VA-003 Practice Test 21 — 15 Questions

Question 1

Match each Vault secret engine to its primary purpose.

Accepted Answer

KV: Stores arbitrary secrets as key-value pairs.. Correct matches: KV -> static secrets, AWS -> dynamic AWS credentials, PKI -> certificates. Common confusions involve swapping purposes between engines.

Answer

KV: Generates dynamic database credentials.

Answer

AWS: Issues X.509 certificates.

Answer

Transit: Manages SSH keys.

Question 2

A Vault user wants to check the capabilities of their token on a specific path. Which command should they use?

Accepted Answer

vault token capabilities <path>. The `vault token capabilities` command is specifically designed to check what operations (e.g., read, create, update, delete, list) a given token is allowed to perform on a particular path. It evaluates the token's attached policies against the path and returns the effective capabilities, making it the correct tool for this task.

Answer

vault token list

Answer

vault policy capabilities

Answer

vault token lookup <token>

Question 3

A DevOps team has configured a Vault policy to allow reading secrets from the 'secret/data/engineering' path. The policy contains:

path "secret/data/engineering/*" {
  capabilities = ["read", "list"]
}

However, when a user attempts to read a secret at 'secret/data/engineering/db/password', they receive a permission denied error. What is the most likely cause?

Accepted Answer

The policy uses a single asterisk, which does not match nested paths; it should use double asterisk or specify the exact path.. In Vault's policy path matching, a single asterisk (`*`) matches only a single level of the path, not nested sub-paths. The path `secret/data/engineering/*` matches `secret/data/engineering/foo` but does NOT match `secret/data/engineering/db/password` because the latter has an additional sub-path level. To match all nested paths, you must use a double asterisk (`**`) or explicitly list the full path. This is a common pitfall when writing Vault policies for hierarchical secret structures.

Answer

The policy lacks the 'deny' capability to override the default deny.

Answer

The secret engine's mount path is different; it is mounted at 'secret/' but the policy expects 'secret/data/'.

Answer

The user's token does not have the correct identity policies attached.

Question 4

An organization uses Vault with a Consul storage backend. They have three Vault servers and three Consul servers. During a routine maintenance, they restart all Consul servers simultaneously. After the restart, Vault becomes sealed and cannot be unsealed. The Vault logs show 'storage: error listing' and 'failed to check status'. The Consul cluster is healthy with a leader. What is the most likely cause and solution?

Accepted Answer

Restore Vault's storage backend from a recent backup. When all Consul servers are restarted simultaneously, the Vault storage backend (Consul) may lose critical metadata or consistency state that Vault relies on to maintain its seal/unseal status. Even though the Consul cluster appears healthy with a leader, the underlying data corruption or loss of key-value entries (such as the barrier key or storage index) prevents Vault from reading its storage, causing it to seal and fail to unseal. Restoring Vault's storage backend from a recent backup is the correct solution because it recovers the consistent state of the data, including the encrypted master key and configuration, without requiring re-initialization.

Answer

Re-initialize Vault and generate new unseal keys

Answer

Generate a new root token using unseal keys

Answer

Use the unseal keys to unseal Vault again

Question 5

Which TWO of the following are correct statements about Vault secrets engines?

Accepted Answer

The Transit secrets engine performs encryption operations without storing the encrypted data.. The Transit secrets engine performs encryption operations such as encrypt, decrypt, sign, and verify without storing the encrypted data. Option C is correct: dynamic secrets engines (e.g., database, AWS) generate credentials on demand with a configurable Time-to-Live (TTL). Option A is incorrect because each secrets engine instance is mounted at a single path; however, the same engine type can be enabled at multiple paths. Option D is incorrect because a KV engine is either version 1 (unversioned) or version 2 (versioned), not both simultaneously. Option E is incorrect because static secrets, such as database static roles, do support rotation to rotate passwords periodically.

Answer

Secrets engines are enabled at a path, and each engine can be mounted at multiple paths.

Answer

The KV secrets engine can be configured to store both versioned and unversioned data simultaneously.

Answer

Static secrets engines do not support rotation.

Question 6

A developer creates a token using the 'token create' command with the 'period=24h' flag. What type of token is created?

Accepted Answer

Periodic token. The 'token create' command with the 'period=24h' flag creates a periodic token. Periodic tokens have a TTL that is automatically renewed by the client before expiration, but they do not have a maximum lifetime beyond the period itself. This is distinct from normal tokens, which have both a TTL and a max TTL, and root tokens, which are exempt from TTL enforcement.

Answer

Root token

Answer

Orphan token

Answer

Batch token

Question 7

A large enterprise uses Azure Active Directory as its identity provider. They want to authenticate users to Vault using Azure AD tokens. However, they require that Vault validate the token's signature and claims without contacting Azure AD every time. Which authentication method should they use?

Accepted Answer

OIDC authentication. (OIDC authentication) is correct because OpenID Connect (OIDC) allows Vault to validate an Azure AD token's signature and claims locally using the provider's JWKS (JSON Web Key Set) endpoint, without requiring a round-trip to Azure AD for every authentication request. This satisfies the requirement for offline token validation while still leveraging Azure AD as the identity provider.

Answer

LDAP authentication

Answer

Token authentication

Answer

Azure authentication

Question 8

A DevOps team is writing a Vault policy for a CI/CD pipeline that needs to authenticate using AppRole, read specific secrets, and write dynamic database credentials. Which THREE capabilities should be included in the policy to meet these requirements? (Choose three.)

Accepted Answer

read. The only capability required for the described tasks is 'read'. Reading specific secrets from KV v2 or generating dynamic database credentials (via database/creds/<role-name>) both use the 'read' operation. AppRole authentication is handled before the policy applies; the policy itself does not need to grant capabilities for the login process.

Answer

write

Answer

create

Answer

sudo

Answer

update

Question 9

A Vault operator accidentally revoked a token that was used to lease many database credentials. What happens to the leases associated with that token?

Accepted Answer

All leases are immediately revoked.. In Vault, tokens are the root of identity and authorization for all associated leases. When a token is revoked, Vault immediately revokes all leases created using that token, including database credential leases, because the token's lifecycle governs the leases it has created. This ensures that no credentials remain valid after the token is revoked, maintaining security.

Answer

The leases become orphaned and will never be revoked.

Answer

Vault automatically renews the leases with a new token.

Answer

The leases continue until their natural expiration.

Question 10

An e-commerce application integrates with Vault's transit secrets engine to encrypt sensitive customer data before storing it in a database. The operations team regularly rotates the encryption key (my-key) for compliance. Recently, after a rotation, some old ciphertexts could not be decrypted, causing data retrieval failures. The team checked the key configuration and found that the key version used for encryption (version 2) is still present, but decryption fails with an error: 'decryption key version is not available for decryption'. They verified that the ciphertext includes the key version. What is the most likely cause and resolution?

Accepted Answer

The 'min_decryption_version' is set to 3, preventing decryption with version 2. Set it to 2 to allow decryption.. The error 'decryption key version is not available for decryption' indicates that the key version used to encrypt the data (version 2) is present but not allowed for decryption. In Vault's transit secrets engine, the `min_decryption_version` parameter controls the lowest key version that can decrypt data. If it is set to 3, version 2 ciphertexts cannot be decrypted. Setting `min_decryption_version` to 2 resolves the issue by permitting decryption with version 2.

Answer

The 'suppress_decryption' parameter was enabled on the transit mount, blocking decryption. Disable it.

Answer

The key was exported and reimported, losing the version history. Re-create the key from scratch.

Answer

The ciphertext was corrupted during storage. The only solution is to re-encrypt all data with the current key version.

Question 11

An application uses Vault's KV v2 secrets engine to read a static secret (e.g., API key) at path 'secret/data/myapp/config'. The application initially reads the secret and uses the returned lease_id to successfully renew the lease every hour. After a maintenance window, the application starts failing to renew the lease, receiving an error that the lease is not renewable or does not exist. The secret data is still present and accessible via a new read. What is the most likely cause of this failure?

Accepted Answer

The token used to renew the lease has expired.. The error 'lease is not renewable or does not exist' typically occurs when the token used to authenticate the renewal request has expired. In Vault, KV v2 secrets engine reads do not produce renewable leases; the lease_id returned is actually from the token. If the application's token expires, it cannot renew any leases, even if the secret data is still accessible via a new read with a valid token. Options B and C would cause the secret path itself to change, but the secret data is still present, so they are unlikely. Option D is incorrect because KV v2 leases are not renewable, so they cannot expire in the scenario described.

Answer

The secret was deleted and recreated under the same path.

Answer

The KV v2 engine was disabled and re-enabled.

Answer

The lease expired during the maintenance window because the application did not renew it on time.

Question 12

A policy must allow a user to revoke their own token. Which endpoint and capability are required?

Accepted Answer

path "auth/token/revoke-self" { capabilities = ["update"] }. To revoke your own token, you need the endpoint 'auth/token/revoke-self' with the 'update' capability. Option A uses 'auth/token/revoke', which is for revoking other tokens and requires sudo capability. Option B uses the correct endpoint but 'write' is not a valid capability in Vault; the correct capability is 'update'. Option C uses 'sys/leases/revoke', which is for revoking leases, not tokens.

Answer

path "auth/token/revoke" { capabilities = ["update"] }

Answer

path "auth/token/revoke-self" { capabilities = ["write"] }

Answer

path "sys/leases/revoke" { capabilities = ["update"] }

Question 13

A Vault operator wants to manage lease durations for secrets issued by a PKI secrets engine. Which two actions can they take to affect the lease duration of certificates?

Accepted Answer

Configure the 'ttl' parameter in the PKI role definition.. The 'ttl' parameter in a PKI role definition directly controls the lease duration (time-to-live) for certificates issued by that role. This is the primary mechanism for setting how long a certificate is valid, overriding the mount-level default if specified.

Answer

Set the 'default_lease_ttl' on the auth method used to log in.

Answer

Set the 'max_lease_ttl' on the auth method used to log in.

Answer

Set the 'lease_duration' parameter in the PKI role definition.

Question 14

A large e-commerce company uses Vault to manage secrets for their AWS EC2 instances. They use AWS IAM auth. The Vault role is configured with bound_iam_role_arn to match the IAM role 'ec2-app-role'. Most instances work fine. However, a new instance launched with the same IAM role fails to authenticate. The instance can reach Vault (network is fine) and the AWS credentials are valid. The Vault server logs show: 'error validating login: unable to get instance identity document'. The new instance is in a different AWS region (us-west-2) while most others are in us-east-1. Vault is deployed in us-east-1. What is the most likely cause and solution?

Accepted Answer

Vault's AWS auth method must be configured with the correct region for instance identity validation.. The AWS auth method in Vault validates the instance identity document, which includes the region where the instance is launched. By default, Vault's AWS auth method uses the region configured in its sts_endpoint or the Vault server's own region (us-east-1). When a new instance in us-west-2 presents its identity document signed with a us-west-2 region-specific key, Vault fails to validate it because it is checking against the wrong region's signing key. Configuring the auth method with the correct region (or a wildcard) allows Vault to validate identity documents from multiple regions.

Answer

The IAM role does not exist in us-west-2.

Answer

The new instance needs to be associated with an instance profile.

Answer

Create a new Vault role for the us-west-2 region.

Question 15

A CI/CD pipeline needs to generate thousands of short-lived tokens each day for jobs that run for at most 5 minutes. The tokens should not be renewable or revocable individually. Which token type should be used?

Accepted Answer

Batch tokens. Batch tokens are designed for high-volume, short-lived workloads where tokens are generated in batches and have a configurable TTL (time-to-live). They cannot be renewed or revoked individually, making them ideal for CI/CD pipelines that need thousands of tokens per day for jobs lasting at most 5 minutes.

Answer

Orphan tokens

Answer

Service tokens

Answer

Periodic tokens