VA-003 Practice Test 20 — 15 Questions

Question 1

A security team wants to ensure that all Vault policies for applications follow the principle of least privilege. They have a policy 'app-kv' that grants read access to secrets under 'secret/data/app/*'. An auditor finds that a developer can also read secrets under 'secret/data/team/*'. The policy currently uses a path-based glob. Which change should the team make to restrict access to only the app path?

Accepted Answer

Change the path to 'secret/data/app/' (without glob) and ensure the policy only grants 'read' capability.. Option D is correct because removing the glob and using an exact path 'secret/data/app/' restricts access to only that specific path. In Vault, a trailing slash without a glob matches exactly that path and its immediate children when used with the appropriate capabilities, enforcing least privilege without granting unintended access to other paths like 'secret/data/team/*'.

Answer

Change the path to 'secret/data/app/+' and use 'list' capability.

Answer

Change the path to 'secret/data/app/*' and add 'deny' capability for other paths.

Answer

Keep the path as 'secret/data/app/*' but add a policy with path 'secret/data/team/*' and 'deny' capability.

Question 2

An organization requires that all Vault secrets be encrypted with a key derived from a hardware security module (HSM) and that the cluster can be unsealed automatically. Which seal type should they use?

Accepted Answer

PKCS11 seal. The PKCS11 seal type is correct because it enables Vault to derive the unseal key from a key stored in a hardware security module (HSM) via the PKCS#11 interface. This allows automatic unsealing of the cluster by leveraging the HSM's key, meeting both the encryption and auto-unseal requirements.

Answer

Transit seal

Answer

Shamir seal

Answer

Cloud KMS seal

Question 3

A large enterprise uses Azure Active Directory as its identity provider. They want to authenticate users to Vault using Azure AD tokens. However, they require that Vault validate the token's signature and claims without contacting Azure AD every time. Which authentication method should they use?

Accepted Answer

OIDC authentication. Option B (OIDC authentication) is correct because OpenID Connect (OIDC) allows Vault to validate an Azure AD token's signature and claims locally using the provider's JWKS (JSON Web Key Set) endpoint, without requiring a round-trip to Azure AD for every authentication request. This satisfies the requirement for offline token validation while still leveraging Azure AD as the identity provider.

Answer

LDAP authentication

Answer

Token authentication

Answer

Azure authentication

Question 4

Refer to the exhibit. An application uses this policy to access Vault. The application is able to read database credentials from `database/creds/my-role`. However, attempts to list all roles at `database/roles/` fail. What is the most likely cause?

Accepted Answer

The policy does not allow the 'list' capability on the path `database/roles/`. The policy grants 'read' capability on `database/creds/my-role` but does not include the 'list' capability on `database/roles/`. In Vault, listing requires an explicit 'list' capability in the policy, even if 'read' is allowed on sub-paths. Without 'list', the API call to `LIST database/roles/` returns a permission denied error.

Answer

The path `database/roles/` is not a valid path for listing roles

Answer

The database secrets engine is not enabled

Answer

The application needs the 'sudo' capability to list roles

Question 5

Which TWO authentication methods support multi-factor authentication (MFA) natively within Vault Enterprise?

Accepted Answer

Userpass authentication. Userpass authentication in Vault Enterprise supports MFA natively because it can be configured with a second factor such as TOTP, Duo, or Okta directly within the auth method's configuration. This allows the userpass method to enforce both a password and an additional authentication factor without requiring an external identity provider or custom wrapper.

Answer

AWS IAM authentication

Answer

Token authentication

Answer

Kubernetes authentication

Question 6

An application uses transit encryption with convergent encryption enabled. Which THREE statements are true about convergent encryption? (Choose three.)

Accepted Answer

It produces the same ciphertext for the same plaintext and context.. Convergent encryption derives the encryption key from the plaintext content itself, typically by hashing the plaintext. Because the same plaintext always produces the same key, and the encryption algorithm is deterministic (no random nonce), the resulting ciphertext is identical for identical plaintexts. This property directly enables deduplication of encrypted data, as identical ciphertexts can be identified and stored only once.

Answer

It requires a separate key for each context.

Answer

It is typically slower than non-convergent encryption.

Question 7

A compliance requirement states that encryption keys must be automatically rotated every 90 days. Which Vault feature can be used to enforce this?

Accepted Answer

Setting `auto_rotate` on the transit key. Option A is correct because the Vault Transit Secrets Engine supports an `auto_rotate` parameter that can be set on a key to enforce automatic rotation every 90 days. When enabled, Vault automatically rotates the encryption key at the specified interval without manual intervention, directly meeting the compliance requirement for automated 90-day rotation.

Answer

Using Vault's cron-like scheduler

Answer

Periodic rotation using the transit engine's `min_decryption_version`

Answer

Key rotation schedule policy

Answer

Using a periodic token to call the rotate endpoint

Question 8

An application encrypts data using the transit engine and stores the ciphertext in a database. After a key rotation, the application can no longer decrypt the data. What is the most likely cause?

Accepted Answer

The `min_decryption_version` was set to a value higher than the old key version. Option D is correct because the `min_decryption_version` parameter in Vault's transit engine specifies the minimum key version that can be used for decryption. After a key rotation, if this value is set higher than the old key version, the engine will refuse to decrypt data encrypted with that older version, even if the old key data is still present in the key ring. This is a common misconfiguration that leads to decryption failures post-rotation.

Answer

The ciphertext was generated with a different key

Answer

The token used for decryption has been revoked

Answer

The key was rotated and the old version was automatically deleted

Answer

The transit engine was disabled

Question 9

Which TWO of the following are benefits of using Vault's transit engine for encryption as a service?

Accepted Answer

Applications can encrypt/decrypt data without accessing the key material. Vault's transit engine enables applications to encrypt and decrypt data without ever having access to the underlying key material. The encryption keys are stored securely within Vault, and applications only interact with the engine via API calls, ensuring that the keys remain protected and never exposed to client memory or logs.

Answer

The encryption key is stored in the application's memory

Answer

Keys can be exported and used in external applications

Answer

Only the root token can manage keys

Question 10

A Vault cluster uses DR replication. The primary cluster fails, and the DR secondary is promoted to primary. After promotion, some secret data written to the primary shortly before the failure is missing on the new primary. What is the most likely reason?

Accepted Answer

The data had not yet been replicated to the DR secondary before the primary failed.. In Vault DR replication, data is asynchronously replicated from the primary to the secondary cluster. If the primary fails before the replication stream has transmitted the most recent writes, those writes are lost. When the DR secondary is promoted to primary, it only contains data that was successfully replicated up to the point of failure. This is the most likely reason the secret data is missing.

Answer

The seal wrapping key was rotated on the primary after the last replication.

Answer

The secret engine was not enabled on the DR secondary.

Answer

The DR secondary was promoted with the 'force' option, which skips replication of the last writes.

Question 11

A Vault administrator is configuring Consul as the storage backend. The Consul cluster will span three data centers with low latency links. Which Consul deployment is recommended for Vault to ensure data safety?

Accepted Answer

5 Consul servers in a single datacenter. Option D is correct because Vault requires a strong consistency guarantee for its storage backend, and Consul achieves this via the Raft consensus protocol, which requires a majority of servers to be available. A single datacenter with 5 Consul servers provides the necessary fault tolerance and quorum (3 out of 5) to survive failures while maintaining data safety. Spreading servers across datacenters with low latency links still introduces network partitions and higher latency, which can break Raft's stability and lead to split-brain scenarios or degraded performance.

Answer

3 Consul servers across 3 datacenters (1 per DC)

Answer

3 Consul servers in each datacenter (total 9)

Answer

3 Consul servers in one datacenter with agents in others

Question 12

Which TWO of the following are correct statements about Vault secrets engines?

Accepted Answer

The Transit secrets engine performs encryption operations without storing the encrypted data.. Option B is correct: dynamic secrets engines generate credentials on demand with a TTL. Option E is correct: the Transit secrets engine performs encryption operations without storing the data. Option A is incorrect because each engine instance is mounted at a single path, though the same engine type can be enabled at multiple paths. Option C is incorrect because static secrets (e.g., database static roles) can have rotation. Option D is incorrect because each KV engine is either v1 (unversioned) or v2 (versioned), not both.

Answer

Secrets engines are enabled at a path, and each engine can be mounted at multiple paths.

Answer

The KV secrets engine can be configured to store both versioned and unversioned data simultaneously.

Answer

Static secrets engines do not support rotation.

Question 13

A company is deploying Vault in a Kubernetes environment. Which three components are essential for a production-ready Vault on Kubernetes? (Choose three.)

Accepted Answer

A persistent volume claim for each Vault pod for storage.. Option B is correct because Vault requires durable storage for its encrypted data (the storage backend). In Kubernetes, a PersistentVolumeClaim (PVC) provides this durable block or file storage that survives pod restarts. Without a PVC, Vault would lose its data when the pod is rescheduled, making it unsuitable for production.

Answer

A ConfigMap to store Vault configuration including unseal keys.

Answer

An Ingress controller to expose Vault externally.

Question 14

A DevOps team is writing a Vault policy for a CI/CD pipeline that needs to authenticate using AppRole, read specific secrets, and write dynamic database credentials. Which THREE capabilities should be included in the policy to meet these requirements? (Choose three.)

Accepted Answer

create. Option B (create) is correct because the CI/CD pipeline needs to write dynamic database credentials, which requires the 'create' capability on the database secrets engine path (e.g., database/creds/my-role). The 'create' capability allows generating new credentials from a role, which is distinct from simply updating existing secrets. Without 'create', the pipeline cannot request fresh credentials from the database backend.

Answer

write

Answer

sudo

Question 15

A company uses Vault to store application configuration secrets for multiple teams. The Vault cluster is running in production and has the KV secrets engine enabled at the path 'secret/' using version 2. A DevOps engineer, using a Vault token with full admin access, creates a new secret at 'secret/data/team-a/app-config' using the CLI command 'vault kv put secret/team-a/app-config key=value'. The secret is intended for the CI/CD pipeline, which uses a token with a policy that grants 'read' capability on 'secret/data/*'. The pipeline is configured to read the secret by calling the Vault API at the path 'v1/secret/team-a/app-config'. The pipeline reports a 404 Not Found error. The pipeline engineer verifies that the token is valid and has the correct policy attached. All other secrets in the same path can be read successfully by the pipeline. What is the most likely cause of the 404 error?

Accepted Answer

The pipeline is using the wrong API path: for KV v2, the path must include '/data/' before the secret path.. The correct action is to update the pipeline to use the path 'v1/secret/data/team-a/app-config', because KV v2 requires the '/data/' prefix in the API path. Options A and B are incorrect because the engine is enabled and the policy covers the path. Option C is incorrect because the secret exists at the expected location; the issue is the API path used by the pipeline.

Answer

The secret engine at 'secret/' is not enabled.

Answer

The secret was written to a different path than expected.

Answer

The token's policy does not cover the path 'secret/team-a/app-config'.