VA-003 Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. A user with this policy can successfully read credentials but cannot renew the lease. What is the missing capability?

Accepted Answer

'update' on sys/leases/renew.. The user can read credentials but cannot renew the lease because the policy grants 'read' and 'list' capabilities on the secret path, but renewing a lease requires the 'update' capability on the 'sys/leases/renew' endpoint. This endpoint is used to extend the lifetime of a lease, and without 'update' access, the renewal request is denied.

Answer

'list' on sys/leases/.

Answer

'renew' on the secret path.

Answer

'sudo' on sys/leases/.

Question 2

Which TWO authentication methods are designed for human users? (Choose two.)

Accepted Answer

OIDC. OIDC (OpenID Connect) is an identity layer built on top of OAuth 2.0 that allows human users to authenticate via an external identity provider (IdP) using tokens (ID tokens in JWT format). It is specifically designed for human user authentication, enabling single sign-on (SSO) across applications.

Answer

AWS

Answer

Kubernetes

Answer

AppRole

Question 3

A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?

Accepted Answer

AWS IAM auth. AWS IAM auth is the most appropriate and secure method because it allows Jenkins jobs running on EC2 instances to authenticate to Vault using the instance's AWS IAM role without storing any long-lived credentials. The EC2 instance obtains temporary AWS credentials via the instance metadata service (IMDS), and Vault validates these against AWS STS to issue a short-lived Vault token. This eliminates the need to manage static secrets or tokens in Jenkins job configurations.

Answer

GitHub personal access token

Answer

AppRole

Answer

Username & password (userpass)

Question 4

A DevOps engineer is configuring Vault to encrypt data in transit for a microservice. They create a key in the transit engine and want to encrypt a base64-encoded plaintext. Which API path and operation should they use?

Accepted Answer

POST /v1/transit/encrypt/{key_name} with plaintext in payload. The Vault Transit Secrets Engine exposes a POST endpoint at `/v1/transit/encrypt/{key_name}` that accepts a JSON payload containing the `plaintext` field, which must be base64-encoded. This operation encrypts the provided plaintext using the named encryption key and returns the ciphertext. The POST method is required because the operation modifies state (encrypts data) and the plaintext is sent in the request body, not as a query parameter.

Answer

POST /v1/transit/encrypt/{key_name} with ciphertext in payload

Answer

GET /v1/transit/encrypt/{key_name} with query param

Answer

POST /v1/transit/sign/{key_name}

Answer

POST /v1/transit/hmac/{key_name}

Question 5

A DevOps team is setting up a Vault cluster for the first time. They plan to use AWS KMS for auto-unseal and Consul as the storage backend. As part of the architecture, which TWO components are essential for the Vault server to start and serve requests?

Accepted Answer

A storage backend. B is correct because Vault requires a storage backend to persist data such as secrets, policies, and tokens. Without a configured storage backend (e.g., Consul), the Vault server cannot initialize or serve requests, as it has no place to store or retrieve state. The storage backend is the foundation for all Vault operations, including high-availability coordination.

Answer

A public CA certificate

Answer

A 4096-bit encryption key

Answer

A load balancer

Question 6

A user receives 'permission denied' when running 'vault write secret/data/myapp value=123'. The user's token has a policy that includes 'path "secret/data/*" { capabilities = ["read", "list"] }'. What is the most likely cause?

Accepted Answer

The path requires create or update capability.. The user's policy grants only 'read' and 'list' capabilities on the path 'secret/data/*'. The 'vault write' command requires either 'create' or 'update' capability (or both) on the path. Since the policy lacks these capabilities, Vault returns a 'permission denied' error, even though the token is valid and the secret engine is mounted.

Answer

The user is not authenticated.

Answer

The secret engine is not mounted.

Answer

The token is expired.

Question 7

A healthcare application needs to encrypt sensitive patient data before storing it in a legacy database that does not support encryption. The team wants to use Vault's encryption as a service. However, the application is running on a restricted network that cannot make outbound HTTP requests to Vault. Which solution should the team implement?

Accepted Answer

Deploy Vault Agent in sidecar mode with a configured encrypt stanza to handle encryption locally.. Vault Agent in sidecar mode runs alongside the application on the same host, handling encryption locally without requiring outbound HTTP requests. The encrypt stanza in the agent configuration allows it to proxy encryption operations to Vault's transit secrets engine, while the application communicates with the agent over a local loopback interface, bypassing network restrictions.

Answer

Set up Vault replication from a central Vault to a local Vault instance.

Answer

Use Vault's HTTP API from the application to encrypt data directly.

Answer

Enable the transit secrets engine and call Vault's encrypt endpoint.

Question 8

Which THREE authentication methods support generating tokens with TTL and renewable options?

Accepted Answer

Userpass authentication. Userpass authentication (B) is correct because Vault's userpass auth method supports token generation with configurable TTL (time-to-live) and renewable options via the `token_ttl` and `token_renewable` parameters in the auth method configuration or role settings. This allows administrators to enforce session lifetimes and permit token renewal for user accounts authenticated via username/password.

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 9

A company is using Vault's Integrated Storage (Raft) for high availability. During a network partition, two Vault nodes become isolated from the third. What happens to the isolated nodes?

Accepted Answer

The two isolated nodes continue to serve requests, the third stops. In Vault Integrated Storage (Raft), a quorum of nodes (majority) is required to maintain cluster leadership and serve requests. During a network partition where two nodes are isolated from the third, the two nodes form a majority (2 out of 3) and can continue to serve requests, while the isolated third node loses quorum and stops serving requests to prevent split-brain. This behavior is enforced by the Raft consensus algorithm, which requires a majority for any write or read operations to ensure consistency.

Answer

All three nodes automatically rejoin after partition

Answer

All three nodes continue to serve requests

Answer

The two isolated nodes stop serving requests

Question 10

An administrator configured the database secrets engine with PostgreSQL. When an application requests credentials, Vault returns a username and password. However, the application reports that the credentials are not working. What is the most likely cause?

Accepted Answer

The database user used by Vault does not have sufficient privileges to create users.. The most likely cause is that the database user configured in Vault lacks the necessary privileges to create new database users. When Vault generates dynamic credentials, it uses its own database connection (the root or management user) to execute `CREATE USER` and `GRANT` statements. If that user does not have the `CREATEROLE` or `SUPERUSER` attribute (or equivalent `CREATE USER` privilege in PostgreSQL), the credential creation fails silently or produces unusable credentials, even though Vault returns a username and password.

Answer

The TTL on the role is set too low.

Answer

The connection string provided to Vault is incorrect.

Answer

The generated credentials were revoked by Vault before the application used them.

Question 11

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Accepted Answer

Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.. Increasing the default lease TTL to 8 hours reduces the frequency of lease renewals, directly addressing the performance issue. Configuring periodic tokens with a short TTL ensures that the token itself still rotates frequently, maintaining security by limiting the window of exposure if a token is compromised. This balances reduced renewal overhead with strong security posture.

Answer

Remove the TTL entirely so that credentials never expire.

Answer

Decrease the default lease TTL from 1 hour to 30 minutes.

Answer

Increase the maximum TTL for the role to 24 hours.

Question 12

Which TWO of the following are valid uses of the Vault transit secrets engine?

Accepted Answer

Signing arbitrary data for verification. The Vault transit secrets engine can sign arbitrary data using a managed key, allowing verification of the signature's authenticity without exposing the key. This is a core encryption-as-a-service feature, enabling data integrity and non-repudiation for external systems.

Answer

Generating random bytes for cryptographic salt

Answer

Exporting the encryption key for use outside Vault

Answer

Storing static secrets like API keys

Question 13

A security team wants to store static secrets like API keys in Vault. They need the secrets to be versioned and support rollback. Which secrets engine should they use?

Accepted Answer

KV v2. KV v2 is the correct choice because it is designed specifically for storing static secrets with built-in versioning and rollback capabilities. Unlike KV v1, which overwrites data without preserving history, KV v2 retains a configurable number of secret versions, allowing administrators to undelete or roll back to a previous version using the `vault kv rollback` command or API calls.

Answer

Cubbyhole

Answer

KV v1

Answer

Transit

Question 14

A healthcare company uses Vault Transit to encrypt patient records before storing them in a database. Each request to encrypt a small field (e.g., SSN) takes about 200ms due to network latency and cryptographic overhead. The application needs to encrypt millions of records daily, causing performance bottlenecks. The team wants to reduce latency per encryption operation. After reviewing the Vault documentation, they consider the following options: A. Use the batch encryption endpoint to encrypt multiple plaintexts in a single API call. B. Deploy a local caching proxy on each application server to intercept encryption calls. C. Enable Vault's built-in encryption result caching. D. Use a dedicated, high-performance Vault cluster with more resources. Which option most directly reduces per-operation latency?

Accepted Answer

Use the batch encryption endpoint. The batch encryption endpoint in Vault Transit allows multiple plaintexts to be encrypted in a single API call, amortizing the fixed overhead of network latency and cryptographic setup across all records in the batch. This directly reduces per-operation latency because the 200ms cost is incurred once per batch rather than once per individual encryption. Options that address caching or cluster performance do not reduce the per-call overhead of the encryption operation itself.

Answer

Deploy a local caching proxy

Answer

Use a dedicated, high-performance Vault cluster

Answer

Enable Vault's built-in encryption result caching

Question 15

A token with a policy that explicitly denies 'read' on 'secret/engineering/private' is issued. The same token also has another policy that grants 'read' on 'secret/engineering/*'. What is the result when the token tries to read 'secret/engineering/private'?

Accepted Answer

The read fails because the explicit deny on the specific path takes precedence. D is correct because Vault's policy evaluation uses a deny-overrides model: any explicit deny on a specific path takes precedence over any allow, even if the allow is more permissive or from a wildcard. The explicit deny on 'secret/engineering/private' blocks the read, regardless of the broader grant on 'secret/engineering/*'.

Answer

The read succeeds because the grant from the wildcard policy is more permissive

Answer

The read fails because the policies conflict and Vault defaults to deny

Answer

The read succeeds because the token has a separate policy that grants read