VA-003 Practice Test 10 — 10 Questions

Question 1

A DevOps team needs to encrypt sensitive configuration data before storing it in a version control system. They want to use Vault's encryption as a service to encrypt the data using a named encryption key. Which Vault path should they use to perform the encryption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

POST /v1/transit/encrypt/my-key. The correct path for encrypting data using Vault's encryption-as-a-service is POST /v1/transit/encrypt/my-key. The Transit secrets engine provides encryption as a service, and the /encrypt endpoint is specifically designed to encrypt plaintext data using a named encryption key. The key name 'my-key' in the path identifies which key in the Transit engine should be used for the encryption operation.

Answer

POST /v1/transit/sign/my-key

Answer

POST /v1/transit/hmac/my-key

Answer

POST /v1/transit/random

Answer

POST /v1/transit/decrypt/my-key

Question 2

A company needs to generate short-lived, dynamic database credentials for its MySQL instances. Which secrets engine should be configured?

Accepted Answer

Database secrets engine. The Database secrets engine is specifically designed to generate short-lived, dynamic credentials for databases like MySQL. It creates unique, time-bound usernames and passwords on demand, which aligns with the requirement for temporary database access without manual credential management.

Answer

KV secrets engine

Answer

AWS secrets engine

Answer

PKI secrets engine

Question 3

Drag and drop the steps to configure Vault's database secrets engine with PostgreSQL into the correct order.

Accepted Answer

Enable the database secrets engine, then configure the PostgreSQL connection, then create a role, then generate credentials, and finally revoke the lease.. The correct sequence for configuring Vault's database secrets engine with PostgreSQL is: first enable the secrets engine, then configure the database connection, then create a role that defines the credential generation parameters, then generate credentials, and finally revoke the lease when done. This order ensures all prerequisites are met at each step.

Answer

Configure the PostgreSQL connection, then enable the database secrets engine, then create a role, then generate credentials, and finally revoke the lease.

Answer

Create a role, then configure the PostgreSQL connection, then enable the database secrets engine, then generate credentials, and finally revoke the lease.

Answer

Generate credentials, then create a role, then configure the PostgreSQL connection, then enable the database secrets engine, and finally revoke the lease.

Question 4

A Vault administrator wants to allow users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it enables Vault to authenticate users against an external corporate Active Directory (AD) server. Vault's LDAP auth method binds to the AD directory using a service account, then validates user credentials via a simple bind operation, allowing seamless integration with existing corporate identity infrastructure.

Answer

Okta

Answer

AppRole

Answer

Userpass

Question 5

A token with a policy granting 'write' on 'secret/team-alpha/*' is unable to write to 'secret/team-alpha/db-creds' in a KV v2 engine. What is the most likely cause?

Accepted Answer

The policy path should be 'secret/data/team-alpha/*' for KV v2. D is correct because in Vault's KV v2 engine, the actual data path is prefixed with 'data/' after the mount path. A policy granting 'write' on 'secret/team-alpha/*' targets the metadata path, not the data path. To write secrets, the policy must use 'secret/data/team-alpha/*' to match the correct API endpoint.

Answer

The token is not a root token

Answer

The token's TTL has expired

Answer

The token has a conflicting policy from a parent token

Question 6

A security audit requires tracking token usage without exposing the token value itself. Which token attribute should be logged?

Accepted Answer

Token accessor. The token accessor is a non-sensitive reference to a Vault token that can be used for token lifecycle operations (e.g., lookup, renewal, revocation) without exposing the actual token value. Logging the accessor satisfies audit requirements for tracking token usage while maintaining security, as the accessor cannot be used to authenticate requests.

Answer

Token value

Answer

Creation TTL

Answer

Policy list

Question 7

A Vault cluster is sealed. An operator attempts to renew a lease but gets an error. What is the most likely error?

Accepted Answer

Vault is sealed. When Vault is sealed, it cannot process any operations, including lease renewal. The error would indicate the sealed state.

Answer

Upstream error

Answer

Permission denied

Answer

Lease not found

Question 8

A CI/CD pipeline needs to generate thousands of short-lived tokens each day for jobs that run for at most 5 minutes. The tokens should not be renewable or revocable individually. Which token type should be used?

Accepted Answer

Batch tokens. Batch tokens are designed for high-volume, short-lived workloads where tokens are generated in batches and have a configurable TTL (time-to-live). They cannot be renewed or revoked individually, making them ideal for CI/CD pipelines that need thousands of tokens per day for jobs lasting at most 5 minutes.

Answer

Orphan tokens

Answer

Service tokens

Answer

Periodic tokens

Question 9

A company uses Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. Clients in eu-west-1 report that they receive stale data when reading from the local secondary cluster's active node. What is the most likely cause?

Accepted Answer

The replication filter is excluding certain paths.. In Vault Enterprise Performance Replication, replication filters can be configured to exclude specific paths (e.g., secret engines or policies) from being replicated to secondary clusters. If a filter excludes certain paths, the secondary cluster will not receive updates for those paths, causing clients reading from the local secondary to see stale or missing data. This matches the symptom of stale reads on the secondary's active node.

Answer

The secondary cluster has not enabled performance standby.

Answer

The cluster is in 'primary_failover' mode.

Answer

The secondary cluster is in primary state instead of secondary.

Question 10

An administrator notices that after revoking a specific lease, the underlying database credential is still accessible. What is the most likely cause?

Accepted Answer

The revocation script failed to delete the database user.. When a lease is revoked in Vault, the revocation script associated with the database secret engine is responsible for deleting or disabling the corresponding database user. If that script fails (e.g., due to insufficient permissions, network issues, or a bug in the script), the underlying credential remains active in the database, even though the lease is no longer valid in Vault. This is a common operational issue where the lease lifecycle and the actual credential lifecycle become out of sync.

Answer

The secret engine caches credentials.

Answer

The lease ID was incorrect.

Answer

The lease was renewed after revocation.