VA-003 Practice Exam 3 — 20 Questions

Question 1

A user receives 'permission denied' when running 'vault write secret/data/myapp value=123'. The user's token has a policy that includes 'path "secret/data/*" { capabilities = ["read", "list"] }'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The path requires create or update capability.. The user's policy grants only 'read' and 'list' capabilities on the path 'secret/data/*'. The 'vault write' command requires either 'create' or 'update' capability (or both) on the path. Since the policy lacks these capabilities, Vault returns a 'permission denied' error, even though the token is valid and the secret engine is mounted.

Answer

The user is not authenticated.

Answer

The secret engine is not mounted.

Answer

The token is expired.

Question 2

The CLI command returns a 403 error. What is the most likely cause?

Accepted Answer

The token does not have a policy allowing read on 'database/creds/readonly'. A 403 Forbidden error from Vault indicates that the request was authenticated (the token is valid) but the token's policies do not grant permission for the requested action. Since the command attempts to read from 'database/creds/readonly', the most likely cause is that the token lacks a policy allowing read access on that path. This is a standard authorization failure, not an authentication or configuration issue.

Answer

The role 'readonly' does not exist

Answer

The database secrets engine is not mounted at 'database/'

Answer

The field 'value' does not exist in the secret

Question 3

A security team wants to ensure that tokens can be revoked immediately if a compromised token is detected, even if the token ID is unknown. Which token feature should they use?

Accepted Answer

Token accessors. Token accessors allow revocation of a token without knowing the token ID. They are specifically designed for this purpose.

Answer

Periodic tokens

Answer

Batch tokens

Answer

Orphan tokens

Question 4

Refer to the exhibit. What operation was performed on the secret "mysecret"?

Accepted Answer

Read. The exhibit shows a Vault CLI command that retrieves the value of a secret at the path 'secret/mysecret'. The 'vault read' command is used to read data from Vault's key-value store, returning the stored value. Since the command 'vault read secret/mysecret' is executed, the operation performed is a Read, making option B correct.

Answer

Write

Answer

Delete

Answer

List

Question 5

A team is migrating from a monolithic application to microservices. Each microservice needs to authenticate to Vault using its own AppRole. The security team wants to enforce that each AppRole can only read secrets from its own dedicated path (e.g., service-a can only read from 'services/service-a/*', service-b from 'services/service-b/*'). They have created the AppRoles and policies. However, during testing, they notice that service-a can read secrets from service-b's path. The administrator checks the policy for service-a and sees it has a 'capabilities' list on 'services/service-a/*' and also 'services/service-b/*' by mistake. They correct the policy, but the issue persists. What is the most likely reason that service-a still has access?

Accepted Answer

The token was issued before the policy was corrected and still carries the old policy version; it must be replaced or renewed to get the updated permissions. Vault tokens are immutable once issued; they carry a snapshot of the policies at the time of creation. Correcting the policy on the Vault server does not retroactively update existing tokens. Service-a's token was issued before the policy fix and still contains the old policy that granted access to 'services/service-b/*'. The token must be replaced (revoked and re-issued) or renewed to pick up the updated policy permissions.

Answer

The policy still contains an error that grants access to the wrong path

Answer

The policy update has not been applied to the Vault cluster yet

Answer

The service-a token has a second policy attached that grants access to service-b

Question 6

An administrator creates a service token with a TTL of 1 hour and a max TTL of 24 hours. The token is renewed once after 55 minutes. What happens to the token after 24 hours from creation?

Accepted Answer

The token expires and cannot be renewed. The token's TTL was set to 1 hour with a max TTL of 24 hours. After the first renewal at 55 minutes, the token's TTL resets to 1 hour, but the max TTL remains 24 hours from creation. Once 24 hours have passed from creation, the token reaches its max TTL and expires permanently; it cannot be renewed because the max TTL is a hard upper limit enforced by Vault's token lifecycle logic.

Answer

The token is revoked by the system

Answer

The token's TTL is automatically extended by 1 hour

Answer

The token becomes an orphan token

Question 7

A user wants to view information about their current token, including its policies and TTL. Which TWO CLI commands can be used?

Accepted Answer

vault read auth/token/lookup-self. Option A, `vault read auth/token/lookup-self`, is correct because it reads the `auth/token/lookup-self` endpoint, which returns details about the token used to make the request, including its policies, TTL, and other metadata. Option E, `vault token lookup`, is correct because it queries the same token lookup functionality through the CLI and, when run without a token argument, displays information about the current token such as policies and TTL. Option B, `vault token list`, is incorrect because it lists accessor values of tokens rather than showing details of the current token. Option C, `vault write auth/token/lookup`, is incorrect because the lookup endpoint is read-oriented and requires a token parameter; writing to it without a token does not return current-token information. Option D, `vault token info`, is incorrect because it is not a valid Vault CLI command.

Answer

vault token list

Answer

vault write auth/token/lookup

Answer

vault token info

Question 8

An organization has two Vault clusters in different geographic regions and wants to replicate secrets from the primary cluster to the secondary cluster for disaster recovery. Which Vault replication feature should they use?

Accepted Answer

Disaster Recovery (DR) replication. Disaster Recovery (DR) replication is the correct Vault feature for replicating secrets from a primary cluster to a secondary cluster in a different geographic region for disaster recovery. DR replication copies all data, including secrets, policies, and tokens, in a one-way direction from primary to secondary, ensuring the secondary cluster can be promoted if the primary fails. This is distinct from performance replication, which is designed for load distribution and allows writes on both sides.

Answer

Cluster replication

Answer

Active Directory replication

Answer

Performance replication

Question 9

A financial services company runs a microservices application on Kubernetes. Each service needs to authenticate to Vault using Kubernetes auth and then read secrets from a shared KV v2 engine mounted at 'shared-kv'. The security team requires that Service-A can only read secrets under 'shared-kv/team-alpha/*' and Service-B can only read secrets under 'shared-kv/team-beta/*'. The Vault administrator has already configured the Kubernetes auth method and created roles for each service with bound service account names. However, both services are currently able to read all paths under 'shared-kv/'. The administrator wants to enforce the least privilege access. Which course of action should the administrator take?

Accepted Answer

Review and update the policy attached to the Kubernetes auth roles to restrict capabilities to the specific paths, e.g., 'path "shared-kv/data/team-alpha/*" { capabilities = ["read"] }'.. The issue is that the policy attached to the Kubernetes auth roles grants read access to the entire 'shared-kv/*' path. By updating the policy to restrict capabilities to specific paths like 'shared-kv/data/team-alpha/*' and 'shared-kv/data/team-beta/*', the administrator enforces least privilege. The 'data' prefix is required for KV v2 engines to access secret data, and the wildcard ensures only the respective team's secrets are readable.

Answer

Configure the Kubernetes auth role to use 'token_policies' with a restrictive policy and ensure the bound service account names are correct.

Answer

Create a new secrets engine for each team and mount them at 'team-alpha' and 'team-beta', then assign each service to its respective engine.

Answer

Add a 'path_deny' capability in the policy for the disallowed paths.

Question 10

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Option E is correct because Vault's transit secrets engine supports key rotation via the `rotate` endpoint (e.g., `vault write -f transit/keys//rotate`), which creates a new key version while retaining older versions for decrypting existing ciphertext. Option C is correct because after rotation, existing ciphertext still references older key versions, so `rewrap` (e.g., `vault write transit/rewrap/ ciphertext=<...>`) re-encrypts the data under the latest key version without exposing the plaintext, satisfying periodic rotation compliance. Option A is wrong because immediately setting `min_decryption_version` to the newest version would make ciphertext encrypted with older versions undecryptable, breaking access to existing data. Option B is wrong because exporting the key defeats the purpose of Vault transit (keys never leave Vault) and manual re-encryption is unnecessary since `rewrap` handles it. Option D is wrong because deleting old key versions would render existing ciphertext undecryptable and is not required for rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 11

Which authentication method in Vault uses a shared secret (Role ID) and a dynamic secret (Secret ID) to authenticate machines or applications?

Accepted Answer

AppRole. AppRole is the correct authentication method because it is specifically designed for machine-to-machine or application-to-application authentication in Vault. It uses a static Role ID (like a username) combined with a dynamically generated Secret ID (like a password) that can be created, revoked, or have a time-to-live, providing a secure and flexible way for non-human entities to obtain a Vault token.

Answer

LDAP

Answer

Username & password (userpass)

Answer

Okta

Question 12

A large enterprise runs Vault in a high-availability cluster with integrated storage (Raft). They notice that read requests are not being evenly distributed across nodes, causing some nodes to have high load. They want to offload read operations to standby nodes. What feature should they enable to achieve this?

Accepted Answer

Enable performance standby nodes. Performance standby nodes are a Vault Enterprise feature designed to handle read requests without participating in the Raft consensus write quorum. By enabling this, read operations are offloaded to standby nodes, distributing the load evenly and reducing the burden on the active cluster nodes. This directly addresses the uneven read distribution and high load on specific nodes.

Answer

Configure a load balancer with a round-robin algorithm

Answer

Enable read replicas on standby nodes

Answer

Increase the number of Raft nodes to distribute reads

Question 13

A DevOps team needs to provide temporary database credentials to applications without storing long-lived passwords. Which secrets engine should they use?

Accepted Answer

Database secrets engine. The Database secrets engine is designed to generate dynamic, short-lived database credentials on demand, allowing applications to access databases without storing long-lived passwords. It creates unique credentials for each request and automatically revokes them after a configurable TTL, meeting the requirement for temporary access without persistent secrets.

Answer

KV v2 secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 14

A security engineer is enabling the Transit secrets engine at the path 'transit/'. They need to encrypt data without ever exposing the plaintext key material to the application, and they want the ciphertext to be safely stored in an external database. They also require the ability to rotate the encryption key periodically without re-encrypting existing data. Which command correctly configures a new encryption key named 'orders' for this purpose?

Accepted Answer

vault write -f transit/keys/orders. The Transit secrets engine centralizes encryption as a service, allowing applications to encrypt data without managing keys. To create a new named encryption key, the correct command is 'vault write -f transit/keys/orders', which generates a key of the default type (aes256-gcm96) and enables encryption, decryption, and rotation. This satisfies the requirement of not exposing key material and supporting future rotation.

Answer

vault write transit/encrypt/orders plaintext=$(base64 <<< "my secret")

Answer

vault write transit/keys/orders type=rsa-2048

Answer

vault secrets enable -path=orders transit

Question 15

A startup wants to use Vault to manage MySQL database credentials for their development environment. They have a single MySQL database and require that each application gets unique, short-lived credentials that are automatically rotated. The operations team enabled the database secrets engine, configured the MySQL connection, and created a role with a TTL of 1 hour. However, when an application requests credentials using the role, Vault returns an error: 'No more available leases on this role'. The team checks the role's configuration and sees that the 'max_ttl' is set to 1 hour and 'default_ttl' is also 1 hour. What is the most likely cause of this error?

Accepted Answer

The role has a 'max_leases' parameter set to a low value (e.g., 5) that has been exceeded. Increase the 'max_leases' on the role.. The error 'No more available leases on this role' indicates that the role has a finite number of leases it can issue, controlled by the 'max_leases' parameter. When this limit is reached, Vault refuses to issue new credentials until existing leases expire or are revoked. The role's TTL and max_ttl being both 1 hour does not cause this error; rather, the exhaustion of the lease count does.

Answer

The database secrets engine is not enabled at the expected path; the role is pointing to a different engine.

Answer

The application is not using a valid token to authenticate to Vault, so the request is rejected.

Answer

The TTL values are too short; applications are requesting new credentials too frequently and exhausting a hidden limit. Increase the TTL.

Question 16

An organization wants to use Vault to generate AWS IAM users with specific managed policies attached. They have configured the AWS secrets engine with the appropriate IAM credentials. What step is required to ensure each generated user gets the correct policies?

Accepted Answer

Configure a role in the AWS secrets engine that specifies the managed policies. The AWS secrets engine in Vault uses roles to define the exact permissions and policies for generated IAM users. By configuring a role that specifies the managed policies, Vault ensures that each dynamically generated IAM user is created with those policies attached, meeting the organization's requirement.

Answer

Enable the AWS secrets engine at a custom path

Answer

Set a high TTL on the AWS secrets engine mount

Answer

Use the transit secrets engine to encrypt the AWS credentials

Question 17

A DevOps team wants to authenticate a CI/CD pipeline running on a Jenkins server outside Kubernetes. The pipeline needs to obtain short-lived tokens to read secrets. Which authentication method should be used?

Accepted Answer

AppRole auth. AppRole auth is designed for machine-to-machine authentication, allowing Jenkins (outside Kubernetes) to obtain short-lived tokens by providing a RoleID and SecretID. This method supports automated workflows without human intervention, making it ideal for CI/CD pipelines that need to read secrets from Vault.

Answer

LDAP auth

Answer

Kubernetes auth

Answer

GitHub auth

Question 18

Which TWO are benefits of using Vault's encryption as a service?

Accepted Answer

Allows applications to delegate encryption/decryption to Vault without handling keys. Option B is correct because Vault's Encryption as a Service (via the transit secrets engine) lets applications send plaintext to Vault's encrypt/decrypt endpoints and receive ciphertext or plaintext back, so the app never stores or manages the cryptographic keys itself. Option C is correct because the transit engine natively supports automatic key rotation and key versioning, allowing old ciphertext to remain decryptable while new data uses the latest key version. Option A is not a benefit specific to Encryption as a Service, since encrypting data at rest in cloud storage is typically handled by storage-level or disk encryption rather than Vault's transit engine. Option D is wrong because applications must have network connectivity to reach Vault's API for encryption and decryption operations. Option E is wrong because the transit engine supports both symmetric algorithms (such as AES-GCM) and asymmetric algorithms (such as RSA and ECDSA).

Answer

Enables encryption of data at rest in cloud storage

Answer

Eliminates the need for any network connectivity to Vault

Answer

Supports only symmetric key algorithms

Question 19

Refer to the exhibit. A user with this policy attempts to read 'secret/data/team/admin'. What will happen?

Accepted Answer

Read fails because deny overrides the broader path.. Vault's policy evaluation uses a deny-by-default model where explicit deny rules override any allow rules. The policy first allows read on 'secret/data/team/*' but then explicitly denies read on 'secret/data/team/admin'. Since the deny rule is more specific and matches the exact path, it takes precedence, causing the read operation to fail.

Answer

Read succeeds because the first path allows read.

Answer

Read fails because the path does not exist.

Answer

Read succeeds if the user also has sudo capability.

Question 20

Which TWO of the following are valid use cases for the Transit secrets engine? (Select exactly 2.)

Accepted Answer

Signing and verifying data. Option A is correct because the Transit secrets engine provides cryptographic operations as a service, including signing and verifying data via endpoints such as /transit/sign/:name and /transit/verify/:name, so applications can perform signature operations without handling raw signing keys. Option B is correct because Transit supports encryption and decryption through endpoints like /transit/encrypt/:name and /transit/decrypt/:name, allowing data to be encrypted in transit while the encryption key never leaves Vault. Option C is not the intended use case because Transit does not serve as a general-purpose key store; key storage is handled by other engines such as KV or by Vault's key management features, and Transit keys are used for cryptographic operations rather than being retrieved. Option D is incorrect because Transit does not store encrypted data at rest; it only performs encryption/decryption operations, while data storage belongs to engines like KV. Option E is incorrect because X.509 certificate management is handled by the PKI secrets engine, not the Transit secrets engine.

Answer

Storing encryption keys

Answer

Storing encrypted data at rest

Answer

Managing X.509 certificates