VA-003 Practice Exam 2 — 20 Questions

Question 1

An organization uses Kubernetes pods to access Vault. They want to avoid hardcoding any secrets in the pod definition. Which authentication method should they use?

Accepted Answer

Kubernetes. The Kubernetes authentication method is correct because it allows pods to authenticate to Vault using their service account token, which is automatically mounted into the pod. This eliminates the need to hardcode any secrets in the pod definition, as Vault verifies the token against the Kubernetes API server and issues a temporary Vault token based on the pod's identity.

Answer

LDAP

Answer

Username & Password

Answer

AppRole

Question 2

A company is using Vault's PKI secrets engine to issue certificates for internal services. They have set up a root CA and an intermediate CA. The intermediate CA's certificate expires soon, and they need to renew it. They generate a new intermediate CSR and have it signed by the root CA. After importing the new intermediate certificate, the team notices that certificates issued by the old intermediate are still valid but new certificate requests fail with 'no valid intermediate CA found'. What step did the team likely miss?

Accepted Answer

They forgot to set the new intermediate certificate as the issuing CA by writing it to the correct path (e.g., pki/intermediate/set-signed).. In Vault's PKI secrets engine, after the root CA signs a new intermediate certificate, the signed certificate must be explicitly set as the issuing CA by writing it to the `pki/intermediate/set-signed` endpoint. Without this step, Vault still references the old (expiring) intermediate certificate and cannot sign new ones, resulting in the 'no valid intermediate CA found' error. Simply importing the signed certificate is not sufficient; it must be configured as the active issuing CA. Option B is incorrect because failing to update CRL distribution points would affect CRL distribution, not cause a 'no valid intermediate CA found' error during certificate issuance.

Answer

They forgot to update the CRL distribution points on the new intermediate.

Answer

They changed the root CA's key algorithm, causing incompatibility.

Answer

They did not revoke the old intermediate CA before importing the new one.

Question 3

A user runs 'vault write secret/mydata value=hello' and gets a warning about missing metadata. They intended to store a simple key-value pair. What is the most likely issue?

Accepted Answer

The path is under KV v2 engine, which requires the data/ prefix.. The warning about missing metadata indicates the path is under a KV v2 secret engine, which requires the `data/` prefix before the path (e.g., `vault write secret/data/mydata value=hello`). KV v2 stores metadata and versioned data separately, so writing directly to `secret/mydata` triggers a warning because it expects the `data/` subpath. This is the most likely issue given the user's intent to store a simple key-value pair.

Answer

The value must be JSON-encoded.

Answer

The token lacks write capability on that path.

Answer

The secret engine is not enabled.

Question 4

Which TWO of the following are valid capabilities that can be specified in a Vault policy?

Accepted Answer

create. In Vault policies, capabilities define the allowed actions on paths. The `create` capability permits creating new data at a path without needing to read existing data, which is distinct from `update` that allows modifying existing data. Both `create` and `update` are valid, separate capabilities in Vault's policy system.

Answer

write

Answer

sudo

Answer

rename

Question 5

A developer wants to authenticate to Vault using a username and password without any external identity provider. Which authentication method should be enabled?

Accepted Answer

Userpass authentication. The userpass authentication method is designed for Vault to authenticate users directly with a username and password, without relying on any external identity provider. It stores the credentials within Vault's own backend, making it the correct choice for a standalone authentication scenario where no external system like LDAP or an OIDC provider is involved.

Answer

Token authentication

Answer

LDAP authentication

Answer

AppRole authentication

Question 6

A company needs to automatically generate short-lived database credentials for developers. Which secrets engine should they use?

Accepted Answer

Database. The Database secrets engine is specifically designed to generate short-lived, dynamic database credentials on demand. It connects to a database and creates unique user accounts with configurable time-to-live (TTL) values, which are automatically revoked when the lease expires. This directly meets the requirement for automatically generating temporary database credentials for developers.

Answer

KV v2

Answer

AWS

Answer

Cubbyhole

Question 7

The token was created 12 hours ago and has not been used yet. What will happen if the token is not used or renewed?

Accepted Answer

It will expire in 12 hours. Vault tokens have a configurable Time-To-Live (TTL) and a maximum TTL. If a token is not used within its TTL, it will expire. Since the token was created 12 hours ago and has not been used, and the default TTL for many token types in Vault is 24 hours, the token will expire in 12 hours (the remaining TTL). This is because the token's TTL begins counting down from creation, not from first use.

Answer

It can be renewed indefinitely if used

Answer

It will expire when the number of uses reaches 0

Answer

It will expire immediately because it was not used within 12 hours

Question 8

A Vault policy includes the following statement: path "secret/data/+/app" { capabilities = ["read"] }. Which paths would match this policy? (Assume KV v2)

Accepted Answer

secret/data/team-a/app. In Vault KV v2, the path structure is `secret/data/<path>`, and the `+` glob matches a single path segment. The policy `secret/data/+/app` matches exactly one segment between `data/` and `/app`. Option D, `secret/data/team-a/app`, has a single segment `team-a` before `app`, so it matches. Options with additional segments (A, B) or missing the required segment (C) do not match.

Answer

secret/data/team-a/app/db

Answer

secret/data/team-a/team-b/app

Answer

secret/data/app

Question 9

A Vault cluster has a performance secondary cluster replicating from a primary. An administrator needs to generate a one-time password (OTP) for an SSH target. They are on the secondary cluster. They run `vault write ssh/otp/otp_role ip=10.0.0.1 username=admin`. What is the expected behavior?

Accepted Answer

The request succeeds because the SSH secret engine is a local mount that exists on the secondary. The SSH secret engine is a local mount, meaning it is not replicated from the primary to the performance secondary cluster. Local mounts exist independently on each cluster, so the secondary can write data to its own local SSH engine. The `vault write ssh/otp/otp_role` command is syntactically correct and will succeed on the secondary as long as the role and engine are configured locally.

Answer

The request fails because the CLI command syntax is wrong

Answer

The request fails because secondary clusters cannot write any data

Answer

The request fails because the SSH secret engine must be replicated to the secondary

Question 10

Which TWO statements about batch tokens are true?

Accepted Answer

They are lightweight and support a high creation rate.. Batch tokens are designed to be lightweight and support a high creation rate, ideal for ephemeral workloads. Option B is correct because batch tokens cannot be used with a use-limit; use-limits are only supported by service tokens. Options C, D, and E are incorrect: batch tokens do not support explicit max TTL (C), they do not have a TTL as they derive their lifetime from the parent token (D), and they are not renewable (E).

Answer

They support explicit max TTL.

Answer

They have a TTL.

Answer

They are renewable.

Question 11

An administrator creates a token role with 'allowed_policies' and tries to create a child token. What does this error indicate?

Accepted Answer

The token role's token_count_limit has been reached. The error 'token count per user (3) exceeded' indicates that the number of tokens issued for that entity (user or role) has exceeded the maximum allowed, which is controlled by the 'token_count_limit' parameter in the token role. Option D correctly identifies this limit as the cause. Option A is irrelevant because revocation count is not involved. Option B is incorrect because the error is about token count, not TTL. Option C is incorrect because the error is about quantity, not policy permissions.

Answer

The token has been revoked too many times

Answer

The token's TTL is too short

Answer

The token's policy is not allowed by the role

Question 12

A development team needs tokens that can be renewed automatically as long as they are still in use, up to a maximum lifetime of 72 hours. Which token type and configuration should be used?

Accepted Answer

Service token with a TTL of 1h and max TTL of 72h. A service token with a TTL of 1 hour and a max TTL of 72 hours allows automatic renewal as long as the token is still in use, up to the maximum lifetime of 72 hours. This configuration ensures that the token's TTL is extended on each use, preventing expiration during active sessions while enforcing an absolute upper limit.

Answer

Periodic token with a TTL of 72h

Answer

Orphan token with a TTL of 1h

Answer

Batch token with a TTL of 72h

Question 13

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Accepted Answer

vault write shared/data/db_password value=s3cret. In Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Answer

vault write shared/db_password value=s3cret

Answer

vault write shared/metadata/db_password value=s3cret

Answer

vault write shared/config/db_password value=s3cret

Question 14

A Vault administrator notices that the audit log file on the Vault server is filling up the disk. What is the best course of action to prevent disk full issues?

Accepted Answer

Configure the file audit device with log rotation.. Configuring log rotation on the file audit device allows the Vault server to automatically archive or delete old audit logs based on size or time thresholds, preventing the disk from filling up while retaining necessary audit data. This is the recommended approach in Vault for managing disk space without disabling security auditing or relying on external infrastructure changes.

Answer

Disable audit logging to reduce disk usage.

Answer

Switch to a syslog audit device.

Answer

Increase the disk size of the Vault server.

Question 15

A team wants to store static secrets like database passwords and rotate them periodically. Which secrets engine should they enable?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is designed for static secrets like database passwords, offering versioning, configurable deletion, and periodic rotation via lease management or external automation. It stores secrets as key-value pairs with metadata, making it ideal for static credentials that need controlled lifecycle management.

Answer

AWS secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 16

A company uses HashiCorp Vault in production to manage secrets for its microservices. One microservice, 'order-svc', authenticates via AppRole and receives a service token with a TTL of 24 hours and a max TTL of 48 hours. Over the past few days, operations teams report that 'order-svc' fails to renew its token after approximately 23 hours, causing authentication failures. The token lookup shows the token is still alive with about 1 hour of TTL remaining, but renewal attempts return a 'permission denied' error. The Vault audit logs show the renewal request is reaching Vault and being denied. The token's policies include 'path "auth/token/renew-self" { capabilities = ["update"] }'. The token was created with the default options. What is the most likely cause of this failure?

Accepted Answer

The token has already been renewed up to its max TTL, so further renewal would exceed the max. The token's max TTL of 48 hours has been reached after repeated renewals. Each renewal extends the token's TTL up to the max TTL, and once that limit is hit, further renewal attempts are denied with a 'permission denied' error, even if the current TTL still shows remaining time. The token lookup showing 1 hour of TTL left indicates the token is still valid, but the renewal is blocked because it would exceed the configured max TTL.

Answer

The token's parent token has been revoked, making it an orphan

Answer

The token is a batch token and cannot be renewed

Answer

The token's num_uses has reached zero

Question 17

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Vault's `vault rewrap` command re-encrypts existing ciphertext with the latest key version without decrypting the underlying plaintext, preserving the data's confidentiality. This is essential after a key rotation to ensure all ciphertext uses the new key, meeting compliance requirements for periodic key rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 18

A DevOps team uses Vault to manage secrets for a microservices application. The application authenticates to Vault using AppRole, and each service obtains a periodic token with a TTL of 24 hours and a period of 1 hour. The tokens are used to read secrets from a path. Recently, the team noticed that some services are unable to read secrets after a few hours, with error messages indicating that the token is not authorized or has expired. Upon investigation, the team finds that the tokens are being renewed properly but still fail after some time. What is the most likely cause of this issue?

Accepted Answer

The tokens have a shorter max TTL than the period, causing them to expire before they can be renewed.. The tokens have a period of 1 hour and a TTL of 24 hours, but the max TTL (maximum allowed lifetime) for the token or the role is likely set to a value shorter than the period. In Vault, the period controls how often the token must be renewed, while the max TTL is the absolute upper limit on the token's lifetime. If the max TTL is less than the period (e.g., 30 minutes), the token will expire before the next renewal attempt, even if renewal logic is correct.

Answer

The Vault server's maximum number of tokens per client has been exceeded.

Answer

The tokens are not being renewed correctly due to a bug in the renewal logic.

Answer

The AppRole secret ID is being revoked, causing tokens to become invalid.

Question 19

A Vault administrator wants to ensure that all secrets are encrypted at rest and in transit. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable TLS on all Vault listener configurations.. Enabling TLS on all Vault listener configurations ensures that data is encrypted in transit between clients and the Vault server, protecting against eavesdropping and man-in-the-middle attacks. Option C is correct because using a seal that provides envelope encryption (e.g., Auto Unseal with a cloud KMS) encrypts the master key and storage backend data, ensuring secrets are encrypted at rest. Together, these two configurations satisfy the requirement for encryption both in transit (TLS) and at rest (seal envelope encryption).

Answer

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Answer

Set the `encrypt` parameter on the audit device configuration.

Answer

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Question 20

A user receives an error 'invalid ciphertext' when trying to decrypt data. The ciphertext was created by another Vault instance. What is the most likely issue?

Accepted Answer

The ciphertext includes key version info that doesn't match. Vault's transit secrets engine appends key version information to the ciphertext by default. When decrypting, Vault checks that the key version embedded in the ciphertext matches a version of the key that exists in the destination Vault instance. If the ciphertext was created by a different Vault instance with a different key version history, the version embedded in the ciphertext will not correspond to any known key version, causing the 'invalid ciphertext' error.

Answer

Different key names

Answer

The Vault instance is sealed

Answer

Different key types

Answer

The user lacks permissions to decrypt