VA-003 Practice Test 17 — 15 Questions

Question 1

A team is using Vault's KV v2 secrets engine to store API keys for multiple microservices. They have enabled versioning and need to ensure that when a secret is deleted, it can be recovered within 30 days. Additionally, they want to keep a history of all versions for compliance. The team has noticed that some secrets are being permanently removed immediately instead of moving to a deleted state. Which configuration change should they make to enforce this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the 'delete_version_after' parameter to 30 days on the KV v2 mount. The 'delete_version_after' parameter on a KV v2 secrets engine mount specifies the time window (in seconds or as a duration like '30d') during which a deleted version remains in a soft-deleted state and can be recovered via the 'undelete' endpoint. Setting this to 30 days ensures that when a secret is deleted, it is not permanently removed until after that period, preserving the ability to restore it and maintaining a full version history for compliance.

Answer

Enable 'check-and-set' on the secrets path to prevent unintended overwrites

Answer

Write a custom script that calls the 'undelete' endpoint immediately after deletion

Answer

Set 'max_versions' to 1 to limit the number of retained versions

Question 2

A periodic token is created with a TTL of 30 days. After 60 days, the token is still in use but suddenly stops working. What is the most likely reason?

Accepted Answer

The token was revoked manually or by an administrator. The token's TTL (time-to-live) of 30 days determines how long it is valid from its creation or last renewal, but it does not set an absolute maximum lifetime. After 60 days, the token would have been renewed or used periodically, so it should still be valid unless an external action invalidated it. Manual revocation by an administrator or via a revocation endpoint is the most likely cause for a token that was working but suddenly stops, as it overrides any TTL-based expiration.

Answer

The token exceeded its max TTL of 60 days

Answer

The token reached its default max TTL of 32 days

Answer

The token's explicit_max_ttl was set to a value less than 60 days

Question 3

A developer needs a token that can be used only 5 times and must expire after 24 hours, regardless of the number of uses. Which token creation method should be used to enforce these constraints?

Accepted Answer

Use a token role with num_uses=5 and ttl=24h. A token role with both `num_uses=5` and `ttl=24h` enforces both constraints: the token can be used only 5 times and will expire after 24 hours, regardless of which limit is reached first. Creating a token directly with only `num_uses` or only `ttl` would miss one constraint, and a periodic token ignores the `num_uses` limit entirely.

Answer

Create a token directly with num_uses=5

Answer

Create a token directly with ttl=24h

Answer

Create a periodic token with period set to 24h

Question 4

A security administrator notices that a Vault client using AppRole authentication is generating a very large number of tokens, causing performance issues. The administrator finds that the same AppRole role is used by multiple applications. What should the administrator do to reduce the number of tokens while maintaining security?

Accepted Answer

Create separate AppRole roles for each application. Creating separate AppRole roles for each application allows the administrator to isolate token generation per application, preventing a single role from being overwhelmed by multiple clients. This maintains security by ensuring each application has its own set of credentials and policies, reducing the total number of tokens without compromising access control.

Answer

Decrease the token TTL on the AppRole role

Answer

Periodically rotate the secret ID

Answer

Set secret_id_num_uses to 1 on the AppRole role

Question 5

Which TWO of the following are valid reasons for a token renewal to fail with a 'lease not found' or 'token not found' error? (Select exactly 2 options.)

Accepted Answer

The token has expired. A Vault token that has expired is no longer valid for renewal. When a token's lease expires, the auth backend or secret engine removes the lease entry, so any renewal attempt returns 'lease not found' or 'token not found'. Option E is correct because batch tokens are designed to be non-renewable; they have no associated lease, so any renewal attempt results in a 'token not found' error. This is a fundamental behavior of Vault's lease lifecycle: expired tokens and batch tokens cannot be renewed and must be re-authenticated.

Answer

The token has num_uses set to 0

Answer

The token has exceeded its max TTL

Answer

The token is an orphan token

Question 6

Refer to the exhibit. A user with this policy tries to write a new secret to "secret/data/production/db". What will happen?

Accepted Answer

The write fails because the policy only allows read on production.. The policy only grants 'read' capability on the 'secret/data/production/*' path, which allows reading secrets but not creating or updating them. Writing a new secret requires 'create' or 'update' capabilities (or 'write' which encompasses both). Since the policy lacks these capabilities, the write operation fails regardless of whether the secret already exists.

Answer

The write succeeds if the secret already exists.

Answer

The write succeeds because the path matches.

Answer

The write fails because the user does not have list capability.

Question 7

A company uses Vault's KV v2 secrets engine. A policy is needed to allow a service to only update existing secrets at path "secret/data/service/config", but not create new ones. Which capabilities should be included?

Accepted Answer

["update"]. In Vault's KV v2 secrets engine, the 'update' capability is specifically required to modify an existing secret at a given path without the ability to create a new one. The 'create' capability is needed only for initial creation, and 'read' is not required for the update operation itself. Since the policy must allow updating existing secrets but not creating new ones, only the 'update' capability is necessary.

Answer

["read", "update"]

Answer

["write"]

Answer

["create", "update"]

Question 8

Which TWO statements are true about batch tokens?

Accepted Answer

Batch tokens cannot be renewed or revoked. Batch tokens are designed to be lightweight and do not support renewal or revocation. They are not persisted in Vault's storage backend; instead, they are generated on-the-fly using a keyed hash (HMAC) and validated by the server without storing them. This makes them ideal for high-frequency, short-lived workloads where the overhead of managing a full token lifecycle is undesirable.

Answer

Batch tokens can be renewed to extend their lifetime

Answer

Batch tokens can be looked up using the lookup endpoint

Question 9

An application's token is failing to renew, and the logs show 'token not renewable'. The token was created with a TTL of 24h and no explicit max TTL. What is the most likely cause?

Accepted Answer

The token was created with the renewable flag set to false. The error 'token not renewable' occurs when a token is created with the `renewable` flag explicitly set to `false`. Even though the token has a TTL of 24h and no explicit max TTL, the absence of the renewable flag means the token cannot be renewed at all. Vault tokens are renewable by default, but if the application or operator sets `renewable=false` during creation, the token will expire after its TTL and cannot be extended.

Answer

The token has been renewed too many times, exceeding its TTL

Answer

The token accessor is invalid

Answer

The token's max TTL has been reached

Question 10

A DevOps team uses Vault to store database credentials via the database secrets engine. They notice that after the default lease duration, applications receive errors when trying to connect. The team wants to ensure that applications automatically renew leases before expiration. What should they do?

Accepted Answer

Use Vault Agent to renew the secret.. Vault Agent is designed to automatically handle secret renewal and lifecycle management. It runs as a sidecar or daemon that periodically checks the lease duration and renews it before expiration, ensuring applications always have valid credentials without manual intervention or custom scripting.

Answer

Schedule a cron job to periodically read new credentials.

Answer

Set a longer default TTL on the role.

Answer

Set a longer max TTL on the mount.

Question 11

Which TWO of the following are benefits of using Vault's transit engine for encryption as a service?

Accepted Answer

Applications can encrypt/decrypt data without accessing the key material. Vault's transit engine enables applications to encrypt and decrypt data without ever having access to the underlying key material (Option B). Additionally, key rotation is handled centrally by Vault without any application downtime, as applications continue to use the same API calls and Vault manages the rotation transparently (Option E).

Answer

The encryption key is stored in the application's memory

Answer

Keys can be exported and used in external applications

Answer

Only the root token can manage keys

Question 12

A Vault cluster has a token with the following policy: path "secret/data/dev/*" { capabilities = ["read", "list"] }. The token is used to read a secret at "secret/data/dev/password". The read succeeds. Later, the token tries to read "secret/data/prod/password". What happens?

Accepted Answer

Fails because the token needs an explicit policy for "secret/data/prod/".. Vault policies are path-based and deny by default. The token's policy only grants 'read' and 'list' capabilities on paths matching 'secret/data/dev/*', so any attempt to access 'secret/data/prod/password' is not covered by that policy. Without an explicit policy allowing access to the 'prod' path, the request is denied by Vault's default deny behavior.

Answer

Fails with a system error.

Answer

Succeeds because token has read capability on all secrets.

Answer

Succeeds because the token can list and read any path.

Question 13

After a Vault migration, some leases are no longer valid and cause errors. What is the best way to force a cleanup of all leases under a specific mount without affecting other mounts?

Accepted Answer

Use vault lease revoke -prefix . The `vault lease revoke -prefix ` command is specifically designed to revoke all leases associated with a given mount path without affecting other mounts. This command iterates through all leases under that prefix and forces their revocation, cleaning up invalid leases efficiently. It is the targeted, non-disruptive approach for lease cleanup in Vault.

Answer

Restart Vault servers

Answer

Disable and re-enable the secret engine

Answer

Reduce the mount's max_lease_ttl to 0

Question 14

A security team wants to allow applications to authenticate to Vault without storing any secrets in configuration files. The applications run on AWS EC2 instances with an IAM role attached. Which Vault authentication method leverages the EC2 instance metadata to obtain credentials?

Accepted Answer

AWS IAM authentication. AWS IAM authentication (option D) is correct because it allows applications running on EC2 instances with an attached IAM role to authenticate to Vault without storing any secrets. The Vault client uses the EC2 instance metadata service (IMDS) to retrieve the instance identity document and its signature, which are then presented to Vault. Vault verifies these credentials against the AWS API, confirming the instance's identity and IAM role, thereby enabling secure, secretless authentication.

Answer

GCP IAM authentication

Answer

Userpass authentication

Answer

AppRole authentication

Question 15

An administrator receives an access denied error when trying to use the token accessor to revoke a token. The administrator's token has the following policy capabilities: path "auth/token/revoke-accessor" { capabilities = ["create", "update"] }. What is the issue?

Accepted Answer

The administrator lacks the 'sudo' capability on that path. The `auth/token/revoke-accessor` endpoint requires the `sudo` capability in addition to `create` or `update`. In Vault, certain sensitive token management operations, such as revoking a token by its accessor, are protected by the `sudo` privilege to prevent unauthorized revocation. Without `sudo`, the administrator receives an access denied error even though they have `create` and `update` capabilities on the path.

Answer

The administrator's token does not have any capabilities on the path

Answer

The path requires 'create' and 'update' but not 'sudo'

Answer

The accessor path is incorrect; it should be auth/token/accessors/revoke