VA-003 Practice Test 12 — 15 Questions

Question 1

An organization wants to encrypt data at rest in a cloud storage bucket. They plan to use Vault's transit engine to generate a data key and then encrypt the data locally. Which transit endpoint should they use to get a data key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

POST /v1/transit/datakey/plaintext/my-key. The correct endpoint to retrieve a data key that can be used for local client-side encryption is POST /v1/transit/datakey/plaintext/my-key. This endpoint returns both the plaintext data key (for local encryption) and the ciphertext version of the key (for secure storage alongside the encrypted data). The 'plaintext' in the path indicates that the response includes the key in plaintext form, which is necessary for performing encryption locally.

Answer

POST /v1/transit/encrypt/my-key

Answer

POST /v1/transit/decrypt/my-key

Answer

POST /v1/transit/datakey/ciphertext/my-key

Question 2

An administrator configures a database secrets engine with a role that uses 'creation_statements' and 'revocation_statements'. However, when a lease expires, the database user is not revoked. What is the most likely cause?

Accepted Answer

The revocation statement is incorrect. The most likely cause is that the revocation statement is incorrect. When a lease expires, Vault executes the SQL statement defined in `revocation_statements` to delete or disable the database user. If this statement has a syntax error, references a non-existent table, or fails to match the user created by `creation_statements`, the revocation will silently fail, leaving the user active in the database.

Answer

The connection string is invalid

Answer

The database user has been manually deleted

Answer

The lease duration is set too high

Question 3

Which TWO of the following are true about token accessors?

Accepted Answer

Accessors should be used in audit logs instead of token values. Token accessors are designed to be used in audit logs as a safe alternative to the actual token value. This prevents sensitive token data from being exposed in logs while still allowing correlation of events to a specific token. Option C is correct because an accessor is a unique identifier that references a token without revealing the token's secret value.

Answer

Accessors are the token value

Answer

Accessors can be used to renew the token

Question 4

A security administrator wants to create a policy that allows a service to renew its own token and list its own token capabilities, but not create new tokens. Which policy statements should be included?

Accepted Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["read"] }. It uses the correct endpoints and capabilities: update for renew-self and read for capabilities-self. Option B uses create for renew-self, which is incorrect (renew-self requires update). Option C uses update for capabilities-self, which is wrong (capabilities-self requires read). Option D uses non-self endpoints (renew and capabilities) which would allow renewing or checking capabilities of any token, granting broader privileges than intended.

Answer

path "auth/token/renew-self" { capabilities = ["create"] }; path "auth/token/lookup-self" { capabilities = ["read"] }

Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["update"] }

Answer

path "auth/token/renew" { capabilities = ["update"] }; path "auth/token/capabilities" { capabilities = ["read"] }

Question 5

An organization uses Vault's AWS secrets engine to generate temporary IAM credentials. The Vault administrator has set the default lease TTL on the AWS mount to 15 minutes. A developer creates a role with role TTL of 30 minutes and explicit max TTL of 1 hour. Which TWO statements are true regarding the lease behavior for credentials generated under this role?

Accepted Answer

The initial lease duration will be 30 minutes (the role TTL).. Option A is correct because when a role specifies its own TTL, that role TTL overrides the mount's default lease TTL, so the initial lease duration for credentials generated under this role is 30 minutes. Option B is correct because the role's explicit max TTL of 1 hour caps the total lifetime of the lease, meaning renewals can extend it only up to that 1-hour maximum. Option D is incorrect because the 15-minute default lease TTL applies only when the role does not define its own TTL. Option C is incorrect because an explicit max TTL prevents indefinite renewal and overrides the system max TTL. Option E is incorrect because Vault does not take the minimum of the default lease TTL and role TTL; the role TTL takes precedence for the initial lease duration.

Answer

The lease can be renewed indefinitely up to the system max TTL.

Answer

The initial lease duration will be 15 minutes (the default lease TTL).

Answer

The lease duration is the minimum of default lease and role TTL.

Question 6

Which THREE steps are required to configure the database secrets engine for generating dynamic credentials?

Accepted Answer

Create a role that maps to the database user and permissions. Option E is correct because the database secrets engine must first be enabled (e.g., `vault secrets enable database`) before any connections or roles can be created. Option C is correct because you must configure a database connection (`vault write database/config/`) with the plugin, connection URL, and privileged credentials Vault uses to create dynamic users. Option A is correct because a role (`vault write database/roles/`) defines the SQL statements and mappings that generate the dynamic credentials with the appropriate permissions. Option B is not required for generating credentials, since it only governs authorization to read them, and Option D is optional tuning rather than a required configuration step.

Answer

Configure a policy to allow users to read credentials from the role

Answer

Tune the engine's default TTL

Question 7

An administrator needs to revoke a token but wants to keep all child tokens that were created using this token as the parent. Which revocation operation should be used?

Accepted Answer

Orphan token revocation. Orphan token revocation is the correct operation because it revokes the parent token while preserving all child tokens that were created using it. This is achieved by removing the parent token's accessor and its associated policies, but leaving the child tokens' hierarchy intact so they continue to function independently. In Vault, this is done via the `vault token revoke -orphan` command or the corresponding API endpoint.

Answer

Immediate token revocation

Answer

Sudo token revocation

Answer

Self token revocation

Question 8

Which THREE are benefits of using Vault response wrapping?

Accepted Answer

Reduces the risk of secret exposure in transit. Option A is correct because Vault response wrapping returns a single-use wrapping token instead of the actual secret, so if the response is intercepted in transit the attacker only obtains a wrapping token that can be unwrapped once, reducing the risk of secret exposure. Option C is correct because a wrapping token is single-use: once it is unwrapped, the token is revoked and cannot be used again, which ensures the wrapped secret can be retrieved only once. Option E is correct because wrapping enables delegation of access without sharing the actual token — the wrapper can hand the wrapping token to another party (e.g., an app or trusted operator) who unwraps it to obtain a short-lived token with limited policy, without ever exposing the original token. Option B is not correct because wrapping tokens support only a single unwrap, not unlimited unwraps. Option D is not correct because response wrapping does not extend the TTL of the underlying secret; the wrapping token itself has a short TTL and the wrapped secret retains its own lease/TTL.

Answer

Supports unlimited unwraps

Answer

Increases the TTL of the secret

Question 9

A Vault cluster uses Integrated Storage. During a planned upgrade, the administrator wants to minimize downtime. Which upgrade strategy should be used?

Accepted Answer

Perform a rolling upgrade one node at a time. Integrated Storage (Raft-based) requires a quorum of nodes to maintain cluster availability. A rolling upgrade, where each node is upgraded one at a time, ensures that the cluster never loses quorum (more than half of the nodes remain online and functional), minimizing downtime while the upgrade proceeds.

Answer

Upgrade all nodes at once

Answer

Stop all nodes, upgrade, then start

Answer

Add new upgraded nodes then remove old ones

Question 10

Which THREE of the following are true statements about the AppRole authentication method? (Choose three.)

Accepted Answer

Vault can generate a wrapped Secret ID for secure delivery. Option B is correct because Vault's AppRole auth method supports response wrapping: the Secret ID can be returned as a wrapped response, and the single-use wrapping token is delivered to the target application so the Secret ID is never exposed in plaintext in transit. Option C is correct because a Secret ID can have CIDR bindings (secret_id_bound_cidrs) that restrict the source IP addresses allowed to use that Secret ID during login, adding a network-layer constraint. Option D is correct because the Role ID is a non-secret, stable identifier that the application presents at login, functioning much like a username, while the Secret ID acts as the corresponding secret credential. Option A is not correct because token policies are attached to the AppRole role/token, not embedded in the Secret ID itself; the Secret ID is just a credential value. Option E is not correct because a Secret ID is not inherently single-use — it can be used multiple times unless it is created with the single-use property (e.g., via secret_id_num_uses) or is a wrapped response token, which is single-use.

Answer

The Secret ID contains the token policies

Answer

The Secret ID can only be used once

Question 11

A company is deploying Vault in a high-availability configuration across three data centers. They need to ensure that if the active Vault node fails, another node can take over without manual intervention. Which Vault feature should they configure?

Accepted Answer

Configure Vault with a highly available storage backend such as Raft and enable automatic leader election.. Vault's integrated Raft storage backend supports automatic leader election via the Raft consensus protocol. When the active node fails, the remaining nodes automatically hold an election to select a new leader, ensuring high availability without manual intervention. This is the native HA mechanism for Vault when using Raft as the storage backend.

Answer

Enable performance standby nodes.

Answer

Use a load balancer with health checks to redirect traffic.

Answer

Set up Disaster Recovery (DR) replication between data centers.

Question 12

What is the purpose of the Seal/Unseal process in Vault architecture?

Accepted Answer

To enable Vault to process requests. The Seal/Unseal process in Vault is a security mechanism that protects the encryption key used to encrypt data at rest. When Vault starts, it is in a sealed state and cannot process any requests until it is unsealed by providing a threshold number of unseal keys (shards). Unsealing decrypts the master key in memory, allowing Vault to access the storage backend and serve API requests. Option D is correct because the primary purpose is to enable Vault to process requests after a secure startup.

Answer

To delete old secrets

Answer

To rotate the encryption key

Answer

To back up the storage backend

Question 13

Which THREE are appropriate use cases for Vault's Transit secrets engine?

Accepted Answer

Providing cryptographic offloading for applications running in untrusted environments. Option A is correct because the Transit secrets engine performs encryption/decryption as a service, so applications in untrusted environments can offload cryptographic operations to Vault without ever handling or storing the encryption keys themselves. Option D is correct because Transit supports signing and verification operations, allowing Vault to hold the signing key while the application submits data to be signed or verified. Option E is correct because Transit's encrypt/decrypt endpoints let an application encrypt sensitive database fields while the key material remains inside Vault, so the application never sees the encryption key. Option B is not a Transit use case; generating and managing TLS certificates is handled by the PKI secrets engine. Option C is not a Transit use case; storing and retrieving static secrets such as API keys is the role of the KV (Key/Value) secrets engine.

Answer

Generating and managing TLS certificates for internal services

Answer

Storing and retrieving static secrets like API keys

Question 14

Refer to the exhibit. Based on the output from 'vault status', which statement is true?

Accepted Answer

The unseal configuration uses 5 key shares with a threshold of 3.. The 'vault status' output shows 'Sealed: false', 'Key Shares: 5', and 'Key Threshold: 3'. This indicates that Vault is unsealed and uses a Shamir seal configuration with 5 key shares, requiring any 3 of them to unseal. Option B correctly states this unseal configuration.

Answer

The storage backend is a file backend.

Answer

Auto-unseal is enabled using Consul as the seal provider.

Answer

Vault is not configured for high availability.

Question 15

A user's token was revoked by an administrator, but the user can still read secrets from a KV v1 secrets engine. What is the most likely reason?

Accepted Answer

The secrets were from a KV v1 engine that does not use leases. KV v1 secrets engines do not issue leases for read operations, so token revocation does not affect access to previously read secrets. The token itself was revoked, but the user's ability to read secrets from KV v1 persists because the engine does not enforce lease-based expiration or revocation checks on stored data.

Answer

The token had sudo capabilities on the path

Answer

The token was a root token and cannot be revoked

Answer

The token was an orphan token and therefore immune to revocation