VA-003 Practice Test 2 — 10 Questions

Question 1

An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?

Accepted Answer

POST /v1/auth/token/renew. The `POST /v1/auth/token/renew` endpoint is the standard Vault API call to extend the Time-To-Live (TTL) of an existing token, which is a core token lifecycle operation. This endpoint accepts the token to renew in the request body and returns a new lease duration, adhering to Vault's token management design.

Answer

PUT /v1/auth/token/roles

Answer

DELETE /v1/auth/token/revoke

Question 2

A large e-commerce company uses Vault to manage database credentials for microservices. They have a Vault cluster of 5 nodes using Integrated Storage (Raft). To increase capacity, they add a sixth node to the cluster. Shortly after, they notice intermittent 'no leader' errors in the Vault logs, and some clients experience failures when reading secrets. The cluster was functioning correctly before the addition. What is the most likely cause and the recommended action?

Accepted Answer

The cluster now has an even number of nodes, which can cause split-brain scenarios and leader election issues. Recommended action: remove the new node to revert to 5 nodes, or add a seventh node to make it odd.. The Vault cluster uses Integrated Storage (Raft), which relies on a consensus protocol that requires an odd number of nodes to maintain a quorum. Adding a sixth node creates an even number, increasing the risk of a split-brain scenario where no single group can achieve a majority, leading to 'no leader' errors and client failures. The recommended action is to either remove the new node to revert to 5 nodes or add a seventh node to restore an odd count.

Answer

The cluster's Raft protocol requires all nodes to be voters, but the new node is a non-voter. Recommended action: promote the new node to voter.

Answer

The new node has a different storage performance, causing it to lag behind and not participate in consensus. Recommended action: replace the new node with a faster instance.

Answer

The new node was not properly joined to the cluster and is running as a standalone server. Recommended action: re-run the join command and ensure the node is part of the cluster.

Question 3

Which TWO of the following are valid uses of a token accessor? (Select exactly 2 options.)

Accepted Answer

Lookup token properties. A token accessor is a non-sensitive reference to a Vault token that allows certain operations without exposing the token ID itself. The `lookup` and `revoke` operations are valid uses of a token accessor because they can be performed using the accessor via the Vault API or CLI (e.g., `vault token lookup -accessor ` and `vault token revoke -accessor `). These operations do not require the actual token value, preserving security while enabling token management.

Answer

Wrap the token

Answer

Create a child token

Answer

Renew the token

Question 4

Which TWO of the following are features of the AWS secrets engine compared to the Azure secrets engine?

Accepted Answer

Can generate IAM users with custom policies. The AWS secrets engine can dynamically generate IAM users with custom policies attached, allowing fine-grained access control for applications. Option E is correct because the engine can generate STS temporary credentials for cross-account access, enabling secure, time-limited access to AWS resources in different accounts.

Answer

Supports federation via SAML with Azure AD

Answer

Provides native integration with Azure Key Vault for key management

Answer

Allows connection to AWS via IAM instance profiles

Question 5

An administrator needs to issue tokens that are automatically renewable by the client (so they can stay alive as long as renewed) but must expire no later than 30 days. Which TWO token parameters should be configured on the token role?

Accepted Answer

max_ttl. (max_ttl) is correct because it enforces the absolute maximum lifetime of the token, ensuring it expires no later than 30 days regardless of renewals. Option D (period) is correct because setting a period makes the token automatically renewable by the client, allowing it to stay alive as long as it is renewed before the period expires. Together, period enables automatic renewal behavior and max_ttl caps the total lifespan at 30 days.

Answer

renewable

Answer

ttl

Answer

num_uses

Question 6

Refer to the exhibit. After executing these commands, what is the expected behavior?

Accepted Answer

The decryption command requires the key version to be specified. In the Vault Transit secrets engine, when a key has multiple versions (e.g., after rotation), the decryption command requires the key version to be specified to ensure the correct key is used. If the version is not specified, Vault defaults to the latest version, which may not match the version used for encryption, leading to decryption failure. Therefore, option C is correct.

Answer

The key is automatically rotated every 30 days

Answer

The ciphertext is base64 encoded, and the plaintext is base64 decoded automatically

Answer

The encryption operation will fail because the key type 'aes256-gcm96' is incorrect

Question 7

A cloud-native application uses Vault's Kubernetes auth method to inject tokens into pods. Each pod receives a Vault token with a TTL of 1 hour, renewable. The application is designed to renew tokens before they expire. However, after a recent update, some pods are failing to authenticate with Vault, reporting 'token not found' errors. The operations team checks the Vault audit logs and sees that tokens associated with these pods are being revoked immediately after creation. The pods have not performed any revocation. What is the most likely cause?

Accepted Answer

The Kubernetes service account that the pod uses has been deleted or its token has been invalidated, causing Vault to revoke derived tokens.. Vault's Kubernetes auth method creates a derived token that is tied to the Kubernetes service account token used during login. If the Kubernetes service account is deleted or its token is invalidated (e.g., due to rotation or expiration), Vault immediately revokes all derived tokens. The audit logs confirm revocation without pod action, and the TTL/renewal design points to an external dependency failure, not a Vault-side issue.

Answer

The Kubernetes auth method's 'kubernetes_ca_cert' has expired, causing Vault to invalidate all tokens.

Answer

The Vault tokens are being created as batch tokens and are immediately revoked due to a misconfiguration.

Answer

The pods are attempting to renew tokens too frequently, exceeding a rate limit.

Question 8

An application is failing to decrypt data using the transit secrets engine. The ciphertext was generated with key 'my-key' version 3, but the engine currently shows key version 5. What is the most likely cause of the failure?

Accepted Answer

The min_decryption_version is set to 4, preventing decryption with version 3. The transit secrets engine allows configuring a minimum decryption version (`min_decryption_version`) for each key. If this value is set to 4, the engine will refuse to decrypt any ciphertext generated with key version 3, even if version 3 still exists in the key ring. This is the most direct and likely cause of the failure, as the ciphertext was created with version 3 but the engine now enforces a higher minimum version.

Answer

The ciphertext was generated by a different transit key

Answer

The key was rotated, and automatic data re-encryption is required

Answer

The application is using the wrong encryption algorithm

Question 9

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Accepted Answer

Enable AppRole authentication, create a role, retrieve the RoleID, generate a SecretID, then login.. First enable the auth method, then create the role, then retrieve the RoleID, generate a SecretID, and finally login.

Answer

Create a role, enable AppRole authentication, retrieve the RoleID, generate a SecretID, then login.

Answer

Enable AppRole authentication, create a role, generate a SecretID, retrieve the RoleID, then login.

Answer

Enable AppRole authentication, create a role, retrieve the RoleID, login, then generate a SecretID.

Question 10

A DevOps team needs to create a Vault policy that allows reading secrets from path "secret/data/app" but only for the key "db_password". They want to enforce this using Vault's policy syntax. Which policy statement achieves this?

Accepted Answer

path "secret/data/app" { capabilities = ["read"]; allowed_parameters = {"db_password"=[]} }. Vault policy syntax uses `allowed_parameters` to restrict which keys within a path can be read. By setting `allowed_parameters = {"db_password"=[]}`, the policy permits reading only the `db_password` key under `secret/data/app`, while denying access to any other keys at that path. This enforces the requirement precisely.

Answer

path "secret/data/app" { capabilities = ["read"] }

Answer

path "secret/data/app/db_password" { capabilities = ["read"] }

Answer

path "secret/data/app" { capabilities = ["read"]; required_parameters = ["db_password"] }