C are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Active Directory
Why this is correct
Correct. Active Directory is a valid secrets engine that rotates and manages AD service account passwords.
- ✗
AWS
Why it's wrong here
Incorrect. AWS is a valid secrets engine, but it is not one of the two correct answers for this question.
- ✓
SSH
Why this is correct
Correct. SSH is a built-in secrets engine that manages SSH key credentials.
- ✗
LDAP
Why it's wrong here
Incorrect. LDAP is an auth method, not a secrets engine.
- ✗
Transit
Why it's wrong here
Incorrect. Transit is a valid secrets engine, but it is not one of the two correct answers for this question.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.