VA-003 Practice Test 20 — 15 Questions

Question 1

An organization uses Vault with AWS IAM auth. After rotating the AWS IAM role credentials, users are unable to authenticate with Vault. The Vault audit logs show 'permission denied' for the AWS auth method. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AWS secret engine is disabled. After rotating AWS IAM role credentials, the most likely cause of authentication failure is that the AWS secret engine was disabled during the rotation process. The 'permission denied' error in audit logs indicates the auth method is not enabled. While credential rotation itself does not directly cause engine disablement, it is possible that maintenance activities disabled it. Options A, B, and C are unrelated: trust policies do not contain credentials, token TTL and revocation affect client tokens, not the auth method.

Answer

The IAM role trust policy was not updated after credential rotation

Answer

The Vault token TTL expired

Answer

The client token used for AWS auth is revoked

Question 2

Refer to the exhibit. What operation was performed on the secret "mysecret"?

Accepted Answer

Read. The exhibit shows a Vault CLI command that retrieves the value of a secret at the path 'secret/mysecret'. The 'vault read' command is used to read data from Vault's key-value store, returning the stored value. Since the command 'vault read secret/mysecret' is executed, the operation performed is a Read, making option B correct.

Answer

Write

Answer

Delete

Answer

List

Question 3

A financial services company runs a mixed environment of on-premises and cloud workloads. They use Vault Enterprise with performance replication across two data centers: primary in us-east and secondary in eu-west. The secrets engine configuration includes KV v2 for static secrets, database engine for PostgreSQL credentials, and transit for encryption. Recently, the operations team noticed that after a network partition between the data centers, the secondary cluster stopped serving read requests for database credentials, although other secrets like KV v2 were still accessible. The team confirmed that the replication status shows 'secondary' and the cluster is healthy. The Vault configuration uses a single replication path filter that includes all mounts. What is the most likely reason for the database credentials not being available on the secondary?

Accepted Answer

Dynamic secrets are not replicated; the secondary cannot generate credentials if the primary is unreachable.. In Vault Enterprise, performance replication replicates static data (like KV v2 secrets) but does not replicate dynamic secrets such as database credentials. Dynamic secrets are generated on-demand by the primary cluster; the secondary cluster cannot generate them if the primary is unreachable because it lacks the ability to create new leases or credentials. This is why database credentials were unavailable on the secondary after the network partition, while static KV v2 secrets remained accessible.

Answer

The replication path filter excludes the database engine mount.

Answer

The secondary cluster has a network issue preventing it from connecting to the database.

Answer

The secondary cluster is configured to only serve static secrets.

Question 4

A DevOps engineer runs `vault token lookup s.abc123` and receives a permission denied error. The engineer has a valid token with the default policy attached. What is the most likely cause?

Accepted Answer

The default policy does not grant permission to look up other tokens. The default policy in Vault is intentionally restrictive and does not include the `token/lookup` capability for tokens other than the caller's own token. Since the engineer is attempting to look up a specific token ID (`s.abc123`) rather than their own token, the default policy denies this action. The permission denied error is expected because the default policy only allows basic operations like reading system capabilities and managing the caller's own token, not inspecting other tokens.

Answer

The token does not have an attached policy that allows 'token/lookup'

Answer

The token is expired or revoked

Answer

The engineer used the token accessor instead of the token ID

Question 5

A security team needs to create a token with a custom TTL of 1 hour and associate it with a policy named 'read-only'. Which Vault CLI command accomplishes this?

Accepted Answer

vault token create -policy=read-only -ttl=1h. Both `vault token create -policy=read-only -ttl=1h` and `vault token create -policy=read-only -ttl 1h` are valid Vault CLI commands that create a token with the specified policy and TTL. The CLI parser accepts both the equals sign and space syntax for string flags. Therefore, both options A and C accomplish the task.

Answer

vault write auth/token/create policies=read-only ttl=1h

Answer

vault create token -policy=read-only -ttl=1h

Question 6

Which TWO statements are true about Vault's encryption as a service using the transit engine?

Accepted Answer

Data encrypted with a key can be decrypted with a later version of the same key if the key is rotated. [CORRECT]. Options B and C are correct. Option B is correct because the transit engine retains old key versions after rotation, allowing decryption of data encrypted with previous versions. Option C is correct because the transit engine supports convergent encryption, which allows encrypting the same plaintext with the same key to produce the same ciphertext, enabling deduplication. Option A is incorrect because keys can be rotated. Option D is incorrect because Vault does not store plaintext data; it only performs encryption/decryption without storing data. Option E is incorrect because Vault does not allow clients to provide their own key material; keys are generated internally by Vault.

Answer

Encryption keys cannot be rotated once created. [wrong]

Answer

Vault stores the plaintext data for audit purposes. [wrong]

Answer

Clients can provide their own key material when creating a key. [CORRECT]

Question 7

A user wants to view information about their current token, including its policies and TTL. Which TWO CLI commands can be used?

Accepted Answer

vault read auth/token/lookup-self. `vault read auth/token/lookup-self` is a standard Vault CLI command that retrieves information about the current token, including its policies, Time-To-Live (TTL), and other metadata. This command uses the token lookup-self API endpoint, which is specifically designed for the calling token to inspect itself without needing explicit read permissions on its own token ID.

Answer

vault token list

Answer

vault write auth/token/lookup

Answer

vault token info

Question 8

A user receives this error when trying to read a secret. What is the most likely cause?

Accepted Answer

The token's policy does not grant read on that path. Vault uses a policy-based authorization model. When a token attempts to read a secret, Vault checks the token's associated policies to determine if the action is permitted on that specific path. If the policy does not include a `read` capability (or a broader capability like `sudo` or `update` that implies read) for the secret's path, Vault denies the request with a permission denied error, regardless of the token's validity or the secret engine's status.

Answer

The secret engine is not enabled

Answer

The token is a root token

Answer

The token has expired

Question 9

A token with the above policy attempts to look up its own token by calling the accessor endpoint. What will happen?

Accepted Answer

The operation fails with a permission denied error. The policy grants sudo on 'auth/token/lookup', but the endpoint for lookup by accessor is 'auth/token/lookup-accessor', which is a different path. Therefore, this policy does not allow that operation. Option A is wrong because the path is different. Option C is wrong because the policy does not have read or create on the correct path. Option D is wrong because the token has capabilities, just not on the required path.

Answer

The operation succeeds because the token can read its own token

Answer

The operation succeeds because sudo allows all accessor operations

Answer

The operation fails because the token lacks any capabilities

Question 10

Refer to the exhibit. A user attempts to renew the token after 20 hours. What will happen?

Accepted Answer

The token will be renewed for another 4h, after which it will expire.. The explicit max TTL is 24h. After 20h, the remaining time until max TTL is 4h. Renewal will set the token duration to the minimum of the requested TTL (12h) and the remaining max TTL (4h), resulting in a 4h TTL. After that, the token expires.

Answer

The renewal will fail because the token has exceeded its explicit max TTL.

Answer

The token will be renewed for another 12h and can be renewed indefinitely.

Answer

The token will be renewed for 12h, but the total lifetime cannot exceed 24h.

Question 11

What is the purpose of the Seal/Unseal process in Vault architecture?

Accepted Answer

To enable Vault to process requests. The Seal/Unseal process in Vault is a security mechanism that protects the encryption key used to encrypt data at rest. When Vault starts, it is in a sealed state and cannot process any requests until it is unsealed by providing a threshold number of unseal keys (shards). Unsealing decrypts the master key in memory, allowing Vault to access the storage backend and serve API requests. Option D is correct because the primary purpose is to enable Vault to process requests after a secure startup.

Answer

To delete old secrets

Answer

To rotate the encryption key

Answer

To back up the storage backend

Question 12

A user has the above policy attached. What operation can the user perform on 'secret/data/production/db_password'?

Accepted Answer

Read the secret. The policy grants 'read' capability on 'secret/data/production/db_password'. In Vault's KV Secrets Engine v2, the 'read' capability allows retrieving the secret data and its metadata. Therefore, the user can read the secret, which includes both the data and metadata. Option B is correct because the policy explicitly allows the read operation on that path.

Answer

Update the metadata of the secret

Answer

Delete the secret

Answer

Write a new version of the secret

Question 13

Which THREE steps are required to configure the database secrets engine for a MySQL database?

Accepted Answer

Enable the database secrets engine. Enabling the database secrets engine is the first required step because Vault secrets engines must be explicitly enabled at a mount path before they can be used. Without enabling the engine, no subsequent configuration (such as configuring connections or roles) is possible. This is done via the `vault secrets enable database` command or the equivalent API call.

Answer

Generate a root certificate for the database

Answer

Tune the mount to set default TTL for all roles

Question 14

Refer to the exhibit. A developer reports that a token they created using `vault token create -policy=my-policy -ttl=2h` is no longer working after 1 hour. The token lookup output shows the token details. What is the most likely cause?

Accepted Answer

The token's max_ttl was set to 1h when created, and the token reached its max_ttl.. The token was created with a `-ttl=2h` but the token lookup output shows `max_ttl=1h`. The `max_ttl` is an upper limit enforced by the token's configuration or the system's maximum TTL setting. Even though the requested TTL was 2 hours, the token's effective lifetime is capped by the lower of the two values, so it expired after 1 hour.

Answer

The token has num_uses set to 0, meaning it can only be used once.

Answer

The token is a service token and cannot be renewed.

Answer

The token is an orphan token and requires the parent token to be valid.

Question 15

A data analytics company needs to encrypt streaming data (e.g., clickstream events) before sending to a cloud data lake. Each event is about 1KB. They use Vault Transit to encrypt each event individually. The encryption rate is too slow for the volume (100,000 events/second). The team considers options to improve performance. Which approach is most effective for reducing the number of API calls to Vault while maintaining security?

Accepted Answer

Generate a local data encryption key (DEK) and encrypt it with Vault's Transit engine (KEK). Encrypt each event locally with the DEK, storing the encrypted DEK alongside the data.. It implements an envelope encryption pattern: a local Data Encryption Key (DEK) encrypts each event locally, avoiding an API call per event, while the DEK itself is encrypted by Vault's Transit engine (Key Encryption Key, KEK). This reduces the number of Vault API calls from 100,000 per second to a single call per DEK rotation, drastically improving throughput without exposing the DEK in plaintext.

Answer

Use a different secrets engine like Database or PKI.

Answer

Increase the number of Vault nodes and load balance requests.

Answer

Use Vault's batch encryption to send multiple events in one request.