VA-003 Practice Exam 3 — 20 Questions

Question 1

A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?

Accepted Answer

The renewable flag requires the role to be updated after existing leases are issued.. When a role's configuration is changed, existing leases are not updated. Users who obtained leases before the renewable flag was set to false would still have leases with renewable=true. Option C correctly identifies that the role was likely updated after some leases were issued. Option A is incorrect because the renewable flag is respected. Option B is incorrect; the lease's renewable property is independent of the token's. Option D is false; renewable applies to secret engine leases as well.

Answer

The renewable flag is not respected when max_ttl equals default_ttl.

Answer

The renewable flag is only applicable to token auth methods, not secrets engines.

Answer

The lease's renewable property is controlled by the client token's renewable status.

Question 2

After a Vault migration, some leases are no longer valid and cause errors. What is the best way to force a cleanup of all leases under a specific mount without affecting other mounts?

Accepted Answer

Use vault lease revoke -prefix . Using 'vault lease revoke -prefix ' revokes all leases under that prefix, effectively cleaning them up without disabling the engine.

Answer

Restart Vault servers

Answer

Disable and re-enable the secret engine

Answer

Reduce the mount's max_lease_ttl to 0

Question 3

A Vault administrator wants to configure a role for dynamic secrets with a default TTL of 1 hour and a max TTL of 4 hours. They also want to allow renewal but only up to the max TTL. Which configuration achieves this?

Accepted Answer

default_ttl=1h, max_ttl=4h, renewable=true. Setting default_ttl=1h, max_ttl=4h, and renewable=true allows the lease to be renewed up to a total lifespan of 4 hours, with initial TTL of 1 hour. Option B is correct. Option A has renewable=false, preventing renewal. Option C has max_ttl less than default, which is invalid. Option D adds an unnecessary ttl parameter.

Answer

default_ttl=1h, max_ttl=4h, renewable=false

Answer

default_ttl=4h, max_ttl=1h, renewable=true

Answer

default_ttl=1h, max_ttl=4h, renewable=true, ttl=1h

Question 4

Which two commands can be used to manually revoke leases? (Choose two.)

Accepted Answer

vault lease revoke . Both 'vault lease revoke ' and 'vault lease revoke -prefix ' are valid commands for manually revoking leases. Other options either renew, disable the entire mount, or revoke tokens.

Answer

vault secrets disable <path>

Answer

vault token revoke <token>

Answer

vault lease renew <lease_id>

Question 5

An admin needs to check the remaining lifespan of a lease. Which command should they use?

Accepted Answer

vault lease lookup <lease_id>. The `vault lease lookup` command displays lease details including remaining TTL. Option D is correct. Option A reads from sys/leases/lookup but that path is for listing leases, not a single lease. Option B lists leases, not checks a specific lease. Option C with -increment=0 would attempt a renewal, not a lookup.

Answer

vault read sys/leases/lookup/<lease_id>

Answer

vault lease list <lease_id>

Answer

vault lease renew -increment=0 <lease_id>

Question 6

An admin wants to revoke all leases associated with a specific AWS IAM user created by Vault. Which command should they use?

Accepted Answer

vault lease revoke -prefix aws/creds/myrole. The `vault lease revoke -prefix` command revokes all leases with a given prefix. The prefix for AWS IAM users created by a role is typically 'aws/creds/role-name'. Option C correctly uses the -prefix flag. Option A revokes only that exact path if it were a lease ID. Option B has no -prefix. Option D has an incorrect syntax.

Answer

vault lease revoke aws/creds/myrole/ -prefix

Answer

vault lease revoke aws/creds/myrole

Answer

vault lease revoke -path aws/creds/myrole

Question 7

An admin needs to revoke all leases associated with a particular policy violation. Which two methods can be used? (Choose two.)

Accepted Answer

vault write sys/leases/revoke-prefix . Both `vault lease revoke -prefix ` and `vault write sys/leases/revoke-prefix ` will revoke all leases with the given prefix, which can target the mount or role involved in the policy violation. Option A revokes a specific lease only. Option B revokes a token and its leases, but not specifically by policy prefix. Option E has an incorrect path.

Answer

vault sys/leases/revoke-force <prefix>

Answer

vault token revoke -mode=orphan <token>

Answer

vault lease revoke <lease_id>

Question 8

An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?

Accepted Answer

Vault's tidy operation is not configured to clean up stale leases.. Vault does not automatically revoke the actual database user when a lease expires; it relies on the tidy operation to clean up stale leases and revoke the underlying credentials. If tidy is not run or configured, expired leases can leave behind database users. Option B is correct. Option A: high max_ttl would lengthen lifespan but still eventually expire. Option C: rotation statement affects password changes, not revocation. Option D: network issues could cause revocation failures, but tidy would still help clean up.

Answer

The lease revocation process is failing due to network issues.

Answer

The database rotation statement is incorrect, causing Vault to not properly revoke credentials.

Answer

The role's max_ttl is set too high, allowing leases to live longer.

Question 9

Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)

Accepted Answer

The system's max_lease_ttl configuration. The lease's actual TTL is influenced by the role's default_ttl (initial TTL), the role's max_ttl (maximum allowed total TTL), and the system's max_lease_ttl configuration (global cap). The requesting token's TTL does not directly impact lease TTL. The rotation period is for password rotation, not lease duration.

Answer

The requesting token's TTL

Answer

The backend's rotation period

Question 10

Based on the exhibit, what is the maximum total lifespan of this lease?

Accepted Answer

1 hour. The max_ttl field shows 1h, which is the maximum total time the lease can exist from its issue time, including all renewals. The current ttl of 30m is the remaining time if not renewed, but the lease can be renewed up to the max_ttl of 1 hour. Option B is correct.

Answer

2 hours

Answer

90 minutes

Answer

30 minutes

Question 11

A developer requests a credential from this role. Which statement about the resulting lease is true?

Accepted Answer

The lease will have a TTL of 1 hour and cannot be renewed.. The role has default_ttl=1h and renewable=false, so the lease will have an initial TTL of 1 hour and cannot be renewed. The max_ttl of 24h is irrelevant because renewal is disabled. Option C is correct.

Answer

The lease will have a TTL of 24 hours and can be renewed.

Answer

The lease will have a TTL of 1 hour and can be renewed.

Answer

The lease will have a TTL of 24 hours and cannot be renewed.

Question 12

A Vault user wants to check the capabilities of their token on a specific path. Which command should they use?

Accepted Answer

vault token capabilities <path>. The `vault token capabilities` command is specifically designed to check what operations (e.g., read, create, update, delete, list) a given token is allowed to perform on a particular path. It evaluates the token's attached policies against the path and returns the effective capabilities, making it the correct tool for this task.

Answer

vault token list

Answer

vault policy capabilities

Answer

vault token lookup <token>

Question 13

Which TWO of the following are valid token states?

Accepted Answer

Revoked. Option D is correct because 'Revoked' is a standard token state defined in the OAuth 2.0 framework (RFC 7009) and implemented in Vault's token lifecycle. When a token is explicitly revoked via the `/sys/leases/revoke` endpoint or through a lease revocation, it transitions to the revoked state and can no longer be used for authentication or authorization.

Answer

Expired

Answer

Orphan

Answer

Suspended

Question 14

A security analyst discovers that a token used by a legacy application is still active long after the application was decommissioned. Which Vault feature should have been used to automatically expire tokens when the application is no longer running?

Accepted Answer

Set a TTL on the token. Option C is correct because setting a Time-To-Live (TTL) on the token ensures it automatically expires after a specified duration, even if the application is decommissioned. This prevents orphaned tokens from remaining active indefinitely, which is a security risk. Vault's TTL mechanism is designed to enforce token lifetime limits without requiring manual intervention.

Answer

Enable token renewal to keep it alive

Answer

Use a periodic token and revoke it manually

Answer

Use a batch token to limit its lifetime

Question 15

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Accepted Answer

24h. The correct answer is C (24h) because when a certificate request is made, Vault applies the most restrictive TTL among the role's configured `ttl`, the mount's default lease TTL, and the requested TTL. Here, the role's `ttl` of 24h is the shortest, so it overrides both the requested 48h and the mount default of 72h, resulting in a certificate with a 24-hour validity.

Answer

The request will be rejected because the requested TTL exceeds the role's ttl.

Answer

48h

Answer

72h

Question 16

A developer created a token and wants to ensure that the token can only be used to read secrets from the 'secret/data/production' path. Which policy attachment approach should be used?

Accepted Answer

Create a policy with read capability on 'secret/data/production' and attach it to the token. Option C is correct because Vault uses policies to define fine-grained access control, and the only way to restrict a token to read secrets from a specific path is to create a policy with the appropriate capabilities (e.g., 'read' on 'secret/data/production') and attach that policy to the token at creation time. Tokens themselves do not inherently carry path restrictions; they inherit permissions solely from attached policies.

Answer

Set the token's metadata to restrict access

Answer

Use a root token and restrict its use via a policy

Answer

Set the token type to service and it will automatically restrict access

Question 17

Which TWO of the following are valid methods to revoke a Vault token?

Accepted Answer

vault token revoke . Option A is correct because `vault token revoke ` is the direct command to revoke a specific Vault token by its token value. This invalidates the token immediately, preventing any further use. Option D is correct because `vault token revoke -accessor ` revokes a token using its accessor, which is a non-sensitive identifier that can be used to manage tokens without exposing the token itself.

Answer

vault secrets disable <path>

Answer

vault auth disable <path>

Answer

vault policy delete <name>

Question 18

A DevOps team needs to create a Vault policy that allows reading secrets from path "secret/data/app" but only for the key "db_password". They want to enforce this using Vault's policy syntax. Which policy statement achieves this?

Accepted Answer

path "secret/data/app" { capabilities = ["read"]; allowed_parameters = {"db_password"=[]} }. Option C is correct because it uses allowed_parameters to restrict to the key "db_password". Option A allows reading all keys. Option B uses an incorrect path for key-level restriction. Option D requires the parameter but does not restrict to only that key.

Answer

path "secret/data/app" { capabilities = ["read"] }

Answer

path "secret/data/app/db_password" { capabilities = ["read"] }

Answer

path "secret/data/app" { capabilities = ["read"]; required_parameters = ["db_password"] }

Question 19

An administrator wants to create a policy that grants the ability to list all authentication methods enabled on the Vault server. Which path and capability are required?

Accepted Answer

path "sys/auth" { capabilities = ["list"] }. Option B is correct. The path 'sys/auth' with 'list' capability lists all auth methods. Option A with 'read' would give details but not list. Option C includes both, which is overkill. Option D uses a wildcard that may also list unrelated items.

Answer

path "sys/auth" { capabilities = ["read", "list"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Answer

path "auth/*" { capabilities = ["list"] }

Question 20

A security administrator wants to create a policy that allows a service to renew its own token and list its own token capabilities, but not create new tokens. Which policy statements should be included?

Accepted Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["read"] }. Option B is correct because it uses the correct endpoints and capabilities: update for renew-self and read for capabilities-self. Option A uses update for capabilities-self, which is wrong. Option C uses create for renew-self, which is incorrect. Option D uses non-self endpoints giving broader privileges.

Answer

path "auth/token/renew-self" { capabilities = ["create"] }; path "auth/token/lookup-self" { capabilities = ["read"] }

Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["update"] }

Answer

path "auth/token/renew" { capabilities = ["update"] }; path "auth/token/capabilities" { capabilities = ["read"] }