VA-003 Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. A Vault policy is defined as shown. A user presents a token with this policy. Which operation will be permitted?

Accepted Answer

Create secret/data/engineering/config. The policy grants `create` and `update` capabilities on `secret/data/engineering/*`, which allows creating secrets under that path. Option C is correct because the `create` capability permits writing a new secret at `secret/data/engineering/config`, as the path matches the glob pattern and the operation is a write (POST/PUT).

Answer

List secret/data/finance

Answer

Delete secret/data/finance/budget

Answer

Read secret/data/finance

Question 2

Match each Vault response wrapping feature to its description.

Accepted Answer

Response Wrapping Token: A single-use token that encapsulates a response, used to securely transfer secrets.. In Vault, response wrapping uses a single-use token with a cubbyhole to store secrets, and the TTL determines its validity. Common confusions include thinking the token can be reused or that cubbyhole is a replicated storage engine.

Answer

Response Wrapping Token: A token that never expires and can be used multiple times.

Answer

Cubbyhole: A secret storage engine that replicates to all nodes in a cluster.

Answer

TTL: The number of times a wrapped response can be unwrapped before it expires.

Question 3

Drag and drop the steps to initialize and unseal a Vault server for the first time into the correct order.

Accepted Answer

Start the server, then initialize Vault, then distribute the unseal keys, then unseal the Vault, then verify the status.. The correct sequence for initializing and unsealing a Vault server for the first time is: start the server, initialize Vault (which generates unseal keys), distribute the unseal keys to key holders, unseal the Vault using a threshold of keys, then verify the Vault is unsealed. This ensures proper security and operational readiness.

Answer

Initialize Vault, then start the server, then distribute the unseal keys, then unseal the Vault, then verify the status.

Answer

Start the server, then initialize Vault, then unseal the Vault, then distribute the unseal keys, then verify the status.

Answer

Start the server, then distribute the unseal keys, then initialize Vault, then unseal the Vault, then verify the status.

Question 4

Match each Vault term to its definition.

Accepted Answer

Secret: A piece of sensitive data stored in Vault. Correct matches: Secret is sensitive data; Token is an authentication credential. Common confusions: Policy vs. Auth Method — policies control access, auth methods authenticate users.

Answer

Policy: A method used to authenticate a user or machine to Vault

Answer

Auth Method: A set of rules defining access permissions in Vault

Question 5

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data

Question 6

Refer to the exhibit. What seal mechanism is configured for this Vault instance?

Accepted Answer

AWS KMS auto-unseal. The exhibit shows a Vault instance configured with `seal "awskms"` and a `region` and `kms_key_id` specified. This indicates that AWS KMS is used as the auto-unseal mechanism, where Vault delegates the unsealing process to AWS Key Management Service, eliminating the need for manual Shamir key shares.

Answer

HSM seal via PKCS#11

Answer

Shamir seal with default shares

Answer

No seal; Vault is in insecure mode

Question 7

A financial services company uses HashiCorp Vault's transit engine to encrypt customer credit card numbers. The application sends each credit card number individually to Vault for encryption, and the response time is acceptable. However, during peak hours, the company needs to encrypt large batches of 10,000 credit card numbers. Users report that encrypting the entire batch takes several minutes, causing timeouts. The Vault cluster is healthy and not under high load. The security team wants to reduce the encryption time without changing the encryption algorithm or key strength. What should they do?

Accepted Answer

Use the `batch_input` parameter to encrypt multiple plaintexts in one API call.. The `batch_input` parameter allows sending multiple plaintexts in a single API call to Vault's transit engine, significantly reducing the overhead of individual HTTP requests and TLS handshakes. This directly addresses the batch encryption timeout issue without changing the encryption algorithm or key strength, as the Vault cluster is healthy and not under load, indicating the bottleneck is network round-trips, not cryptographic computation.

Answer

Enable key derivation on the transit key to allow parallel encryption.

Answer

Enable convergent encryption to reuse ciphertexts.

Answer

Switch to an AES-256-GCM key for faster encryption.

Question 8

Which TWO best practices should be followed when tuning secrets engine mounts?

Accepted Answer

Configure 'max_lease_ttl' to limit the maximum duration secrets can be valid. Setting a low default lease TTL and enforcing maximum TTL per mount helps control secret lifetimes and reduce risk. Disabling using default policy is not a mount tuning best practice, and audit logging is a system-wide setting.

Answer

Enable audit logging on the mount to track secret access

Answer

Set a high default lease TTL to reduce renewals

Answer

Disable the 'default' policy for the mount to restrict access

Question 9

A company runs a microservices application on Kubernetes. Each service authenticates to Vault using the Kubernetes auth method and obtains a short-lived token with a TTL of 15 minutes. The services use these tokens to read secrets from the KV v2 secrets engine. Recently, the operations team noticed that Vault's lease count has been steadily increasing, and some services are experiencing 'lease not found' errors when trying to renew their tokens. Investigation reveals that the services are not renewing tokens before they expire because the token TTL is too short to complete some long-running tasks. The team wants to fix the issue without compromising security. They are considering the following actions:

A. Increase the default lease TTL for the KV v2 mount to 1 hour.
B. Increase the token TTL for the Kubernetes auth role to 1 hour.
C. Implement a renewal loop in each service to renew tokens every 10 minutes.
D. Use periodic tokens with a period of 1 hour for all services.

Accepted Answer

Increase the token TTL for the Kubernetes auth role to 1 hour.. Increasing the token TTL for the Kubernetes auth role to 1 hour directly addresses the root cause: the current 15-minute TTL is too short for long-running tasks, causing tokens to expire before services can complete their work. By raising the TTL to 1 hour, services have sufficient time to complete tasks and renew tokens, while still maintaining security through short-lived credentials. This approach does not require code changes and leverages Vault's built-in token lifecycle management.

Answer

Increase the default lease TTL for the KV v2 mount to 1 hour.

Answer

Implement a renewal loop in each service to renew tokens every 10 minutes.

Answer

Use periodic tokens with a period of 1 hour for all services.

Question 10

An organization uses Vault's AWS secret engine to dynamically generate IAM credentials. The application uses the API to request credentials by calling 'POST /v1/aws/creds/my-role'. Recently, the application started receiving '400 Bad Request' with error 'invalid role ARN'. The role 'my-role' is defined in Vault and has been working for months. The administrator checks the role configuration and confirms the ARN is correct and that the associated IAM policy exists in AWS. The Vault server logs show no connectivity issues with AWS. The application code has not changed. What is the most likely cause?

Accepted Answer

The IAM role's trust policy has been modified to not allow Vault's AWS account to assume the role. The error 'invalid role ARN' occurs when Vault attempts to call sts:AssumeRole but AWS rejects the request. Since the role ARN is confirmed correct in Vault and the associated IAM policy exists in AWS, the most likely cause is that the IAM role's trust policy has been modified to no longer allow Vault's AWS account (or the external ID) to assume the role. A token expiration would result in a 403 Forbidden, not a 400 with 'invalid role ARN'. Changing the ARN in AWS without updating Vault would cause Vault to use a stale ARN, but the administrator confirmed the ARN is correct. The endpoint is correct as the request has been working for months. Thus, option B is correct.

Answer

The Vault token used for the API call has expired

Answer

The role ARN has been changed in AWS but not updated in Vault

Answer

The application is calling the wrong API endpoint

Question 11

Drag and drop the steps to configure Vault's PKI secrets engine to issue certificates into the correct order.

Accepted Answer

Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate. The correct sequence to configure Vault's PKI secrets engine for issuing certificates is: first enable the PKI secrets engine, then generate a root certificate (self-signed CA), then create a role that defines certificate parameters, and finally issue a certificate using that role. Enabling the engine mounts it at a path, generating the root CA establishes the trust anchor, the role configures certificate properties, and the issuance step produces the actual certificate. Common mistakes include attempting to generate the root or create a role before enabling the engine, or creating the role before generating the root CA, which leads to errors or missing configurations.

Answer

Generate a root certificate, then enable PKI secrets engine, then create a role, then issue a certificate

Answer

Create a role, then enable PKI secrets engine, then generate a root certificate, then issue a certificate

Answer

Enable PKI secrets engine, then create a role, then generate a root certificate, then issue a certificate

Question 12

Which THREE of the following are true statements about the AppRole authentication method? (Choose three.)

Accepted Answer

Vault can generate a wrapped Secret ID for secure delivery. Vault supports wrapping the Secret ID in a single-use, time-limited JWT-based response-wrapping token. This allows the Secret ID to be securely delivered to the target application without exposing it in transit, as the wrapping token can be unwrapped only by the intended recipient using a separate unwrap operation.

Answer

The Secret ID contains the token policies

Answer

The Secret ID can only be used once

Question 13

A DevOps engineer needs to write a new secret to the KV v2 engine at path 'secret/data/team' with key 'api_key' and value 'abc123'. Which Vault CLI command achieves this?

Accepted Answer

vault kv put secret/team api_key=abc123. The KV v2 engine automatically prefixes the path with 'data/' when using the 'vault kv put' command. The correct path for writing a secret to the KV v2 engine is 'secret/data/team', but the CLI command 'vault kv put secret/team api_key=abc123' handles this internally by appending '/data/' to the path. This is a key difference from the 'vault write' command, which requires the full path including 'data/'.

Answer

vault kv put secret/data/team api_key=abc123

Answer

vault write secret/data/team api_key=abc123

Answer

vault write secret/team api_key=abc123

Question 14

An administrator wants to audit token usage without exposing the actual token IDs to auditors. Which approach should they use?

Accepted Answer

Use token accessors in audit logs. Token accessors are non-sensitive, randomly generated identifiers that are mapped one-to-one with actual Vault tokens. By logging the accessor instead of the token ID, administrators can audit token usage (e.g., lookup, renewal, revocation) without exposing the token itself, which could be used to authenticate. This approach satisfies the requirement of auditing without compromising security.

Answer

Enable audit logging without any modifications

Answer

Use the token lookup API for each audit event

Answer

Use response wrapping to encapsulate tokens

Question 15

An organization requires that all Vault secrets be encrypted with a key derived from a hardware security module (HSM) and that the cluster can be unsealed automatically. Which seal type should they use?

Accepted Answer

PKCS11 seal. The PKCS11 seal type is correct because it enables Vault to derive the unseal key from a key stored in a hardware security module (HSM) via the PKCS#11 interface. This allows automatic unsealing of the cluster by leveraging the HSM's key, meeting both the encryption and auto-unseal requirements.

Answer

Transit seal

Answer

Shamir seal

Answer

Cloud KMS seal