VA-003 Practice Test 18 — 15 Questions

Question 1

A DevOps team is setting up a Vault cluster for the first time. They plan to use AWS KMS for auto-unseal and Consul as the storage backend. As part of the architecture, which TWO components are essential for the Vault server to start and serve requests?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A storage backend. Option B (a storage backend) is essential because Vault persists all data — secrets, policies, tokens, and configuration — in its storage backend, and here that is Consul; without a working storage backend Vault cannot initialize or serve requests. Option C (a configured seal mechanism) is essential because Vault must be able to unseal its master key to decrypt the barrier and become active; in this scenario the seal mechanism is AWS KMS auto-unseal, which is required for the server to reach a serving state. Option A is not required because Vault can use an internal/self-signed certificate or none at all for basic operation; a public CA cert is only needed for trusted TLS clients. Option D is incorrect because Vault generates its own encryption keys internally (e.g., the master key and barrier key) rather than requiring an externally supplied 4096-bit key. Option E is not essential because a load balancer is only for distributing traffic across multiple Vault nodes, not for a single server to start and serve requests.

Answer

A public CA certificate

Answer

A 4096-bit encryption key

Answer

A load balancer

Question 2

An administrator is reviewing Vault token policies and wants to ensure that tokens created by a specific application cannot be renewed and have a fixed lifetime. Which two token configurations should be applied?

Accepted Answer

Set renewable to false.. Option B is correct because setting renewable to false on the token (or its role) prevents the token from being renewed, directly satisfying the requirement that tokens cannot be renewed. Option D is correct because setting explicit_max_ttl to match the desired TTL caps the token's total lifetime at a fixed value, ensuring a fixed lifetime even if renewal were otherwise possible. Together, renewable=false and explicit_max_ttl enforce both non-renewability and a hard expiration. Option A is wrong because a very large max_ttl would extend, not fix, the token's lifetime. Option C is wrong because a ttl of 0 typically means no expiration or default behavior, not a fixed lifetime. Option E is wrong because no_default_policy only controls whether the default policy is attached, which is unrelated to renewal or lifetime.

Answer

Set max_ttl on the role to a very large value.

Answer

Set ttl on the token to 0.

Answer

Set no_default_policy to true.

Question 3

Which Vault component is responsible for encrypting data before storing it in the storage backend?

Accepted Answer

Barrier. The Barrier (also known as the Security Barrier) is the Vault component responsible for encrypting all data before it is written to the storage backend. It wraps every entry with encryption using the master key, ensuring that data at rest is never stored in plaintext. This is a core architectural layer that provides a cryptographic boundary between Vault's internal operations and the underlying storage.

Answer

Storage Backend

Answer

Audit Device

Answer

Secrets Engine

Question 4

A company runs multiple microservices in a Kubernetes cluster. Each microservice authenticates to Vault using a service token created via the token auth method. The tokens are created with a default TTL of 72h, a max TTL of 168h, and renewable set to true. The services are configured to renew their tokens when the remaining TTL drops below 24h. Recently, some tokens have been expiring prematurely, causing service outages. Upon investigation, you find that the expired tokens were created with a role that includes explicit_max_ttl = 72h. The services see the TTL decreasing normally, but then it jumps to zero even though the services attempted renewal. What is the most likely cause and correct action?

Accepted Answer

Remove the explicit_max_ttl setting from the role or set it to 0.. The `explicit_max_ttl` setting on the role overrides the token's renewable property. When a token has an `explicit_max_ttl` of 72h, it cannot be renewed beyond that absolute lifetime, regardless of the `renewable = true` setting. The services attempt renewal, but Vault enforces the hard limit, causing the TTL to jump to zero at the 72-hour mark. Removing `explicit_max_ttl` or setting it to 0 allows the token to be renewed up to the system's `max_ttl` (168h), preventing premature expiration.

Answer

Configure the services to renew the token when TTL drops below 48h.

Answer

Increase the default TTL on the token auth mount to 168h.

Answer

Set max_ttl on the role to 72h.

Question 5

Refer to the exhibit. A Vault administrator starts a Vault server and receives this error. What is the most likely cause?

Accepted Answer

The storage stanza is missing from the configuration file.. The error indicates that Vault cannot find a configured storage backend. The storage stanza is mandatory in Vault's configuration file because it defines where Vault persists its data (e.g., Consul, Raft, file). Without it, the server fails to start because it has no backend to store secrets and state.

Answer

The Vault binary is corrupt.

Answer

The listener address is incorrect.

Answer

The seal stanza is misconfigured.

Question 6

A company stores static secrets in Vault and requires that all data is encrypted at rest in the storage backend. Which Vault feature provides this encryption?

Accepted Answer

Vault's storage encryption via the barrier.. C is correct because Vault's storage encryption is handled by the security barrier, which automatically encrypts all data written to the storage backend using a 256-bit AES-GCM encryption key. This ensures that data is encrypted at rest regardless of the storage backend's own capabilities, meeting the requirement without relying on backend-specific features.

Answer

The storage backend must be configured to encrypt data.

Answer

The transit secrets engine for encrypting secrets.

Answer

The storage backend's built-in encryption (e.g., Consul's encryption).

Question 7

A Vault cluster with three nodes using Integrated Storage (Raft) is healthy with one active and two standby nodes. A network partition isolates the active node. What will happen?

Accepted Answer

The two standby nodes elect a new leader and continue writing.. In a Vault cluster with Integrated Storage (Raft), a majority of nodes (quorum) is required to maintain leadership and process write operations. When the active node is isolated, the two remaining standby nodes still constitute a majority (2 out of 3). They will hold a new leader election using the Raft consensus algorithm, elect a new active node, and continue accepting write requests. The isolated node, upon reconnection, will be treated as a follower and replicate data from the new leader.

Answer

The two standby nodes will seal themselves.

Answer

The two standby nodes remain in standby state.

Answer

The cluster becomes read-only until the active node rejoins.

Question 8

A company is running Vault in production with a single active node and two standby nodes using Integrated Storage. The operations team notices that after a network partition, one of the standby nodes becomes unavailable for a few minutes. Upon recovery, the node rejoins the cluster. However, the active node's performance degrades temporarily. What is the most likely cause?

Accepted Answer

The standby node's recovery caused Raft snapshot installation, leading to temporary I/O load on the active node.. When a standby node reconnects after a network partition, the Raft consensus protocol may require the node to catch up on missed log entries. If the log gap is large, the active node initiates a snapshot installation, which involves reading and sending a compressed snapshot of the Raft state. This process causes significant I/O and CPU load on the active node, temporarily degrading its performance.

Answer

The standby node caused a leadership election upon reconnection.

Answer

The standby node was not using a seal wrapping key, causing re-encryption of all data.

Answer

The standby node forced a full data sync from the active node, consuming resources.

Question 9

A DevOps team is using Vault tokens with short TTLs for CI/CD jobs. They notice that some jobs fail intermittently with 'permission denied' errors even though the token policy grants the required capabilities. The token is created with a TTL of 10 minutes and renewed automatically by the client library. What is the most likely cause of the failures?

Accepted Answer

The token's max_ttl has been exceeded, causing renewal to fail.. Vault tokens have both a TTL (time-to-live) and a max_ttl (maximum time-to-live). When a token is renewed, its TTL is reset to the original TTL (10 minutes) but only if the cumulative lifetime has not exceeded the max_ttl. If the max_ttl is reached, renewal fails, the token expires, and subsequent operations using that token return 'permission denied' errors, even though the policy itself grants the required capabilities.

Answer

The token's parent token has been revoked.

Answer

The token's max_ttl is being reset each time the token is renewed.

Answer

The token's TTL is too short and the client library is not renewing in time.

Question 10

After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?

Accepted Answer

The old key version is retained and used for decryption when the ciphertext references that version.. A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.

Answer

The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.

Answer

The ciphertext contains the original plaintext, so decryption simply extracts it.

Answer

The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.

Question 11

An organization uses the AWS secrets engine to generate IAM users for each application. They want to ensure that if a Vault server is compromised, the attacker cannot use the AWS secrets engine configuration to gain access to the AWS account. Which additional security measure should be implemented?

Accepted Answer

Use a non-root IAM user with minimal privileges for the engine and restrict the engine's role policies to the minimum needed. The core principle of least privilege ensures that even if the Vault server is compromised, the attacker can only perform actions allowed by the minimal IAM policy attached to the non-root user. This limits the blast radius, preventing the attacker from gaining full administrative access to the AWS account. The AWS secrets engine uses the configured IAM credentials to create temporary IAM users, so restricting those credentials to only the necessary permissions is the most effective mitigation.

Answer

Enable Vault's seal wrapping to encrypt the engine configuration

Answer

Store the AWS access key used by the engine in a separate Vault instance

Answer

Use a dedicated Vault server for the AWS engine

Question 12

Which TWO of the following are benefits of using Vault's transit engine for encryption as a service?

Accepted Answer

Applications can encrypt/decrypt data without accessing the key material. Option B is correct because Vault's transit engine performs cryptographic operations on behalf of the client: the application sends plaintext (or ciphertext) to Vault's encrypt/decrypt endpoints, and Vault returns the result, so the application never handles or even sees the underlying key material. Option E is correct because the transit engine supports centralized key management, including key rotation via the `rotate` endpoint, which creates a new key version while retaining old versions for decryption, allowing rotation without application changes or downtime. Option A is incorrect because the whole point of the transit engine is that the key never leaves Vault's storage and is not held in application memory. Option C is incorrect because transit keys are non-exportable by design (exportable keys must be explicitly enabled and are generally discouraged). Option D is incorrect because key management in the transit engine is governed by Vault policies and tokens with appropriate capabilities, not restricted solely to the root token.

Answer

The encryption key is stored in the application's memory

Answer

Keys can be exported and used in external applications

Answer

Only the root token can manage keys

Question 13

An organization is creating Vault policies to manage access to secrets across multiple application teams. According to HashiCorp best practices, which two approaches should be taken when designing policies? (Choose two.)

Accepted Answer

Use path templating to incorporate entity metadata.. HashiCorp recommends using path templating with entity metadata (e.g., {{identity.entity.metadata.team}}) to dynamically scope policies to specific teams or applications. This approach reduces policy sprawl and ensures that permissions are automatically applied based on the authenticated entity's attributes, aligning with the principle of least privilege.

Answer

Avoid using negative capabilities (deny) when possible.

Answer

Grant maximum permissions initially and then restrict as needed.

Answer

Use a single all-encompassing policy for each environment.

Question 14

Refer to the exhibit. What is the purpose of the -field=ciphertext flag in this command?

Accepted Answer

It instructs Vault to only return the ciphertext field from the response.. The `-field=ciphertext` flag in a Vault command instructs the CLI to extract and return only the value of the `ciphertext` key from the JSON response object. This is a standard Vault output filtering mechanism that allows users to isolate a specific field without parsing the full response, which is especially useful in scripting and automation.

Answer

It sets the ciphertext field for encryption.

Answer

It enables field-level encryption.

Answer

It specifies the encryption key name.

Answer

It outputs the command result to a file named ciphertext.

Question 15

A DevOps engineer is configuring Vault to encrypt data in transit for a microservice. They create a key in the transit engine and want to encrypt a base64-encoded plaintext. Which API path and operation should they use?

Accepted Answer

POST /v1/transit/encrypt/{key_name} with plaintext in payload. The Vault Transit Secrets Engine exposes a POST endpoint at `/v1/transit/encrypt/{key_name}` that accepts a JSON payload containing the `plaintext` field, which must be base64-encoded. This operation encrypts the provided plaintext using the named encryption key and returns the ciphertext. The POST method is required because the operation modifies state (encrypts data) and the plaintext is sent in the request body, not as a query parameter.

Answer

POST /v1/transit/encrypt/{key_name} with ciphertext in payload

Answer

GET /v1/transit/encrypt/{key_name} with query param

Answer

POST /v1/transit/sign/{key_name}

Answer

POST /v1/transit/hmac/{key_name}