VA-003 Practice Test 13 — 15 Questions

Question 1

A company requires that Vault's master key be split into multiple key shares and distributed to different administrators using Shamir's Secret Sharing. They also need to ensure that Vault can automatically unseal if a majority of shares are provided but cannot rely on manual intervention. Which unseal approach should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Shamir seal with a threshold and use unseal keys via a key provider. Shamir seal (also known as the 'seal' wrapping mechanism) allows Vault to use Shamir's Secret Sharing to split the master key into shares, and then automatically unseal by providing those shares via a key provider (e.g., a cloud KMS or HSM) without manual intervention. This satisfies the requirement of splitting the key among administrators while enabling auto-unseal when a majority of shares are available.

Answer

Store the master key in the transit secrets engine and unseal automatically

Answer

Use AWS KMS as a seal for auto-unseal

Answer

Use a single unseal key stored in a password manager and manually unseal

Question 2

A small startup wants to run Vault in a development environment with minimal operational overhead. They need to store secrets in memory only, without any persistence. Which storage backend should they choose?

Accepted Answer

In-memory storage backend. The in-memory storage backend stores all data in RAM with no persistence to disk, making it ideal for development environments where secrets must be lost on restart and operational overhead must be minimized. It requires no configuration, no external dependencies, and no data management, perfectly matching the requirement for minimal overhead and memory-only storage.

Answer

Integrated Storage (Raft) backend

Answer

Consul storage backend

Answer

File storage backend

Question 3

An application encrypts data using the transit engine and stores the ciphertext in a database. After a key rotation, the application can no longer decrypt the data. What is the most likely cause?

Accepted Answer

The `min_decryption_version` was set to a value higher than the old key version. The `min_decryption_version` parameter in Vault's transit engine specifies the minimum key version that can be used for decryption. After a key rotation, if this value is set higher than the old key version, the engine will refuse to decrypt data encrypted with that older version, even if the old key data is still present in the key ring. This is a common misconfiguration that leads to decryption failures post-rotation.

Answer

The ciphertext was generated with a different key

Answer

The token used for decryption has been revoked

Answer

The key was rotated and the old version was automatically deleted

Answer

The transit engine was disabled

Question 4

A DevOps team needs to implement encryption as a service for application data stored in a PostgreSQL database. They want to use Vault's transit secrets engine to encrypt sensitive fields before storage. Which TWO actions should the team take to ensure the encryption keys are rotated automatically and securely?

Accepted Answer

Use a key derivation function with a unique context per application context to ensure each encryption produces distinct ciphertext.. Using a key derivation function (KDF) with a unique context per application ensures that each encryption operation produces distinct ciphertext even if the same plaintext and key are used. This prevents ciphertext correlation attacks and is a recommended practice when encrypting many records with the same key. Option E is correct because Vault's transit secrets engine supports the 'auto_rotate_period' parameter, which allows you to set a time-based automatic rotation schedule for the encryption key, ensuring keys are rotated without manual intervention.

Answer

Set 'min_decryption_version' to the latest key version to force re-encryption of old data.

Answer

Disable key rotation and rely on manual key updates using the transit key/rotate endpoint.

Answer

Restrict access to the decryption capability to prevent adversaries from learning the key material.

Question 5

An organization uses Vault to manage SSH access via the SSH secrets engine. They have a large number of servers, each with a unique host key. The admin configures the SSH secrets engine with a one-time password (OTP) type. Users report that sometimes they cannot authenticate to some servers because the OTP is not accepted. The admin reviews the logs and finds that the server's SSH daemon is not contacting Vault to verify the OTP. The SSH daemon is configured with the Vault SSH helper. What is the most likely cause?

Accepted Answer

The SSH helper's client certificate is expired or not properly configured.. The SSH helper is a client-side component that must authenticate to Vault using a client certificate (mTLS) before it can verify OTPs. If this certificate is expired or misconfigured, the SSH daemon cannot establish a trusted connection to Vault, causing OTP verification to fail silently. This directly explains why the server is not contacting Vault despite the helper being installed.

Answer

The SSH secrets engine's default TTL is too short.

Answer

The Vault server is under high load and dropping requests from SSH helpers.

Answer

The Vault server's IP address has changed and the SSH helper is using the old address.

Question 6

Refer to the exhibit. A developer receives this error when attempting to decrypt data. What is the most likely cause?

Accepted Answer

The ciphertext provided is not valid base64. The error indicates that the ciphertext provided is not valid base64. Vault's transit engine expects ciphertext to be base64-encoded; if the input is malformed or not properly encoded, the decryption operation fails with this specific error. This is the most direct cause given the error message.

Answer

The ciphertext is encrypted with a different key

Answer

The Vault server is not configured with the transit engine

Answer

The key mykey does not exist

Answer

The token used does not have permission to decrypt

Question 7

A company stores static secrets in Vault and requires that all data is encrypted at rest in the storage backend. Which Vault feature provides this encryption?

Accepted Answer

Vault's storage encryption via the barrier.. C is correct because Vault's storage encryption is handled by the security barrier, which automatically encrypts all data written to the storage backend using a 256-bit AES-GCM encryption key. This ensures that data is encrypted at rest regardless of the storage backend's own capabilities, meeting the requirement without relying on backend-specific features.

Answer

The storage backend must be configured to encrypt data.

Answer

The transit secrets engine for encrypting secrets.

Answer

The storage backend's built-in encryption (e.g., Consul's encryption).

Question 8

A DevOps engineer is troubleshooting an issue where a token cannot read a secret from the KV v2 engine at path 'secret/team-alpha/db-creds'. The token's policy includes the following: path "secret/team-alpha/*" { capabilities = ["read"] }. Which TWO reasons could explain the failure?

Accepted Answer

The path in the policy needs to be 'secret/data/team-alpha/*'. KV v2 engine requires the path prefix 'data/' after the mount path to access the actual secret data. The policy path 'secret/team-alpha/*' only covers the metadata and sub-paths, not the data endpoint. To read a secret, the policy must specify 'secret/data/team-alpha/*' with 'read' capability, as the actual secret retrieval occurs via the 'data/' sub-path.

Answer

The user needs to use the token's accessor to read the secret

Answer

The secret engine is not tuned to allow reads

Answer

The token is not a child of the root token

Question 9

A Vault agent is configured with auto-auth and is used to renew a long-running application's token. Which token type is best suited to minimize interruptions and avoid token renewal failures?

Accepted Answer

A periodic token. A periodic token is best suited for long-running applications because it has a fixed lifetime that is automatically renewed by the Vault agent's auto-auth mechanism, and it does not require an associated entity or parent token to remain valid. This eliminates the risk of renewal failures due to parent token expiration or policy changes, ensuring uninterrupted operation.

Answer

A root token

Answer

A service token with a short TTL

Answer

A batch token

Question 10

A DevOps team needs to encrypt large files (several GB) using Vault's transit engine. What is the recommended approach?

Accepted Answer

Use Vault's datakey endpoint to get a data encryption key, encrypt locally, then wrap with Vault. The transit engine is designed for encrypting small data payloads (typically a few KB), not multi-GB files. The recommended approach is to use the `/transit/datakey/plaintext` endpoint to generate a data encryption key (DEK), encrypt the large file locally with that DEK using a symmetric algorithm like AES-256-GCM, and then wrap (encrypt) the DEK with Vault using the transit engine. This keeps the large file out of Vault while still leveraging Vault for key management and audit logging.

Answer

Use Vault's batch encryption

Answer

Use Vault's seal-wrapping feature

Answer

Encrypt the file directly with Vault's transit encrypt API

Answer

Split the file into chunks and encrypt each chunk via transit

Question 11

Refer to the exhibit. What is the purpose of the -field=ciphertext flag in this command?

Accepted Answer

It instructs Vault to only return the ciphertext field from the response.. The `-field=ciphertext` flag in a Vault command instructs the CLI to extract and return only the value of the `ciphertext` key from the JSON response object. This is a standard Vault output filtering mechanism that allows users to isolate a specific field without parsing the full response, which is especially useful in scripting and automation.

Answer

It sets the ciphertext field for encryption.

Answer

It enables field-level encryption.

Answer

It specifies the encryption key name.

Answer

It outputs the command result to a file named ciphertext.

Question 12

An operator wants to enable the database secrets engine at a custom path 'db-creds'. Which command should be used?

Accepted Answer

vault secrets enable -path=db-creds database. The `vault secrets enable` command with the `-path` flag allows you to mount the database secrets engine at a custom path. The syntax `vault secrets enable -path=db-creds database` correctly specifies the custom path and the engine type, enabling the database secrets engine at the desired location.

Answer

vault secrets enable database

Answer

vault write sys/mounts/db-creds type=database

Answer

vault secrets tune -path=db-creds database

Question 13

A root token creates token T1 with a TTL of 1 hour. T1 then creates token T2 with a TTL of 2 hours. After 30 minutes, T1 is revoked without using the 'cascade' option. What happens to T2?

Accepted Answer

T2 becomes an orphan token and continues to work until its TTL expires. When a root token creates T1 and T1 creates T2, T2 is a child token of T1. Revoking T1 without the 'cascade' option only revokes T1 itself and its immediate leases, but does not propagate revocation to descendant tokens. T2 becomes an orphan token, meaning it loses its parent but continues to function independently until its own TTL of 2 hours expires. This behavior is by design in Vault to allow token hierarchies without forced cascading revocation.

Answer

T2 expires immediately

Answer

T2 is also revoked immediately

Answer

T2's TTL is reduced to match T1's remaining TTL

Question 14

What is the primary purpose of the Vault transit secrets engine?

Accepted Answer

Encryption and decryption as a service. The Vault transit secrets engine is designed to provide encryption and decryption as a service, allowing applications to encrypt and decrypt data without managing cryptographic keys directly. It offloads the cryptographic operations to Vault, which securely stores and rotates the encryption keys, ensuring that plaintext data never leaves the application unencrypted. This enables centralized key management and policy-based access control for encryption operations.

Answer

Token generation

Answer

Certificate management

Answer

Dynamic database credentials

Answer

Secure storage of secrets

Question 15

A developer wants to store an API key for their application in Vault using the key-value secrets engine. They need to be able to retrieve the key and also roll back to a previous version if needed. Which secrets engine configuration should they use?

Accepted Answer

Enable the KV v2 secrets engine at a custom path. The KV v2 secrets engine supports versioning, allowing retrieval of previous versions and rollback capabilities. This directly meets the requirement to store an API key and revert to an older version if needed. KV v1 does not support versioning, while Transit and Database engines serve different purposes (encryption and dynamic credentials, respectively).

Answer

Enable the Transit secrets engine at a custom path

Answer

Enable the KV v1 secrets engine at a custom path

Answer

Enable the Database secrets engine at a custom path