VA-003 Practice Test 11 — 15 Questions

Question 1

A company is deploying Vault in a Kubernetes environment. Which three components are essential for a production-ready Vault on Kubernetes? (Choose three.)

Accepted Answer

A persistent volume claim for each Vault pod for storage.. Vault requires durable storage for its encrypted data (the storage backend). In Kubernetes, a PersistentVolumeClaim (PVC) provides this durable block or file storage that survives pod restarts. Without a PVC, Vault would lose its data when the pod is rescheduled, making it unsuitable for production.

Answer

A ConfigMap to store Vault configuration including unseal keys.

Answer

An Ingress controller to expose Vault externally.

Question 2

A company uses Vault to manage secrets for multiple applications. A new security policy requires that all human users authenticate using LDAP and that all machine-to-machine authentication uses AppRole. An administrator has configured an LDAP auth method at 'ldap/' and an AppRole at 'approle/'. The administrator creates a role 'web-app' with a secret ID TTL of 30 days and a token TTL of 1 hour. After deploying the web application, the application successfully logs in using the AppRole role ID and secret ID, retrieves a token, and reads secrets. However, after 1 hour, the application begins receiving 'permission denied' errors when trying to read secrets. The application logs show that it is using the same token obtained during initial login. Which action should the administrator take to resolve this issue?

Accepted Answer

Configure the application to renew the token before it expires by calling the 'auth/token/renew' endpoint.. The application's token has a TTL of 1 hour, and once it expires, Vault will reject any further requests using that token. The application must renew the token before it expires by calling the 'auth/token/renew' endpoint, which extends the token's lifetime (up to the maximum TTL configured on the role). This is the standard pattern for long-running applications using short-lived tokens.

Answer

Increase the secret ID TTL to 60 days so the application can re-authenticate less frequently.

Answer

Set the token TTL to 0 (unlimited) so the token never expires.

Answer

Have the application re-authenticate with the AppRole using the same secret ID after the token expires.

Question 3

A DevOps engineer configures the AWS secrets engine to assume a specific IAM role for generating dynamic credentials. The engine is enabled and the root configuration is set. Which parameter is essential in the role configuration to allow assuming the IAM role?

Accepted Answer

arn. The `arn` parameter is essential in the role configuration for the AWS secrets engine because it specifies the Amazon Resource Name (ARN) of the IAM role that Vault will assume to generate dynamic credentials. Without this parameter, Vault cannot identify which IAM role to assume via AWS STS AssumeRole API, making dynamic credential generation impossible.

Answer

role_type

Answer

credential_type

Answer

inline_policy

Question 4

Refer to the exhibit. An admin wants to ensure this token can be used for 60 hours total. Which action should be taken?

Accepted Answer

Create a new token with explicit_max_ttl=60h.. The token's current `explicit_max_ttl` is set to 48h, and the `creation_ttl` (24h) cannot be increased beyond that bound. To achieve a total lifetime of 60 hours, a new token must be created with `explicit_max_ttl=60h`, which overrides the default or role-based TTL limits and sets the absolute maximum lifetime for the token.

Answer

Increase the creation_ttl to 60h.

Answer

The token will expire after 48h, so increase explicit_max_ttl to 60h on the current token.

Answer

The token already can be used for 60h because it is renewable.

Question 5

Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?

Accepted Answer

AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.. AppRole authentication indeed requires a RoleID and SecretID to be presented by the client to obtain a Vault token, whereas Kubernetes authentication requires a service account token (a JWT) that is signed by the Kubernetes API server. This is a fundamental difference in the credential material each method uses to prove identity.

Answer

Kubernetes auth requires the secret_id to be specified in a configuration file.

Answer

Both AppRole and Kubernetes support response wrapping for initial credentials.

Answer

AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.

Question 6

A company has multiple Vault clusters in different regions. They want to use the replication feature to synchronise secrets across clusters. However, they want to exclude a specific secrets engine from replication for compliance reasons. What should they do?

Accepted Answer

Use performance replication and configure a mount filter.. Performance replication in Vault allows you to replicate secret data across clusters while using mount filters to include or exclude specific secrets engines. This is the correct approach because mount filters are designed precisely for this use case, enabling selective replication to meet compliance requirements without creating separate infrastructure.

Answer

Create a separate Vault cluster for that secrets engine.

Answer

Disable replication on that specific mount.

Answer

Use disaster recovery (DR) replication and exclude the mount.

Question 7

Refer to the exhibit. A user with this policy attempts to read the secret at path "secret/data/team-a/admin". What will happen?

Accepted Answer

The read is denied because the deny policy takes precedence.. The deny policy takes precedence over any allow policy in Vault, regardless of the path specificity. Even though the first path grants read access to 'secret/data/team-a/*', the second path explicitly denies all capabilities (including read) on 'secret/data/team-a/admin', which is a more specific path. Vault's policy evaluation uses a deny-overrides model, so the deny action blocks the read operation.

Answer

The read fails because the path does not exist.

Answer

The read succeeds because the first path grants read.

Answer

The read succeeds because deny only applies to write operations.

Question 8

An administrator is configuring the Transit secrets engine for encryption as a service. Which TWO configuration options are valid?

Accepted Answer

Enabling automatic key derivation per context. The Transit secrets engine supports key derivation, which allows a base key to be combined with a user-supplied context value to generate a unique encryption key per context. This enables multiple parties to use the same base key while deriving distinct keys for different data sets, enhancing security without managing separate keys. Option D is correct because the Transit engine allows administrators to set a rotation period for encryption keys, automatically rotating the key after a specified interval to comply with cryptographic best practices.

Answer

Using the engine to generate one-time passwords

Answer

Configuring the engine to export the key in plaintext

Answer

Setting a TTL on the key itself

Question 9

Which TWO of the following are components of Vault's architecture? (Choose two.)

Accepted Answer

Barrier. The Barrier and Seal are fundamental components of Vault's architecture. The Barrier is an encryption layer that protects all data written to storage by encrypting it with a master key before it is persisted. The Seal is the mechanism that wraps the master key, requiring an unseal process (using Shamir's Secret Sharing or an external key service like AWS KMS) to decrypt the master key and make Vault operational.

Answer

Senlin

Answer

Consul Template

Answer

Vault Agent

Question 10

A user 'john' logs in via the userpass method. The output shows a token with a duration of 768 hours. However, the userpass mount is configured with `token_ttl=24h`. What is the most likely reason for the longer token duration?

Accepted Answer

The user has a custom `ttl` set in the userpass configuration for user 'john'.. The userpass mount allows per-user TTL overrides via the `token_ttl` parameter when creating or updating a user. Even though the mount has a default `token_ttl=24h`, if user 'john' was configured with a specific `token_ttl` of 768 hours, that per-user setting takes precedence over the mount-level default. This is a common way to grant specific users longer token lifetimes without changing the mount's default policy.

Answer

The system backend is configured with a max_ttl that overrides the mount setting.

Answer

The mount token_ttl is only applied if the user does not specify a `token_policies` parameter.

Answer

The token was issued with a periodic token and ignores the TTL.

Question 11

Which Vault CLI command is used to authenticate a user with a username and password to the userpass auth method?

Accepted Answer

vault login -method=userpass username=alice password=secret. `vault login -method=userpass` is the standard Vault CLI command to authenticate against the userpass auth method, passing the username and password as parameters. This command triggers the login endpoint (`/v1/auth/userpass/login/:username`) and returns a client token upon successful authentication.

Answer

vault auth userpass username=alice password=secret

Answer

vault token create -policy=userpass

Answer

vault authenticate userpass username=alice password=secret

Question 12

Which Vault component is responsible for encrypting data before storing it in the storage backend?

Accepted Answer

Barrier. The Barrier (also known as the Security Barrier) is the Vault component responsible for encrypting all data before it is written to the storage backend. It wraps every entry with encryption using the master key, ensuring that data at rest is never stored in plaintext. This is a core architectural layer that provides a cryptographic boundary between Vault's internal operations and the underlying storage.

Answer

Storage Backend

Answer

Audit Device

Answer

Secrets Engine

Question 13

Which TWO are benefits of using Vault's encryption as a service?

Accepted Answer

Allows applications to delegate encryption/decryption to Vault without handling keys. Vault's encryption as a service allows applications to offload encryption and decryption operations to Vault via its API, without the application ever handling or storing encryption keys. This reduces the risk of key exposure and simplifies compliance with security policies.

Answer

Enables encryption of data at rest in cloud storage

Answer

Eliminates the need for any network connectivity to Vault

Answer

Supports only symmetric key algorithms

Question 14

A company is deploying Vault in a high-availability configuration across three data centers. They need to ensure that if the active Vault node fails, another node can take over without manual intervention. Which Vault feature should they configure?

Accepted Answer

Configure Vault with a highly available storage backend such as Raft and enable automatic leader election.. Vault's integrated Raft storage backend supports automatic leader election via the Raft consensus protocol. When the active node fails, the remaining nodes automatically hold an election to select a new leader, ensuring high availability without manual intervention. This is the native HA mechanism for Vault when using Raft as the storage backend.

Answer

Enable performance standby nodes.

Answer

Use a load balancer with health checks to redirect traffic.

Answer

Set up Disaster Recovery (DR) replication between data centers.

Question 15

A DevOps engineer is designing a Vault architecture for a multi-cloud environment spanning AWS, GCP, and on-premises data centers. The requirement is to have low-latency read access to secrets across all regions, and the ability to handle a full regional outage without manual intervention. Which architecture best meets these requirements?

Accepted Answer

Single Vault cluster spread across all regions using Integrated Storage with voter and non-voter nodes.. A single Vault cluster using Integrated Storage with voter and non-voter nodes can span multiple regions and clouds, providing low-latency reads via local non-voter nodes while maintaining a single Raft consensus group. This architecture handles a full regional outage without manual intervention because the Raft protocol automatically maintains quorum across voter nodes, and non-voter nodes can be promoted if needed, ensuring continuous read availability and automatic failover.

Answer

Single Vault cluster with performance standby nodes in each region.

Answer

Multiple Vault clusters with disaster recovery replication using Performance Replication.

Answer

Multiple Vault clusters with Disaster Recovery (DR) replication and an automated failover script that promotes a DR cluster to primary.