VA-003 Practice Test 18 — 15 Questions

Question 1

An administrator wants to view all currently enabled secrets engines and their mount paths. Which command provides this information?

Accepted Answer

vault secrets list. The correct command to list all enabled secrets engines and their mount paths is `vault secrets list` (option B). Option D, `vault read sys/mounts`, is not a valid command in the Vault CLI; the endpoint `sys/mounts` is accessed via `vault secrets list` or by directly reading the path with `vault read sys/mounts` in some contexts, but the CLI command `vault read sys/mounts` does not exist. Options A and C are incorrect: `vault list sys/mounts` is not valid, and `vault secrets show` is not a real command.

Answer

vault list sys/mounts

Answer

vault secrets show

Answer

vault read sys/mounts

Question 2

A team has set up automatic key rotation on a transit key. After rotation, encrypted data that was encrypted with the previous key version can no longer be decrypted. What is the most likely cause?

Accepted Answer

The key's min_decryption_version is set too high. The `min_decryption_version` setting on a transit key in Vault's transit secrets engine controls the minimum key version that can be used to decrypt ciphertext. If this value is set too high (e.g., to the current version), older key versions are effectively disabled for decryption, causing any data encrypted with a previous key version to become undecryptable. This is a common misconfiguration when automating key rotation without properly managing version policies in Vault.

Answer

The key was deleted

Answer

The key's min_encryption_version is set too high

Answer

The team used the 'rewrap' operation incorrectly

Answer

The key is not exportable

Question 3

Where can you view a list of all active tokens in Vault?

Accepted Answer

`vault list auth/token/accessors`. `vault list auth/token/accessors` retrieves token accessors, which are unique identifiers for active tokens. While you cannot directly list tokens for security reasons, listing accessors is the standard way to view active tokens. Option A is false because there is a way to list tokens via their accessors. Option B is false because `vault token list` is not a valid command. Option D is false because both A and B are not true.

Answer

There is no way to list all tokens.

Answer

`vault token list`

Answer

Both A and B

Question 4

Refer to the exhibit. A user runs 'vault token renew -self' on this token. What is the expected behavior?

Accepted Answer

The token TTL will reset to 72h from now.. The token's initial TTL was set to 72h, and the token has a renewable property (service tokens are renewable by default unless explicitly disabled). Running 'vault token renew -self' extends the token's lifetime by resetting the TTL to the original 72h from the current time, as long as the renewal does not exceed the token's maximum TTL (which is also 72h in this case). This behavior is defined by Vault's token lifecycle management, where renewable tokens can have their TTL reset to the initial value upon renewal.

Answer

The token cannot be renewed because the token type is service.

Answer

The token will be renewed, but TTL cannot exceed 72h from issue time.

Answer

The token cannot be renewed because it is orphan.

Question 5

A Vault policy has the following: path "identity/entity/id/*" { capabilities = ["read", "list"] }. What does this policy allow?

Accepted Answer

Listing all identity entities and reading their details.. The policy grants 'read' and 'list' capabilities on the path `identity/entity/id/*`. In Vault, the 'list' capability returns entity IDs (a summary), while the 'read' capability retrieves the full details of a specific entity. Option C correctly captures both actions: listing all entities and reading their details.

Answer

Reading and updating all identity entities.

Answer

Reading and listing all identity entities.

Answer

Reading and listing all identity entity IDs.

Question 6

An admin wants to revoke all leases associated with a specific AWS IAM user created by Vault. Which command should they use?

Accepted Answer

vault lease revoke -prefix aws/creds/myrole. The `vault lease revoke -prefix` command revokes all leases that share a given prefix. Since AWS IAM user credentials generated by Vault under `aws/creds/myrole` have lease IDs that begin with that path, using the `-prefix` flag ensures all associated leases are revoked, regardless of their full lease ID.

Answer

vault lease revoke aws/creds/myrole/ -prefix

Answer

vault lease revoke aws/creds/myrole

Answer

vault lease revoke -path aws/creds/myrole

Question 7

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lease ID is incorrect.. The error message indicates that the lease ID provided for the renewal or revocation operation is invalid. In Vault, lease IDs are unique identifiers tied to a specific secret or token lease. If the lease ID is incorrect—due to a typo, truncation, or mismatch—Vault cannot locate the lease, resulting in this error. Option C correctly identifies this as the most likely cause.

Answer

The token lacks permission.

Answer

The secret engine was disabled.

Answer

The lease has expired.

Question 8

A developer requests a credential from this role. Which statement about the resulting lease is true?

Accepted Answer

The lease will have a TTL of 1 hour and cannot be renewed.. In Vault, when a developer requests a credential from a role that is configured with the default lease TTL of 1 hour and the role has `explicit_max_ttl` set to 0 (or not set), the resulting lease will have a TTL of 1 hour. Additionally, if the role is configured with `renewable=false`, the lease cannot be renewed. Option C correctly reflects both the 1-hour TTL and non-renewable behavior.

Answer

The lease will have a TTL of 24 hours and can be renewed.

Answer

The lease will have a TTL of 1 hour and can be renewed.

Answer

The lease will have a TTL of 24 hours and cannot be renewed.

Question 9

A Vault administrator wants to configure a role for dynamic secrets with a default TTL of 1 hour and a max TTL of 4 hours. They also want to allow renewal but only up to the max TTL. Which configuration achieves this?

Accepted Answer

default_ttl=1h, max_ttl=4h, renewable=true. It sets the default TTL to 1 hour, the maximum TTL to 4 hours, and enables renewal (renewable=true). In Vault, dynamic secret leases can be renewed up to the max_ttl, so with this configuration the initial lease is 1 hour, and each renewal extends the lease until the total lifetime reaches 4 hours, after which no further renewals are allowed.

Answer

default_ttl=1h, max_ttl=4h, renewable=false

Answer

default_ttl=4h, max_ttl=1h, renewable=true

Answer

default_ttl=1h, max_ttl=4h, renewable=true, ttl=1h

Question 10

A DevOps team generates a large number of short-lived tokens for automated deployments. They want to minimize storage overhead and avoid the need for token revocation. Which token type should they use?

Accepted Answer

Batch tokens. Batch tokens are the correct choice because they are designed for high-frequency, short-lived workloads where storage overhead and revocation are concerns. They are created by a parent token, have a configurable TTL (often minutes), and are never stored in Vault's storage backend, eliminating the need for revocation and reducing storage footprint.

Answer

Periodic tokens

Answer

Orphan tokens

Answer

Service tokens

Question 11

A company runs multiple microservices in a Kubernetes cluster. Each microservice authenticates to Vault using a service token created via the token auth method. The tokens are created with a default TTL of 72h, a max TTL of 168h, and renewable set to true. The services are configured to renew their tokens when the remaining TTL drops below 24h. Recently, some tokens have been expiring prematurely, causing service outages. Upon investigation, you find that the expired tokens were created with a role that includes explicit_max_ttl = 72h. The services see the TTL decreasing normally, but then it jumps to zero even though the services attempted renewal. What is the most likely cause and correct action?

Accepted Answer

Remove the explicit_max_ttl setting from the role or set it to 0.. The `explicit_max_ttl` setting on the role overrides the token's renewable property. When a token has an `explicit_max_ttl` of 72h, it cannot be renewed beyond that absolute lifetime, regardless of the `renewable = true` setting. The services attempt renewal, but Vault enforces the hard limit, causing the TTL to jump to zero at the 72-hour mark. Removing `explicit_max_ttl` or setting it to 0 allows the token to be renewed up to the system's `max_ttl` (168h), preventing premature expiration.

Answer

Configure the services to renew the token when TTL drops below 48h.

Answer

Increase the default TTL on the token auth mount to 168h.

Answer

Set max_ttl on the role to 72h.

Question 12

Refer to the exhibit. A user has a token with a policy that grants 'read' on 'secret/*'. The user attempts to read the secret at 'secret/data/app' using `vault kv get secret/data/app` but receives a '404 Not Found' error. The user can successfully list the engine at 'secret/' with `vault secrets list`. What is the most likely cause of the 404 error?

Accepted Answer

The secrets engine is KV v1, but the user is using the KV v2 path format with '/data/'.. The KV v2 secrets engine requires the path format `secret/data/` for reading secret data, while KV v1 uses `secret/` directly. The user is using `vault kv get secret/data/app`, which is the correct command for KV v2, but the error indicates the engine is actually KV v1. Since KV v1 does not have a `/data/` prefix, the path `secret/data/app` does not exist, resulting in a 404 Not Found error. The successful `vault secrets list` confirms the engine is enabled at `secret/`, ruling out option D.

Answer

The user's policy does not cover the sub-path 'secret/data/app'.

Answer

The secret path is mistyped; it should be 'secret/application'.

Answer

The secret engine at 'secret/' is not enabled.

Question 13

Refer to the exhibit. An operator wants the credential to be valid for exactly 2 hours. What should they do?

Accepted Answer

Increase the role's max_ttl to 2h.. To allow a 2-hour total lifetime, the role's max_ttl must be at least 2h. The current lease TTL is 30m but can be renewed up to the role's max_ttl. Simply renewing with 2h TTL will fail if max_ttl is lower. Increasing mount's max_lease_ttl does not change the role's maximum. Requesting a new credential does not have a direct TTL parameter.

Answer

Increase the mount's max_lease_ttl to 2h.

Answer

Renew the lease with a TTL of 2h.

Answer

Request a new credential with a TTL of 2h.

Question 14

Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)

Accepted Answer

The system's max_lease_ttl configuration. The actual TTL of a lease issued by a secrets engine is determined by the minimum of three values: the role's `default_ttl`, the role's `max_ttl`, and the system's `max_lease_ttl` configuration. The system's `max_lease_ttl` acts as a hard upper bound that cannot be exceeded by any lease, regardless of role settings. This ensures that even if a role has a longer `default_ttl`, the system-wide limit will cap the lease duration.

Answer

The requesting token's TTL

Answer

The backend's rotation period

Question 15

A company has a Vault cluster and wants to allow applications running in Kubernetes pods to authenticate without storing static secrets. Which Vault authentication method is specifically designed for Kubernetes?

Accepted Answer

Kubernetes. The Kubernetes auth method is specifically designed for Kubernetes workloads. It allows pods to authenticate to Vault using their Kubernetes service account token, which Vault validates against the Kubernetes API server. This eliminates the need to store static secrets in the cluster.

Answer

AWS IAM

Answer

JWT/OIDC

Answer

AppRole