VA-003 Practice Test 10 — 10 Questions

Question 1

An administrator enables the database secrets engine for PostgreSQL. After configuring the connection, running `vault write database/config/someconfig` yields error: 'x509: certificate signed by unknown authority'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle. The error 'x509: certificate signed by unknown authority' indicates that Vault, when connecting to the PostgreSQL database, received a TLS certificate from the server that was not signed by any Certificate Authority (CA) present in Vault's trusted CA bundle. Vault uses its system's CA pool or a custom CA bundle configured in the connection string to verify the database server's certificate. If the PostgreSQL server uses a self-signed certificate or one issued by an internal CA not trusted by Vault, this error occurs. Option B correctly identifies that the PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle.

Answer

The connection string is incorrect

Answer

The database engine is not enabled

Answer

The Vault server's TLS certificate is self-signed

Question 2

A team is evaluating which secrets engines to use for different use cases. Which TWO statements about secrets engines are true?

Accepted Answer

The KV v2 secrets engine supports versioning and can store metadata like TTL. The KV v2 secrets engine stores multiple versions of a secret, supports metadata such as TTL and deletion time, and allows check-and-set operations for conflict detection. This makes it suitable for use cases requiring secret rotation and audit trails.

Answer

The AWS secrets engine can only generate static access keys

Answer

The Database secrets engine requires a root database user for all configurations

Answer

The Transit secrets engine can generate dynamic database credentials

Question 3

An application needs to obtain short-lived, time-limited credentials to access an external database using username/password authentication. Which secrets engine should be used?

Accepted Answer

Database secrets engine. The Database secrets engine is designed specifically to generate short-lived, dynamic credentials for databases, including external databases accessed via username/password authentication. It creates unique, time-limited usernames and passwords on-the-fly, which are automatically revoked after a configurable TTL, meeting the requirement for temporary credentials.

Answer

KV v2 secrets engine

Answer

Consul secrets engine

Answer

Identity secrets engine

Question 4

Refer to the exhibit. An application token has the above policy. Which operation will fail?

Accepted Answer

Listing keys in the transit engine. The policy shown in the exhibit grants 'create', 'update', 'delete', and 'deny' capabilities on the transit engine, but it does not include a 'list' capability. In Vault's transit secrets engine, listing keys requires the 'list' capability on the engine path. Without it, the operation will fail due to insufficient permissions, even though other key management operations are allowed.

Answer

Rotating the key mykey

Answer

Decrypting data using the key mykey

Answer

Encrypting data using the key mykey

Answer

Deleting the key mykey

Question 5

An operator needs to enable the KV v2 secrets engine at the path 'team-alpha'. Which command should they run?

Accepted Answer

vault secrets enable -path=team-alpha kv-v2. The `vault secrets enable` command with the `-path` flag specifies the mount path as 'team-alpha', and `kv-v2` is the correct engine type for the KV v2 secrets engine. This command mounts the KV v2 engine at the desired path, enabling versioned key-value storage.

Answer

vault secrets enable kv-v2 team-alpha

Answer

vault secrets enable -path=team-alpha kv

Answer

vault secrets mount -path=team-alpha kv

Question 6

A security team needs to audit all interactions with Vault, including requests that are denied due to policy violations. They want to ensure that even if the audit device is full, Vault does not halt operations. Which audit device configuration should they recommend?

Accepted Answer

File audit device with blocking=false and fallback path configured. The file audit device with `blocking=false` ensures that Vault does not block requests when the audit log cannot be written, preventing denial of service. The fallback path provides a secondary location to continue logging if the primary path fails, maintaining audit coverage without halting operations.

Answer

Socket audit device with a remote log aggregator

Answer

File audit device with blocking=true and a separate backup file

Answer

Syslog audit device with local syslog server

Question 7

A Vault operator runs 'vault secrets list' and sees 'cubbyhole/' mounted. What is the purpose of this engine?

Accepted Answer

Store secrets that are isolated per token. The cubbyhole secrets engine creates a private, ephemeral storage space that is scoped to a single Vault token. Secrets written to cubbyhole are only readable by the same token that wrote them and are automatically destroyed when the token expires or is revoked, making it ideal for token-specific secrets like a one-time password or a temporary key.

Answer

Store secrets encrypted by the Transit engine

Answer

Store secrets that are replicated across clusters

Answer

Store secrets with high availability

Question 8

A Vault administrator configures an AWS secrets engine role with credential_type=iam_user and attaches a policy that allows creating EC2 instances. A developer generates credentials and uses them to launch an EC2 instance. Later the lease expires and Vault revokes the IAM user. What happens to the EC2 instance?

Accepted Answer

The instance continues to run because IAM user revocation does not affect running instances. When Vault revokes an IAM user, it deletes the IAM user credentials, but this does not affect resources already launched by that user. The EC2 instance runs under its own instance profile and is not tied to the IAM user's session after launch. AWS does not retroactively terminate or stop instances based on IAM user revocation; the instance continues to run until explicitly stopped or terminated.

Answer

The instance fails with a permission error

Answer

The instance is immediately terminated

Answer

The instance is stopped after a grace period

Question 9

After migrating from an older version of Vault, the operator wants to replace the deprecated 'generic' secrets engine with a modern alternative. Which secrets engine should be used to store static key-value pairs?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is the modern replacement for the deprecated 'generic' secrets engine in Vault. It stores static key-value pairs with added features such as versioning, configurable delete and destroy behaviors, and check-and-set operations, making it the correct choice for this use case.

Answer

AWS secrets engine

Answer

Database secrets engine

Answer

Transit secrets engine

Question 10

Which TWO statements are true when troubleshooting a failed Vault CLI command?

Accepted Answer

Run 'vault token lookup' to verify the token is valid and has the expected policies.. `vault token lookup` is the standard diagnostic command to inspect the current token's metadata, including its validity, creation time, TTL, and associated policies. If the token is expired, revoked, or lacks the necessary policies for the failed command, this command will reveal the issue directly without side effects.

Answer

Run 'vault write' to test if the token can write to a path.

Answer

Run 'vault status' to check if the server is reachable.

Answer

Run 'vault read' to test if any secret is accessible.