VA-003
Encryption as a Service
medium
Question 1 of 8

A team rotates a transit encryption key and still needs previously encrypted data to remain readable. Which statement is correct?

AOld ciphertext cannot be decrypted after key rotation
BVault keeps prior key versions so old ciphertext can still be decrypted, and rewrap can move it to the latest version without exposing plaintext
CRotation automatically stores plaintext for recovery
DRotation converts all old ciphertext to static secrets

More Encryption as a Service Questions

8 questions

Full HashiCorp Certified: Vault Associate (003) Practice Test

All topics covered

All HashiCorp Certified: Vault Associate (003) Questions

Browse by topic

Related Questions

A developer uses the transit secrets engine to encrypt application data. Where is the plaintext stor...

easy

An application sends plaintext to transit/encrypt/my-key through the HTTP API. Why must the plaintex...

medium

A security team wants an almost untrusted process to move old transit ciphertext to the newest key v...

hard

An application stores transit ciphertext that begins vault:v3:. What does v3 identify?...

medium

A team wants identical plaintext values with the same context to produce identical transit ciphertex...

hard
View all Encryption as a Service questions

Educational Content — CertQnA practice questions are written against official exam objectives, covering the same domains tested on the real exam. All content is original and independent — not actual exam questions, not affiliated with any certification vendor. Learn more about our content policy

Discussion

Be the first to share your understanding of this concept

⚠️ Discussion is for concept clarification only. Do not share or request actual exam questions or answers.

Sign in to join the discussion

Sign InCreate free account