VA-003 Practice Test 1 — 10 Questions

Question 1

An administrator wants to use Vault's authentication method that allows users to log in with their corporate credentials via a federated identity system. The credentials are stored in an external identity provider (IdP) and Vault should not store any passwords. Which authentication method should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OIDC authentication. OIDC (OpenID Connect) authentication is the correct choice because it enables federated identity, allowing users to log in with corporate credentials managed by an external IdP (e.g., Azure AD, Okta) without Vault storing any passwords. Vault acts as a relying party, delegating authentication to the IdP and receiving identity tokens, which aligns with the requirement for a passwordless, federated approach.

Answer

LDAP authentication

Answer

Userpass authentication

Answer

Token authentication

Question 2

A security engineer wants to ensure that all requests to Vault are logged for compliance. Which component must be configured?

Accepted Answer

Audit Device. An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

Answer

Secrets Engine

Answer

Storage Backend

Answer

Auth Method

Question 3

Drag and drop the steps to configure Vault's AWS secrets engine to generate IAM credentials into the correct order.

Accepted Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then create a role, then generate IAM credentials, then rotate root credentials.. The correct sequence for configuring Vault's AWS secrets engine to generate IAM credentials is: first enable the AWS secrets engine at a path, then configure the root IAM credentials that Vault will use to interact with AWS, then create a role that defines the permissions for generated credentials, then generate the actual IAM credentials using that role, and finally rotate the root credentials to enhance security. This order ensures that each step's prerequisites are met.

Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then generate IAM credentials, then create a role, then rotate root credentials.

Answer

Enable the AWS secrets engine, then create a role, then configure the root IAM credentials, then generate IAM credentials, then rotate root credentials.

Answer

Configure the root IAM credentials, then enable the AWS secrets engine, then create a role, then generate IAM credentials, then rotate root credentials.

Question 4

An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

Accepted Answer

AWS IAM is eventually consistent and the user may take a few seconds to propagate.. AWS IAM is an eventually consistent system. When Vault uses the AWS secrets engine to create an IAM user via the CreateUser API call, the user is not immediately available across all AWS services due to propagation delays. This eventual consistency means the generated IAM user may take a few seconds to be fully usable, which is a known behavior of AWS IAM.

Answer

The Vault write operation failed due to network latency.

Answer

The TTL on the role is too short.

Answer

Vault must wait for the AWS secret key to be rotated before returning the user.

Question 5

A security team wants to issue tokens that can be used for exactly 10 API calls, after which they must be renewed. Which two token parameters should be set on the token role?

Accepted Answer

ttl and renewable. To meet the requirement that tokens can be used for exactly 10 API calls and then be renewed, you must avoid setting `num_uses` because tokens with `num_uses` set cannot be renewed. Instead, set `ttl` to a short duration (e.g., 1 minute) and `renewable` to true. This allows the token to be used for a limited time (though not exactly 10 calls) and be renewed repeatedly. While this does not enforce exactly 10 calls, it aligns with the constraint that `num_uses` prevents renewal, making this the only viable pair among the options.

Answer

period and num_uses

Answer

ttl and num_uses

Answer

num_uses and renewable

Question 6

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Accepted Answer

Barrier encryption key. The barrier encryption key is the master key used to encrypt and decrypt the Vault data encryption key (DEK), which in turn encrypts all data written to the storage backend. Without this key, Vault cannot protect data at rest because the DEK would be stored in plaintext. It is a fundamental component of Vault's security architecture, ensuring that even if the storage backend is compromised, the data remains encrypted.

Answer

Audit device

Answer

Authentication method

Question 7

A user attempts to read a secret at path 'secret/data/app' and receives a 403 Forbidden error. What is the most likely cause?

Accepted Answer

The token's policy does not grant read capability on that path. A 403 Forbidden error in Vault indicates that the token used for the request is valid and the path exists, but the token's attached policy does not grant the required 'read' capability on that specific path. This is a policy enforcement action by Vault's ACL system, which explicitly denies access when the policy lacks a matching 'read' rule for the path.

Answer

The secret engine is not mounted at 'secret/'

Answer

The secret key does not exist

Answer

The token has expired

Question 8

A company wants to grant developers the ability to read and write secrets under the path 'secret/dev/*', but only they should be able to delete their own secrets. Which policy design best meets this requirement?

Accepted Answer

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "secret/dev/{{identity.entity.name}}/*" { capabilities = ["delete"] }. It grants full CRUDL access to 'secret/dev/*' for reading and writing, but then restricts delete to only the path 'secret/dev/{{identity.entity.name}}/*', which uses the entity's name to ensure developers can only delete secrets under their own sub-path. This leverages Vault's identity entity name templating to enforce per-developer delete scoping.

Answer

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] }

Answer

path "secret/dev/*" { capabilities = ["read", "list"] }

Answer

path "secret/dev/+/{{identity.entity.name}}" { capabilities = ["create", "read", "update", "delete"] }

Question 9

An administrator wants to write a secret 'myapp' with value 'password=pass123' to the KV v2 secret engine mounted at 'secret/'. Which command should they use?

Accepted Answer

vault kv put secret/myapp password=pass123. `vault kv put` is the proper command to write or update a secret in the KV v2 secrets engine. The KV v2 engine requires the `put` subcommand to create or overwrite a secret at the specified path, and the syntax `vault kv put secret/myapp password=pass123` correctly writes the key-value pair to the path `secret/myapp` under the mounted engine at `secret/`.

Answer

vault kv write secret/myapp password=pass123

Answer

vault kv create secret/myapp password=pass123

Answer

vault write secret/myapp password=pass123

Question 10

When running Vault in development mode, which storage backend is used by default?

Accepted Answer

In-memory backend. When Vault is started in development mode using `vault server -dev`, it defaults to an in-memory storage backend. This is explicitly designed for local testing and development, as all data is stored in memory and lost when the process terminates. The in-memory backend requires no configuration and is automatically selected when no `-dev` flag overrides are provided.

Answer

Raft integrated storage

Answer

File system backend at /var/lib/vault

Answer

Consul backend