VA-003 Practice Test 14 — 15 Questions

Question 1

Which TWO components are required for Vault to start and function? (Choose two.)

Accepted Answer

Storage backend. The storage backend is required because Vault must persist all data, including encrypted secrets, configuration, and audit logs, to a durable backend (e.g., Consul, Integrated Storage, or filesystem). Without a configured storage backend, Vault cannot initialize or start. The seal mechanism is required because Vault uses it to encrypt and decrypt the master key; the seal wraps the master key and must be unsealed before Vault can serve requests.

Answer

Authentication method

Answer

Listener

Answer

Audit device

Question 2

Which THREE of the following are capabilities of the PKI secrets engine? (Choose three.)

Accepted Answer

Revoke certificates. The PKI secrets engine in Vault supports certificate revocation via Certificate Revocation Lists (CRLs) or by directly marking a certificate as revoked in its storage backend. This is a core PKI lifecycle management capability, allowing operators to invalidate compromised or expired certificates immediately.

Answer

Automatically rotate certificates

Answer

Generate one-time pads

Question 3

After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?

Accepted Answer

The old key version is retained and used for decryption when the ciphertext references that version.. A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.

Answer

The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.

Answer

The ciphertext contains the original plaintext, so decryption simply extracts it.

Answer

The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.

Question 4

A DevOps team needs to provide temporary database credentials to applications without storing long-lived passwords. Which secrets engine should they use?

Accepted Answer

Database secrets engine. The Database secrets engine is designed to generate dynamic, short-lived database credentials on demand, allowing applications to access databases without storing long-lived passwords. It creates unique credentials for each request and automatically revokes them after a configurable TTL, meeting the requirement for temporary access without persistent secrets.

Answer

KV v2 secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 5

A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?

Accepted Answer

The admin did not assign any policies to the user.. The most likely issue is that the admin created the user 'dev1' but did not assign any policies to that user. In Vault's Userpass auth method, simply creating a user does not attach any policies; the admin must explicitly specify the policies when creating or updating the user. Without a policy attached, the token issued upon login has no capabilities, resulting in a permission denied error even if the policy 'webapp-readonly' exists.

Answer

The policy 'webapp-readonly' does not exist.

Answer

The user 'dev1' does not exist.

Answer

The password is incorrect.

Question 6

Which two of the following are valid lease operations? (Choose two.)

Accepted Answer

vault lease renew. `vault lease renew` is a valid Vault CLI command used to extend the lifetime of a lease before it expires. In HashiCorp Vault, leases are associated with dynamic secrets (e.g., database credentials, AWS IAM keys) and must be periodically renewed to maintain access. The `renew` operation is a core lease lifecycle operation supported by the Vault API and CLI.

Answer

vault lease create

Answer

vault lease delete

Answer

vault lease generate

Question 7

An administrator needs to enable authentication method for human users that integrates with an existing LDAP directory. The company wants to ensure that Vault can perform group-based policy assignment based on LDAP group membership. Which configuration step is mandatory to map LDAP groups to Vault policies?

Accepted Answer

Set the 'groups' attribute to 'memberOf'. The 'groups' attribute mapping must be set to point to the LDAP attribute containing group membership. The 'users' attribute is for user mapping, 'upndomain' is for UPN suffix, 'certificate' is for TLS.

Answer

Set the 'upndomain' parameter to 'company.com'

Answer

Set the 'users' attribute to 'sAMAccountName'

Answer

Set the 'certificate' parameter with the LDAP server certificate

Question 8

A new Vault administrator unseals Vault using a single unseal key, but the Vault remains sealed. What is the most likely cause?

Accepted Answer

The administrator did not provide enough unseal keys to meet the threshold.. Vault uses a threshold-based unsealing mechanism where a minimum number of unseal keys (the threshold) must be provided to reconstruct the master key and decrypt the storage backend. Providing only a single key, even if it is valid, leaves the Vault sealed because the threshold has not been met. The administrator must continue providing distinct unseal keys until the threshold count is reached.

Answer

The storage backend is misconfigured, preventing key retrieval.

Answer

The administrator forgot to provide a valid token.

Answer

Vault needs to be re-initialized after the first unseal.

Question 9

Which TWO of the following scenarios require the use of a periodic token?

Accepted Answer

A batch job that must continue running even if the parent token is revoked.. A periodic token is designed to allow a child token (e.g., for a batch job) to continue operating even after its parent token is revoked. This is achieved by setting the token's period to a finite duration, which decouples the child token's lifecycle from the parent's, enabling the batch job to run to completion without interruption.

Answer

A token that never expires and has a TTL of 0.

Answer

A human operator who needs a token that can be used for multiple sessions.

Answer

A token that should not be revoked when the token that created it is revoked.

Question 10

A company wants to encrypt sensitive data at rest in its application using HashiCorp Vault. They need to ensure that each application instance uses a unique encryption key without storing keys locally. Which TWO actions should the security team take to meet these requirements?

Accepted Answer

Enable key derivation on the transit key.. Enabling key derivation on a transit key allows each application instance to derive a unique encryption key from a single master key using a context value. This ensures that each instance uses a distinct key without storing keys locally, as the derived key is never persisted and is computed on-the-fly during encryption and decryption operations.

Answer

Create a separate transit key for each application instance.

Answer

Enable automatic key rotation on the transit key.

Answer

Store encryption keys in the KV secrets engine.

Question 11

A developer wants to use Vault to encrypt sensitive data before storing it in a database. They need to perform encryption and decryption operations without ever exposing the encryption key. Which secrets engine should they use?

Accepted Answer

Transit. The Transit secrets engine is designed specifically for encryption-as-a-service workflows, allowing applications to encrypt and decrypt data using keys managed entirely within Vault. The encryption key never leaves Vault, satisfying the requirement to avoid exposing the key. In contrast, other engines like KV v2 store raw secrets but do not perform cryptographic operations without exposing the key material.

Answer

PKI

Answer

KV v2

Answer

Database

Question 12

Refer to the exhibit. A developer issues a Vault CLI command to write a secret to path 'secret/data/team/billing'. What will be the outcome?

Accepted Answer

The write is denied because the second rule only allows read capability on the exact path, overriding the wildcard rule.. Vault policies are evaluated using a most-specific-path-wins model. The second rule explicitly allows 'read' on 'secret/data/team/billing', which is more specific than the wildcard rule 'secret/data/team/*'. Since the write operation requires 'create' or 'update' capabilities, and the specific rule only grants 'read', the write is denied even though the wildcard rule would have allowed it.

Answer

The write is denied because the policy does not include a 'write' capability.

Answer

The write is denied unless the developer is authenticated with a token that has sudo privileges.

Answer

The write is allowed if the developer uses the 'vault kv put' command with the -force flag.

Answer

The write is allowed because the first rule grants create and update to all paths under team/.

Question 13

An organization wants to encrypt data at rest in a cloud storage bucket. They plan to use Vault's transit engine to generate a data key and then encrypt the data locally. Which transit endpoint should they use to get a data key?

Accepted Answer

POST /v1/transit/datakey/plaintext/my-key. The correct endpoint to retrieve a data key that can be used for local client-side encryption is POST /v1/transit/datakey/plaintext/my-key. This endpoint returns both the plaintext data key (for local encryption) and the ciphertext version of the key (for secure storage alongside the encrypted data). The 'plaintext' in the path indicates that the response includes the key in plaintext form, which is necessary for performing encryption locally.

Answer

POST /v1/transit/encrypt/my-key

Answer

POST /v1/transit/decrypt/my-key

Answer

POST /v1/transit/datakey/ciphertext/my-key

Question 14

An administrator has created a policy file named 'app-policy.hcl'. Which command should they use to upload this policy to Vault?

Accepted Answer

vault policy write app-policy app-policy.hcl. The `vault policy write` command is the standard Vault CLI command to create or update a policy from a file. The syntax `vault policy write ` reads the HCL or JSON policy definition from the specified file and writes it to Vault's policy storage.

Answer

vault write sys/policy/app-policy @app-policy.hcl

Answer

vault create policy app-policy app-policy.hcl

Answer

vault set policy app-policy app-policy.hcl

Question 15

A company runs its containerized workloads on multiple Kubernetes clusters and also maintains a number of legacy virtual machines running critical applications. The Vault cluster is deployed outside Kubernetes and is used to manage secrets for both environments. The DevOps team has configured the Kubernetes auth method for pods in the Kubernetes clusters, but they are experiencing authentication failures for pods in one specific namespace. Meanwhile, legacy VMs cannot authenticate at all because they are not part of any Kubernetes cluster. The Vault administrator needs to enable authentication for all workloads while minimizing changes to existing applications. The administrator has received the following requirements: containerized pods should authenticate without manual token distribution, legacy VMs should use a method that supports machine-oriented authentication with short-lived tokens, and all authentication should be auditable. Which course of action should the administrator take?

Accepted Answer

Keep the Kubernetes auth method for pods (fixing the namespace-specific issue) and enable AppRole authentication for the legacy VMs, using response wrapping or trusted entities for SecretID delivery.. It preserves the existing Kubernetes auth method for pods (after fixing the namespace-specific issue) and introduces AppRole for legacy VMs, which provides machine-oriented authentication with short-lived tokens via SecretIDs. This approach minimizes changes to existing applications, meets the requirement for auditable authentication (both methods log to Vault audit devices), and avoids manual token distribution by using response wrapping or trusted entities for secure SecretID delivery.

Answer

Configure the LDAP auth method for both pods and legacy VMs, creating service accounts in Active Directory for each application.

Answer

Configure the Kubernetes auth method on all clusters and also install a Vault sidecar on the legacy VMs to make them appear as pods.

Answer

Use AppRole as the sole authentication method for all workloads, generating secret IDs for each pod and VM.