VA-003 Practice Test 20 — 15 Questions

Question 1

A DevOps team is deploying Vault in a Kubernetes cluster. They want to ensure that when a pod starts, it can obtain a short-lived Vault token without human intervention. Which Vault architecture component should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vault Agent sidecar. The Vault Agent sidecar runs alongside the application container in the same pod, automatically authenticating to Vault and retrieving a short-lived token. This eliminates the need for human intervention by handling the authentication lifecycle (e.g., using Kubernetes auth method) and renewing or re-authenticating as needed, ensuring the application always has a valid token.

Answer

Audit Device

Answer

Storage Backend (Consul)

Answer

Vault CLI with token helper

Question 2

An administrator wants to create a policy that grants the ability to list all authentication methods enabled on the Vault server. Which path and capability are required?

Accepted Answer

path "sys/auth" { capabilities = ["list"] }. Option A. To list all enabled authentication methods, the required path is 'sys/auth' with the 'list' capability. The 'list' action returns the names of all auth methods. Option B is incorrect because it includes 'read', which is unnecessary and not required for listing. Option C is also incorrect because it only has 'read', which would only retrieve a specific method if the name is known. Option D uses a wildcard 'auth/*', which would grant list capability on all sub-paths under 'auth/', but the standard path for listing auth methods is 'sys/auth'. Therefore, option A is the most precise and correct.

Answer

path "sys/auth" { capabilities = ["read", "list"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Answer

path "auth/*" { capabilities = ["list"] }

Question 3

A company wants to securely store database credentials for a dynamic application that spins up new instances frequently. They need to ensure each instance gets a unique, time-limited username/password pair with minimal operational overhead. Which approach should they use?

Accepted Answer

Enable the database secrets engine and configure role-based dynamic credential generation. The database secrets engine in HashiCorp Vault is designed specifically for dynamic credential generation, creating unique, time-limited username/password pairs on-demand for each instance. This approach minimizes operational overhead by automating credential lifecycle management, including automatic revocation after the TTL expires, which aligns perfectly with the requirement for frequently spinning up instances.

Answer

Use the transit secrets engine to encrypt the static credentials and distribute them

Answer

Use the PKI secrets engine to issue certificates for database authentication

Answer

Store the credentials in KV v2 and have each instance read them

Question 4

Which two of the following are valid lease operations? (Choose two.)

Accepted Answer

vault lease renew. `vault lease renew` is a valid Vault CLI command used to extend the lifetime of a lease before it expires. In HashiCorp Vault, leases are associated with dynamic secrets (e.g., database credentials, AWS IAM keys) and must be periodically renewed to maintain access. The `renew` operation is a core lease lifecycle operation supported by the Vault API and CLI.

Answer

vault lease create

Answer

vault lease delete

Answer

vault lease generate

Question 5

Refer to the exhibit. A Vault administrator configures a three-node cluster with the above configuration on all nodes (with appropriate node_id). After starting all nodes, the administrator unseals node2 and node3. Node1 remains sealed. What will be the cluster state?

Accepted Answer

Nodes 2 and 3 will form a quorum and elect a leader; Node1 will be a standby when unsealed.. In a Vault cluster, a quorum requires a majority of nodes to be unsealed and available. With three nodes, the quorum size is 2. Nodes 2 and 3, both unsealed, form a quorum and elect a leader among themselves. Node1, though sealed, is still a cluster member; once unsealed, it will join as a standby node, not as a leader, because the leader election has already occurred.

Answer

Nodes 2 and 3 will each try to become leader, causing a split-brain.

Answer

Node1 will automatically join the cluster once unsealed.

Answer

The cluster will be unavailable because Node1 is sealed.

Question 6

Which TWO are core components of Vault's architecture?

Accepted Answer

Seal. Option A (Seal) is correct because the seal/unseal mechanism is a fundamental architectural component of Vault: Vault always starts in a sealed state, and the master key (protected by the unseal keys or auto-unseal KMS) must be used to decrypt the encryption key so Vault can read its data — this barrier is intrinsic to Vault's core design. Option B (Storage backend) is correct because Vault's architecture is built around a pluggable storage backend (e.g., Integrated Storage/Raft, Consul, File) that persists encrypted data; without a configured storage backend Vault cannot function, making it a core component. Option C (Audit device) is not a core architectural component but an optional, enable-able feature for logging requests and responses to destinations like file or syslog. Option D (Auth method) is a pluggable security feature (e.g., token, userpass, LDAP, AppRole) that authenticates clients but is not part of the base architecture. Option E (Replication) is an optional enterprise capability (performance/DR replication) for scaling and disaster recovery, not a core component.

Answer

Audit device

Answer

Auth method

Answer

Replication

Question 7

An organization needs to automatically issue X.509 certificates for internal services. Which secrets engine should they use?

Accepted Answer

PKI secrets engine. The PKI secrets engine is specifically designed to generate X.509 certificates for internal services. It acts as a certificate authority (CA), handling certificate signing requests (CSRs), issuing certificates with configurable lifetimes, and managing revocation via CRLs or OCSP. This directly meets the requirement for automated certificate issuance.

Answer

SSH secrets engine

Answer

Cert secrets engine

Answer

Transit secrets engine

Question 8

In a Vault HA cluster, which node is responsible for handling all write requests?

Accepted Answer

The active node only. In a Vault HA cluster, only the active node can handle write requests. This is because the active node holds the storage backend lock and is the only node that can modify the underlying data store. Standby nodes forward write requests to the active node, ensuring data consistency and preventing split-brain scenarios.

Answer

All nodes

Answer

Standby nodes

Answer

The node that receives the request

Question 9

A Vault operator runs 'vault secrets list' and sees 'cubbyhole/' mounted. What is the purpose of this engine?

Accepted Answer

Store secrets that are isolated per token. The cubbyhole secrets engine creates a private, ephemeral storage space that is scoped to a single Vault token. Secrets written to cubbyhole are only readable by the same token that wrote them and are automatically destroyed when the token expires or is revoked, making it ideal for token-specific secrets like a one-time password or a temporary key.

Answer

Store secrets encrypted by the Transit engine

Answer

Store secrets that are replicated across clusters

Answer

Store secrets with high availability

Question 10

A company requires that Vault data be continuously replicated from a primary data center to a secondary data center for disaster recovery. The secondary data center must be able to become writable in the event of a primary failure. Which Vault feature should they use?

Accepted Answer

Disaster Recovery Replication. Disaster Recovery (DR) Replication is the correct choice because it provides asynchronous replication of Vault data (including configuration, policies, and secrets) from a primary cluster to a secondary cluster. In the event of a primary failure, the secondary cluster can be promoted to become writable, ensuring business continuity. This feature is specifically designed for disaster recovery scenarios where the secondary site must be able to take over write operations.

Answer

Performance Replication

Answer

Consul as storage backend

Answer

Performance Standby

Question 11

A company has a Vault cluster and wants to allow applications running in Kubernetes pods to authenticate without storing static secrets. Which Vault authentication method is specifically designed for Kubernetes?

Accepted Answer

Kubernetes. The Kubernetes auth method is specifically designed for Kubernetes workloads. It allows pods to authenticate to Vault using their Kubernetes service account token, which Vault validates against the Kubernetes API server. This eliminates the need to store static secrets in the cluster.

Answer

AWS IAM

Answer

JWT/OIDC

Answer

AppRole

Question 12

Refer to the exhibit. Which authentication method is currently enabled for production applications?

Accepted Answer

AppRole. The exhibit shows that the production applications are configured with the 'AppRole' authentication method, which is indicated by the presence of a RoleID and SecretID in the application configuration. AppRole is a machine-oriented authentication method in HashiCorp Vault that allows applications to authenticate using a pair of credentials (RoleID and SecretID), making it suitable for automated, non-human workflows. The other methods listed (Token, LDAP, Userpass) are either human-centric or not configured for these applications.

Answer

Token

Answer

LDAP

Answer

Userpass

Question 13

A security team wants to store static secrets like API keys in Vault. They need the secrets to be versioned and support rollback. Which secrets engine should they use?

Accepted Answer

KV v2. KV v2 is the correct choice because it is designed specifically for storing static secrets with built-in versioning and rollback capabilities. Unlike KV v1, which overwrites data without preserving history, KV v2 retains a configurable number of secret versions, allowing administrators to undelete or roll back to a previous version using the `vault kv rollback` command or API calls.

Answer

Cubbyhole

Answer

KV v1

Answer

Transit

Question 14

A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?

Accepted Answer

The admin did not assign any policies to the user.. The most likely issue is that the admin created the user 'dev1' but did not assign any policies to that user. In Vault's Userpass auth method, simply creating a user does not attach any policies; the admin must explicitly specify the policies when creating or updating the user. Without a policy attached, the token issued upon login has no capabilities, resulting in a permission denied error even if the policy 'webapp-readonly' exists.

Answer

The policy 'webapp-readonly' does not exist.

Answer

The user 'dev1' does not exist.

Answer

The password is incorrect.

Question 15

Which TWO best practices should be followed when tuning secrets engine mounts?

Accepted Answer

Configure 'max_lease_ttl' to limit the maximum duration secrets can be valid. Option B is correct because configuring 'max_lease_ttl' on a secrets engine mount caps the absolute lifetime of any secret issued by that mount, preventing clients from renewing or holding credentials indefinitely and thereby limiting exposure if a secret leaks. Option C is correct because setting 'default_lease_ttl' to a low value appropriate for the engine ensures that, absent an explicit request, issued secrets expire quickly, which is a core Vault best practice for reducing the blast radius of compromised credentials. Option A is not a mount-tuning best practice in this context; audit logging is enabled at the audit device level and records requests globally rather than being a per-mount tuning parameter. Option D is incorrect because a high default lease TTL increases the window in which a leaked secret remains valid, contradicting the goal of tight lease lifetimes. Option E is incorrect because the 'default' policy is a global Vault policy attached to tokens, not something that is disabled per secrets engine mount.

Answer

Enable audit logging on the mount to track secret access

Answer

Set a high default lease TTL to reduce renewals

Answer

Disable the 'default' policy for the mount to restrict access