VA-003 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. An application uses this policy to access Vault. The application is able to read database credentials from `database/creds/my-role`. However, attempts to list all roles at `database/roles/` fail. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not allow the 'list' capability on the path `database/roles/`. The policy grants 'read' capability on `database/creds/my-role` but does not include the 'list' capability on `database/roles/`. In Vault, listing requires an explicit 'list' capability in the policy, even if 'read' is allowed on sub-paths. Without 'list', the API call to `LIST database/roles/` returns a permission denied error.

Answer

The path `database/roles/` is not a valid path for listing roles

Answer

The database secrets engine is not enabled

Answer

The application needs the 'sudo' capability to list roles

Question 2

Which token type should be used for short-lived credentials that do not need to be renewed?

Accepted Answer

Batch tokens. Batch tokens in HashiCorp Vault are designed for short-lived, non-renewable credentials. They have a fixed Time-to-Live (TTL) and cannot be renewed or revoked individually; once the TTL expires, the token is automatically invalidated. This makes them ideal for batch jobs or one-time tasks where credential renewal is unnecessary.

Answer

Service tokens

Answer

Periodic tokens

Answer

Orphan tokens

Question 3

Which TWO of the following are valid token states?

Accepted Answer

Revoked. 'Revoked' is a valid token state in Vault. Tokens can be explicitly revoked, rendering them unusable. Option E is correct because 'Active' is the initial state of a token when it is created and remains valid until it expires or is revoked. Options A, B, and C are not valid token states in Vault: 'Expired' is a result of TTL expiry but not a distinct state; 'Orphan' describes a token whose parent is gone, but it is still considered active if not revoked; 'Suspended' is not a Vault token state.

Answer

Expired

Answer

Orphan

Answer

Suspended

Question 4

A company runs Vault in a single cluster with three nodes using the Raft storage backend. The nodes are behind a load balancer that distributes traffic to all nodes. The operations team notices that occasionally, write operations (e.g., writing a secret or creating a policy) fail with a '502 Bad Gateway' error, while read operations succeed. The Vault audit logs show no errors. The load balancer health checks are configured to check the /v1/sys/health endpoint with a 200 response expected. The Vault nodes are all unsealed and the cluster is healthy. Which of the following is the most likely cause of the intermittent write failures?

Accepted Answer

The load balancer is sending write requests to standby nodes, which cannot handle writes.. In a Vault cluster with Raft storage, only the elected leader node can handle write operations (e.g., writing secrets, creating policies). Standby nodes serve read requests and forward writes to the leader. If the load balancer distributes traffic to all nodes without considering leadership, write requests sent to a standby node will fail with a 502 Bad Gateway error because the standby cannot process the write locally and the load balancer may not properly handle the forwarded response or timeout.

Answer

The Raft storage backend does not support write operations.

Answer

The load balancer is not configured to use the /v1/sys/leader endpoint for routing.

Answer

One of the Vault nodes is sealed, causing write requests to fail.

Question 5

A DevOps engineer notices that a long-running application using a Vault token fails after 24 hours. The token was created with a TTL of 48h. The token role has a default TTL of 48h and a max TTL of 72h. What is the most likely cause of the failure?

Accepted Answer

The mount's max TTL for the token is 24h, overriding the role's setting.. The most likely cause is that the mount's max TTL for the token is set to 24h, which overrides the role's max TTL of 72h. In Vault, the effective TTL of a token is the minimum of the role's TTL, the mount's max TTL, and the system's max TTL. Since the token fails exactly after 24 hours, the mount's max TTL of 24h is the limiting factor, causing the token to expire even though the role allows up to 48h.

Answer

The token was manually revoked by an administrator.

Answer

The token was revoked due to a policy violation.

Answer

The token is a batch token and cannot be renewed.

Question 6

An organization uses Vault's token auth method to issue tokens for long-running services. They want to ensure that tokens are automatically revoked after 30 days, even if the service repeatedly renews them. Which token role configuration achieves this?

Accepted Answer

Set max_ttl to 720h on the token role. Setting `max_ttl` to 720h (30 days) on the token role enforces an absolute upper lifetime for the token, regardless of how many times it is renewed. This ensures the token is automatically revoked after 30 days, even if the service repeatedly renews it before the current TTL expires.

Answer

Set ttl to 720h without setting max_ttl

Answer

Set explicit_max_ttl to 720h on the token role

Answer

Set period to 720h without setting max_ttl

Question 7

Which THREE of the following are true regarding Vault's high availability (HA) and replication? (Choose three.)

Accepted Answer

In an HA cluster with Integrated Storage, only the active node can serve write requests. In an HA cluster with Integrated Storage (Raft), only the active node can serve write requests because Raft ensures strong consistency by requiring all writes to go through the elected leader. The leader replicates the write to a quorum of follower nodes before acknowledging the client, preventing split-brain scenarios. This is a fundamental property of the Raft consensus protocol used by Vault Integrated Storage.

Answer

With Integrated Storage, all nodes can handle write requests

Answer

Disaster Recovery Replication replicates everything including policies and audit logs

Question 8

Which TWO of the following are benefits of using dynamic secrets engines (e.g., database, AWS) over static secrets?

Accepted Answer

Provides automatic rotation of credentials upon lease expiry. Dynamic secrets engines generate credentials on-demand with a predefined Time-To-Live (TTL). When the lease expires, Vault automatically revokes the credentials, forcing the client to request new ones. This automatic rotation eliminates the need for manual credential rotation and reduces the window of exposure if a credential is compromised.

Answer

Simplifies the management of service accounts because credentials never change

Answer

Secrets are persistent and do not expire

Answer

Secrets are stored in plaintext in the Vault data store

Question 9

A user with this policy wants to delete secrets under the 'team/' path. Which additional capability must be added?

Accepted Answer

delete. The user's policy grants 'create' and 'update' capabilities on 'team/*', but not 'delete'. In Vault's ACL policy system, each operation (create, read, update, delete, list, sudo) must be explicitly allowed. Since 'delete' is missing, the user cannot delete secrets under 'team/'. Adding the 'delete' capability to the policy is required.

Answer

sudo

Answer

list

Answer

patch

Question 10

An administrator configures AppRole with a RoleID and SecretID. They want to ensure that each SecretID can be used only once. Which configuration should they use?

Accepted Answer

Set secret_id_num_uses=1 in the role.. Setting `secret_id_num_uses=1` in the AppRole role configuration ensures that each SecretID can be used only once to obtain a token. Once the SecretID is used for login, it is automatically revoked and cannot be reused. This directly satisfies the requirement of single-use SecretIDs.

Answer

Set token_num_uses=1 in the role.

Answer

Set bound_cidr_list to a specific IP.

Answer

Set secret_id_ttl=1s in the role.

Question 11

A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?

Accepted Answer

Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.. Configuring the database role with a TTL of 1 hour and an explicit max TTL of 2 hours allows the application to request a 1-hour lease while ensuring that the lease cannot exceed 2 hours, even if the application fails to renew or release it. This minimizes the exposure window by capping the lease duration, and the Vault administrator can rely on automatic lease revocation at TTL expiry rather than manual intervention. The database engine's default lease TTL of 24 hours is overridden by the role-level TTL, which is the proper way to enforce shorter-lived credentials for specific applications.

Answer

Set the default lease TTL on the database mount to 1 hour.

Answer

Increase the system's default lease TTL to 48 hours to give applications more flexibility.

Answer

Manually revoke leases after each application finishes using them.

Question 12

Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)

Accepted Answer

Setting a secret_id_num_uses limit. Setting a `secret_id_num_uses` limit restricts the number of times a SecretID can be used to obtain a token from Vault. This prevents replay attacks and limits the blast radius if a SecretID is leaked, as it becomes invalid after the specified number of uses.

Answer

Keeping the RoleID secret

Answer

Configuring token policies

Question 13

Which of the following are valid ways to authenticate to Vault? (Select all that apply.)

Accepted Answer

SAML 2.0. All of SAML 2.0, GitHub personal access token, Kubernetes auth, and LDAP authentication are valid Vault authentication methods. The SAML auth method (via plugin) enables integration with identity providers; the GitHub auth method uses personal access tokens to authenticate based on team membership; Kubernetes auth allows authentication using a Kubernetes Service Account Token; and LDAP authentication provides integration with LDAP directories. AWS EC2 instance metadata is not a direct Vault authentication method, though Vault's AWS auth method can use EC2 metadata for authentication.

Answer

AWS EC2 instance metadata

Question 14

A Vault administrator needs to create a policy that grants users read access only to the secrets that belong to their own team. The team membership is stored in an external identity provider and mapped to Vault entity aliases. The administrator wants to use a templated policy that references the entity's metadata. Which policy syntax accomplishes this goal?

Accepted Answer

path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }. It uses the proper templating syntax `{{identity.entity.metadata.team}}` to reference the `team` metadata key stored on the Vault entity. This allows the policy to dynamically grant read and list access to the path `secret/data/<team>/*`, ensuring users only see secrets belonging to their own team as defined by the external identity provider.

Answer

path "secret/data/{{entity.metadata.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{identity.entity.aliases.team}}/*" { capabilities = ["read", "list"] }

Question 15

An application uses a periodic token with period=24h. The application renews every 12h. After 48h, the token is still valid. After 72h, the token is still valid. What is the maximum lifetime of this periodic token?

Accepted Answer

Unlimited (as long as it keeps renewing). A periodic token with a defined period (e.g., 24h) has no maximum lifetime; it remains valid indefinitely as long as it is renewed before the period expires. In this scenario, the token is renewed every 12h (well within the 24h period), so after 48h and 72h it is still valid because each renewal resets the token's lifetime, effectively giving it an unlimited lifespan. This behavior is inherent to periodic tokens in Vault, which are designed for long-lived sessions with regular re-authentication.

Answer

72h

Answer

48h

Answer

24h