VA-003 Practice Test 21 — 15 Questions

Question 1

A user wants to log in using the userpass auth method with username 'jdoe' and password 'p@ssw0rd'. What is the correct API endpoint and request?

Accepted Answer

POST /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}. The userpass auth method in Vault requires a POST request to the login endpoint with the password provided in the JSON body. Option D correctly uses POST /v1/auth/userpass/login/jdoe with {"password":"p@ssw0rd"}, which matches the Vault API specification for authenticating against a userpass backend.

Answer

GET /v1/auth/userpass/login/jdoe with header "password: p@ssw0rd"

Answer

PUT /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}

Answer

POST /v1/auth/userpass/login/jdoe?password=p@ssw0rd

Question 2

Refer to the exhibit. A Vault policy allows 'list' on 'secret/data/*'. A user tries to list keys under 'secret/data/' and gets a permission denied error. What is the most likely reason?

Accepted Answer

The path must be 'secret/metadata/*' for list. C is correct because in Vault, listing keys under a KV v2 secrets engine requires the 'list' capability on the 'secret/metadata/*' path, not 'secret/data/*'. The 'data' path is used for reading and writing actual secret values, while 'metadata' is the correct path for listing and deleting metadata (including key names). The policy only grants 'list' on 'secret/data/*', which does not cover the list operation on the metadata endpoint, resulting in a permission denied error.

Answer

The user's token has no default policy

Answer

The policy lacks 'read' capability

Answer

The secrets engine is not enabled

Question 3

An operator needs to enable the KV v2 secrets engine at the path 'team-alpha'. Which command should they run?

Accepted Answer

vault secrets enable -path=team-alpha kv-v2. The `vault secrets enable` command with the `-path` flag specifies the mount path as 'team-alpha', and `kv-v2` is the correct engine type for the KV v2 secrets engine. This command mounts the KV v2 engine at the desired path, enabling versioned key-value storage.

Answer

vault secrets enable kv-v2 team-alpha

Answer

vault secrets enable -path=team-alpha kv

Answer

vault secrets mount -path=team-alpha kv

Question 4

A Vault administrator has enabled the PKI secrets engine and configured a root CA. They now need to issue certificates for multiple internal services, each with its own common name (CN). Which is the most efficient way to issue certificates while maintaining security?

Accepted Answer

Create a separate role for each service with specific allowed domains. Creating a separate role for each service allows you to enforce least-privilege by restricting each role to specific allowed domains (e.g., via `allowed_domains` and `allow_subdomains`). This ensures that each service can only request certificates for its own CN, preventing cross-service impersonation while maintaining efficient, role-based issuance. The PKI secrets engine uses roles to define TTL, key type, and domain constraints, making per-service roles the most secure and manageable approach.

Answer

Create one role with the allow_any_name parameter set to true

Answer

Create one role with a wildcard allowed domain and use the common_name parameter when issuing

Answer

Create one role without any allowed domains and specify the common name in the request

Question 5

Refer to the exhibit. A token has this policy. Which action can the token perform?

Accepted Answer

Read a secret at "secret/data/engineering/db-pass". The token's policy grants 'read' capability on 'secret/data/engineering/*' via the 'data' path. Since 'secret/data/engineering/db-pass' falls under that wildcard, the token can read it. The policy does not allow 'update', 'list', or 'delete' actions on the specified paths.

Answer

Update a secret at "secret/data/engineering/config"

Answer

List secrets at "secret/data/finance/"

Answer

Delete a secret at "secret/data/finance/budget"

Question 6

After migrating from an older version of Vault, the operator wants to replace the deprecated 'generic' secrets engine with a modern alternative. Which secrets engine should be used to store static key-value pairs?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is the modern replacement for the deprecated 'generic' secrets engine in Vault. It stores static key-value pairs with added features such as versioning, configurable delete and destroy behaviors, and check-and-set operations, making it the correct choice for this use case.

Answer

AWS secrets engine

Answer

Database secrets engine

Answer

Transit secrets engine

Question 7

An organization previously used userpass auth and is migrating to LDAP auth. After enabling LDAP and configuring the bind user, users can authenticate but their policies do not apply. What is the most likely cause?

Accepted Answer

LDAP groups are not mapped to Vault policies. When users can authenticate but policies do not apply, it indicates that authentication itself is working (LDAP bind succeeded), but Vault has no way to associate the authenticated user with the correct policies. In Vault, LDAP authentication relies on group membership mapping: the LDAP server returns the user's groups, and Vault must have those groups mapped to Vault policies via `vault write auth/ldap/groups/ policies=`. Without this mapping, the user authenticates but receives no policies, resulting in an empty token with no permissions.

Answer

The bind credentials are incorrect

Answer

The userpass auth method is still enabled

Answer

The LDAP server is unreachable

Question 8

Which token type should be used for short-lived credentials that do not need to be renewed?

Accepted Answer

Batch tokens. Batch tokens in HashiCorp Vault are designed for short-lived, non-renewable credentials. They have a fixed Time-to-Live (TTL) and cannot be renewed or revoked individually; once the TTL expires, the token is automatically invalidated. This makes them ideal for batch jobs or one-time tasks where credential renewal is unnecessary.

Answer

Service tokens

Answer

Periodic tokens

Answer

Orphan tokens

Question 9

What is the purpose of a token's "period" attribute?

Accepted Answer

It is the starting TTL for a periodic token and is refreshed on each renewal.. The 'period' attribute in Vault tokens defines the starting TTL (time-to-live) for a periodic token. When a periodic token is renewed, its TTL is reset to this period value, allowing the token to exist indefinitely as long as it is renewed before the period expires. This is distinct from a non-periodic token, which has a fixed maximum TTL that cannot be extended beyond its original lifetime.

Answer

It defines the maximum lifetime of a token.

Answer

It defines the number of uses before token expires.

Answer

It is the time after which the token is revoked if not used.

Question 10

An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

Accepted Answer

AWS IAM is eventually consistent and the user may take a few seconds to propagate.. AWS IAM is an eventually consistent system. When Vault uses the AWS secrets engine to create an IAM user via the CreateUser API call, the user is not immediately available across all AWS services due to propagation delays. This eventual consistency means the generated IAM user may take a few seconds to be fully usable, which is a known behavior of AWS IAM.

Answer

The Vault write operation failed due to network latency.

Answer

The TTL on the role is too short.

Answer

Vault must wait for the AWS secret key to be rotated before returning the user.

Question 11

An application needs to encrypt sensitive data before storing it in a database. The security team wants to use Vault's encryption as a service to avoid managing encryption keys. Which Vault secrets engine should they enable?

Accepted Answer

Transit. The Transit secrets engine is designed specifically for encryption as a service, allowing applications to encrypt and decrypt data without ever having direct access to the encryption keys. The keys are stored and managed entirely within Vault, which meets the security team's requirement to avoid managing encryption keys themselves.

Answer

AWS

Answer

KV v2

Answer

Consul

Answer

PKI

Question 12

A platform team uses Vault to issue short-lived tokens to external contractors. The security policy requires that every contractor token must be traceable back to the contractor's identity, and that a token can never be renewed beyond its initial TTL. The team creates tokens with the default settings. A contractor later reports that their token stopped working after its TTL expired, but they were able to renew it several times before that. Which token parameter should the team have configured to enforce the policy?

Accepted Answer

Create the token with the display-name parameter set to the contractor's identity and an explicit max TTL equal to the initial TTL.. To enforce the policy, the token must be traceable to the contractor and must not be renewable beyond its initial TTL. The display-name parameter provides traceability by linking the token to a specific identity. An explicit max TTL set to the same value as the initial TTL caps the total lifetime, so renewals cannot extend it. Other parameters like period or no-default-policy do not satisfy both requirements simultaneously.

Answer

Set the token's explicit max TTL to the same value as its initial TTL.

Answer

Set the token's period to a fixed value and enable renewal.

Answer

Create the token with the no-default-policy option and attach a custom policy.

Question 13

A platform team runs a Vault cluster with a transit secrets engine mount at transit/. An application holds a token with a policy granting only "update" on transit/encrypt/orders and "read" on transit/keys/orders. The application's token has a TTL of 1h with a max_ttl of 4h, and it renews itself every 30 minutes using the token renewal endpoint. After roughly four hours of continuous operation, the application's API calls begin failing with a permission denied error even though the token was renewed successfully each time. Which Vault behavior explains this failure?

Accepted Answer

The token reached its max_ttl, so renewal requests stopped extending its lifetime and the token expired, invalidating all requests made with it.. Service tokens are bounded by both a renewable TTL and an absolute max_ttl. Each renewal extends the token's lifetime only until the max_ttl ceiling is reached; beyond that point Vault refuses to extend it, and the token expires. Expiration invalidates the token immediately, so subsequent API calls authenticated with it fail with permission denied, exactly as the application observes after about four hours.

Answer

The transit secrets engine automatically revoked the token when the application exceeded its allowed number of encrypt operations per hour.

Answer

The policy attached to the token expired at the same time as the token's initial TTL and had to be reattached before further API calls could succeed.

Answer

Renewing a token more than once silently converts it into a periodic token whose capabilities are stripped until it is re-authenticated.

Question 14

A platform team operates Vault in a hybrid cloud. They want a single authentication method that lets employees use their existing cloud provider identity (e.g., AWS IAM role, Azure managed identity) to log in without distributing Vault-specific credentials. Which authentication method should they enable?

Accepted Answer

Cloud auth method (e.g., AWS, Azure, GCP). Cloud auth methods (AWS, Azure, GCP) enable authentication using existing cloud provider identities. For AWS, Vault uses the IAM principal's signed request to verify identity; for Azure, it validates managed identity tokens. This eliminates the need to distribute Vault-specific credentials and aligns with the hybrid cloud requirement.

Answer

GitHub auth method

Answer

Username & Password auth method

Answer

Cloud Foundry auth method

Question 15

A developer needs to authenticate to Vault from a CI/CD pipeline running on an on-premises server. The pipeline cannot use cloud provider identities or Kubernetes. The security team wants to avoid embedding long-lived Vault tokens in the pipeline scripts. Which authentication method is most appropriate?

Accepted Answer

AppRole auth method. AppRole is purpose-built for machine-to-machine authentication, including CI/CD pipelines. It uses a role_id and secret_id that can be delivered securely and have short TTLs, avoiding long-lived tokens. Other methods either require interactive user flows or static credentials unsuitable for the scenario.

Answer

Username & Password auth method

Answer

GitHub auth method

Answer

OIDC auth method