VA-003 Practice Test 19 — 15 Questions

Question 1

A small company uses Vault with LDAP authentication for their employees. They configured the LDAP auth method pointing to their on-premises Active Directory. Several users report that they can log in to the Vault UI, but they cannot see any secrets in the paths they expect. The administrator verified that the users are in the correct AD groups. The Vault policies are defined and assigned to groups via the LDAP auth method's group mapping. However, the users still have no permissions. What is the most likely root cause and the correct fix?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The group mapping in Vault does not match the AD group names (case or syntax).. The most likely root cause is that the group mapping in Vault does not match the AD group names due to case sensitivity or syntax differences. Vault's LDAP auth method performs exact string matching when mapping LDAP groups to Vault policies; if the group names in the Vault configuration (e.g., 'Domain Admins') differ from the actual AD group names (e.g., 'Domain Admins' with a trailing space or different case), the mapping fails, resulting in no policy assignment and thus no permissions.

Answer

The LDAP bind credentials are incorrect.

Answer

The LDAP auth method is not enabled.

Answer

The Vault token's TTL is too short.

Question 2

An administrator wants to allow human users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP auth. LDAP (Lightweight Directory Access Protocol) authentication allows integration with corporate Active Directory by binding to the directory service using a user's credentials. This enables centralized authentication against existing AD user objects without duplicating accounts in the Vault system.

Answer

Token auth

Answer

GitHub auth

Answer

Userpass auth

Question 3

A developer needs to generate a new certificate for an internal web service using the PKI secrets engine. A role named 'webserver' has been created. What is the correct command to issue the certificate?

Accepted Answer

vault write pki/issue/webserver common_name=web.example.com. The PKI secrets engine uses the path `pki/issue/<role_name>` to issue certificates. The `vault write` command sends a POST request to this endpoint with the required `common_name` parameter, which generates a new certificate signed by the CA associated with the 'webserver' role.

Answer

vault write pki/webserver/issue

Answer

vault write pki/webserver/cert common_name=web.example.com

Answer

vault read pki/cert/webserver

Question 4

Refer to the exhibit. An application uses this policy to access Vault. The application is able to read database credentials from `database/creds/my-role`. However, attempts to list all roles at `database/roles/` fail. What is the most likely cause?

Accepted Answer

The policy does not allow the 'list' capability on the path `database/roles/`. The policy grants 'read' capability on `database/creds/my-role` but does not include the 'list' capability on `database/roles/`. In Vault, listing requires an explicit 'list' capability in the policy, even if 'read' is allowed on sub-paths. Without 'list', the API call to `LIST database/roles/` returns a permission denied error.

Answer

The path `database/roles/` is not a valid path for listing roles

Answer

The database secrets engine is not enabled

Answer

The application needs the 'sudo' capability to list roles

Question 5

A Vault cluster configured with auto-unseal using AWS KMS is deployed across two availability zones. After a network partition, the standby node remains sealed while the active node is unsealed and serving requests. What is the most likely reason the standby cannot unseal?

Accepted Answer

The standby node cannot communicate with AWS KMS due to the network partition.. In a Vault cluster with auto-unseal via AWS KMS, each node must independently communicate with AWS KMS to unseal itself. A network partition that isolates the standby node from AWS KMS prevents it from reaching the KMS endpoint, so it cannot decrypt its unseal key and remains sealed. The active node is unaffected because it is already unsealed and serving requests from the other side of the partition.

Answer

The standby node is using the wrong AWS region configuration.

Answer

The active node consumed all available KMS API quota for the region.

Answer

The cluster address on the standby is misconfigured.

Question 6

A token has the properties shown in the exhibit. A user attempts to use this token to write a secret to 'secret/data/myapp'. The token fails with a permission denied error. What is the most likely cause?

Accepted Answer

The token's policies do not grant write capability on the target path.. The token's policies define the access control rules for paths in Vault. Since the user received a permission denied error when attempting to write to 'secret/data/myapp', the most likely cause is that the token's attached policies do not include a 'write' or 'create' capability on that specific path. Policies are evaluated based on the path and the requested operation, and without the appropriate capability, the request is denied regardless of other token properties.

Answer

The token has an explicit max TTL of 0s, which prevents write operations.

Answer

The token is a service token but the write operation requires a batch token.

Answer

The token is orphaned, so it cannot be used for write operations.

Question 7

A Vault operator runs `vault status` and sees the output above. The Vault cluster is in production and currently unresponsive to API requests. What is the most likely cause of the unresponsiveness?

Accepted Answer

The Vault cluster is sealed.. The `vault status` output shows that the Vault cluster is sealed. When a Vault cluster is sealed, it cannot process any API requests because the encryption key required to decrypt the data is not available in memory. This is the most common cause of unresponsiveness in a production Vault cluster that has been properly initialized.

Answer

The cluster is not initialized.

Answer

The cluster does not have HA enabled.

Answer

The cluster has no active leader.

Question 8

Refer to the exhibit. A developer reports that a token they created using `vault token create -policy=my-policy -ttl=2h` is no longer working after 1 hour. The token lookup output shows the token details. What is the most likely cause?

Accepted Answer

The token's max_ttl was set to 1h when created, and the token reached its max_ttl.. The token was created with a `-ttl=2h` but the token lookup output shows `max_ttl=1h`. The `max_ttl` is an upper limit enforced by the token's configuration or the system's maximum TTL setting. Even though the requested TTL was 2 hours, the token's effective lifetime is capped by the lower of the two values, so it expired after 1 hour.

Answer

The token has num_uses set to 0, meaning it can only be used once.

Answer

The token is a service token and cannot be renewed.

Answer

The token is an orphan token and requires the parent token to be valid.

Question 9

A Vault administrator needs to create a policy that grants users read access only to the secrets that belong to their own team. The team membership is stored in an external identity provider and mapped to Vault entity aliases. The administrator wants to use a templated policy that references the entity's metadata. Which policy syntax accomplishes this goal?

Accepted Answer

path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }. It uses the proper templating syntax `{{identity.entity.metadata.team}}` to reference the `team` metadata key stored on the Vault entity. This allows the policy to dynamically grant read and list access to the path `secret/data/<team>/*`, ensuring users only see secrets belonging to their own team as defined by the external identity provider.

Answer

path "secret/data/{{entity.metadata.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{identity.entity.aliases.team}}/*" { capabilities = ["read", "list"] }

Question 10

Where can you view a list of all active tokens in Vault?

Accepted Answer

`vault list auth/token/accessors`. `vault list auth/token/accessors` retrieves token accessors, which are unique identifiers for active tokens. While you cannot directly list tokens for security reasons, listing accessors is the standard way to view active tokens. Option A is false because there is a way to list tokens via their accessors. Option B is false because `vault token list` is not a valid command. Option D is false because both A and B are not true.

Answer

There is no way to list all tokens.

Answer

`vault token list`

Answer

Both A and B

Question 11

A company has multiple AWS accounts and wants to allow EC2 instances to authenticate to Vault without storing any secrets on the instances. Which authentication method should they use?

Accepted Answer

AWS. (AWS) is correct because the AWS authentication method in Vault allows EC2 instances to authenticate using their AWS instance identity documents and PKCS#7 signatures, without requiring any long-lived secrets to be stored on the instances. Vault verifies the instance's identity by calling the AWS EC2 API to validate the document and signature, then binds the instance to a Vault role. This eliminates the need to store tokens or credentials on the instance, meeting the requirement of secretless authentication.

Answer

OIDC

Answer

TLS Certificates

Answer

AppRole

Question 12

Which THREE are best practices when selecting authentication methods for different use cases?

Accepted Answer

Use AppRole for automated CI/CD pipelines.. Option A is correct because AppRole is purpose-built for machine-to-machine authentication: it issues a RoleID and SecretID that a CI/CD pipeline can deliver programmatically, and its response-wrapping and secret-ID lifecycle controls make it the recommended method for automated, non-interactive workloads. Option C is correct because AWS IAM auth lets an EC2 instance present its instance profile credentials to Vault, which verifies the AWS-signed request via STS, so no static Vault credentials need to be stored on the instance. Option E is correct because LDAP auth binds directly to a directory such as Active Directory, allowing human users to authenticate with their existing AD credentials and inherit group-based policies, which is the standard approach for enterprise human access. Option B is not a best practice because making token auth the sole method for everyone ignores stronger, purpose-specific methods and forces manual token distribution and lifecycle management, increasing leakage risk. Option D is not a best practice as stated because Kubernetes auth is only appropriate for pods running in a Kubernetes cluster that Vault is configured to trust; using it 'in any environment' is impossible where no Kubernetes service account token or Vault Kubernetes auth role exists.

Answer

Use token auth as the sole method for all users and machines.

Answer

Use Kubernetes auth for pods in any environment.

Question 13

Which TWO of the following Vault CLI commands can be used to write data to Vault?

Accepted Answer

vault write. Option D, `vault write`, is correct because it is the general-purpose Vault CLI command for writing data to a path, such as `vault write secret/foo bar=baz`, and it works across secrets engines including KV v1 and v2. Option E, `vault kv put`, is correct because it is the KV secrets engine subcommand specifically designed to write key-value data, e.g. `vault kv put secret/foo bar=baz`, and it handles KV v2 versioning automatically. The unmarked options do not belong: `vault set`, `vault put`, and `vault push` are not valid Vault CLI commands for writing data, so they would fail as unknown subcommands.

Answer

vault set

Answer

vault put

Answer

vault push

Question 14

A company uses Vault's Kubernetes authentication method to provide secrets to pods. Pods in the 'production' namespace need to read secrets from the path 'secret/data/app/prod'. The administrator has created a Vault role that maps the service account to a policy with capabilities ['read', 'list'] on path 'secret/data/app/*'. However, pods report 'permission denied' when trying to read the secrets. The administrator verifies that the service account has the correct Vault role attached and that the Vault token is being used correctly. What is the most likely cause?

Accepted Answer

The Vault mount for 'secret' is KV v1, so the path should be 'secret/app/prod' without 'data'.. The most likely cause is that the Vault mount for 'secret' is using KV v1, which does not use the 'data' segment in the path. The policy is written with 'secret/data/app/*' (KV v2 path), but because the mount is KV v1, the actual path is 'secret/app/prod'. This path mismatch leads to 'permission denied' because the policy does not apply to the correct path.

Answer

The policy should include the 'sudo' capability.

Answer

The pods are using a token with insufficient TTL.

Answer

The Vault role is not bound to the correct Kubernetes namespace.

Question 15

A Vault administrator wants to allow a CI/CD pipeline to create short-lived tokens for deployment jobs. The pipeline itself authenticates with a periodic token. Which token type should the pipeline use to create tokens for jobs, considering the jobs need to be independent and not affected by the pipeline token's lifecycle?

Accepted Answer

Orphan tokens. Orphan tokens are the correct choice because they allow the CI/CD pipeline to create child tokens that are not tied to the parent token's lifecycle. When a periodic token creates an orphan token, the child token remains valid even if the parent token is revoked or expires, ensuring deployment jobs are independent and not affected by the pipeline token's lifecycle.

Answer

Service tokens with explicit max TTL

Answer

Periodic tokens

Answer

Batch tokens