VA-003 Explain encryption as a service Practice Question
Which TWO of the following are valid uses of the Vault transit secrets engine?
⚠ Common exam trap
HashiCorp often tests the distinction between the transit engine's cryptographic operations (encrypt, decrypt, sign, verify) and the KV engine's static storage, leading candidates to mistakenly select 'storing static secrets' as a valid use.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Signing arbitrary data for verification
The Vault transit secrets engine can sign arbitrary data using a managed key, allowing verification of the signature's authenticity without exposing the key. This is a core encryption-as-a-service feature, enabling data integrity and non-repudiation for external systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Signing arbitrary data for verification
Why this is correct
Transit supports signing and verification operations.
- ✓
Encrypting data using a managed key
Why this is correct
Core function of transit engine.
- ✗
Generating random bytes for cryptographic salt
Why it's wrong here
This is available via `/sys/tools/random`, not transit.
- ✗
Exporting the encryption key for use outside Vault
Why it's wrong here
Exporting keys is disabled by default and not a primary use.
- ✗
Storing static secrets like API keys
Why it's wrong here
Static secrets are stored in KV engine.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.