VA-003 Practice Test 22 — 15 Questions

Question 1

An administrator notices that after revoking a specific lease, the underlying database credential is still accessible. What is the most likely cause?

Accepted Answer

The revocation script failed to delete the database user.. When a lease is revoked in Vault, the revocation script associated with the database secret engine is responsible for deleting or disabling the corresponding database user. If that script fails (e.g., due to insufficient permissions, network issues, or a bug in the script), the underlying credential remains active in the database, even though the lease is no longer valid in Vault. This is a common operational issue where the lease lifecycle and the actual credential lifecycle become out of sync.

Answer

The secret engine caches credentials.

Answer

The lease ID was incorrect.

Answer

The lease was renewed after revocation.

Question 2

A multinational corporation uses Vault Enterprise with the transit engine to encrypt sensitive financial data across multiple cloud regions. Each region has its own Vault cluster, and they use performance replication to synchronize transit keys. Recently, the team in the Asia-Pacific region reports that encryption operations are slower than in other regions. They also notice that some decryption requests for data encrypted with a key that was rotated in the primary region are failing with 'key version not found' errors. The transit key is named 'fin-key' and has been rotated three times. The Asia-Pacific cluster is up-to-date with replication according to the replication status dashboard. Which action should the operations team take to resolve the decryption failures?

Accepted Answer

Verify that the policy in the Asia-Pacific cluster grants 'decrypt' capability on the key path for older key versions.. The decryption failures are caused by missing key versions in the Asia-Pacific cluster's transit engine. Even though performance replication synchronizes transit keys, older key versions may not be replicated if the transit engine's key version caching or policy does not explicitly grant access to them. Verifying that the policy includes 'decrypt' capability on the key path for older key versions ensures that the cluster can serve decryption requests for data encrypted with rotated keys.

Answer

Increase the performance standby count in the Asia-Pacific cluster.

Answer

Manually copy the key material from the primary to the secondary cluster.

Answer

Re-encrypt all data encrypted with version 1 of 'fin-key' using the current version.

Question 3

Which TWO of the following are true about token accessors?

Accepted Answer

Accessors should be used in audit logs instead of token values. Token accessors are designed to be used in audit logs as a safe alternative to the actual token value. This prevents sensitive token data from being exposed in logs while still allowing correlation of events to a specific token. Option C is correct because an accessor is a unique identifier that references a token without revealing the token's secret value.

Answer

Accessors are the token value

Answer

Accessors can be used to renew the token

Question 4

Which TWO authentication methods allow a machine to authenticate without storing a static secret? (Choose two.)

Accepted Answer

Kubernetes. Kubernetes authentication in Vault uses the Kubernetes service account token (a JWT) to authenticate. The JWT is dynamically generated by the Kubernetes API server and is not a static secret stored by the machine; Vault verifies it against the Kubernetes API server's token review endpoint. This allows the machine to authenticate without storing a long-lived static credential.

Answer

LDAP

Answer

AppRole

Answer

Userpass

Question 5

Which three statements about lease renewal are correct? (Choose three.)

Accepted Answer

Renewing a lease increments the lease number.. In Vault, each lease renewal increments the lease number (a monotonically increasing counter) to track the renewal history. This allows clients and Vault to detect replay attacks or stale renewals, as the lease ID remains the same but the lease number changes with each successful renew operation.

Answer

A lease can be renewed indefinitely.

Answer

Lease renewal requires 'sudo' capability.

Question 6

An application needs to encrypt sensitive data before storing it in a database. The security team wants to use Vault's encryption as a service to avoid managing encryption keys. Which Vault secrets engine should they enable?

Accepted Answer

Transit. The Transit secrets engine is designed specifically for encryption as a service, allowing applications to encrypt and decrypt data without ever having direct access to the encryption keys. The keys are stored and managed entirely within Vault, which meets the security team's requirement to avoid managing encryption keys themselves.

Answer

AWS

Answer

KV v2

Answer

Consul

Answer

PKI

Question 7

An organization wants to ensure that even Vault administrators cannot see the plaintext of data encrypted with the transit engine, but they want to use Vault for key management. What feature should be enabled?

Accepted Answer

Client-side encryption with datakey. Client-side encryption with a datakey allows the application to encrypt data locally using a key obtained from Vault, ensuring that Vault administrators never see the plaintext. The datakey is generated by Vault and returned in both plaintext and ciphertext forms; the application encrypts data with the plaintext key and then discards it, storing only the ciphertext key alongside the encrypted data. This decouples key management from data encryption, meeting the requirement that even Vault administrators cannot access the plaintext.

Answer

Seal wrapping

Answer

Convergent encryption

Answer

Key deletion prevention

Answer

Key derivation

Question 8

Refer to the exhibit. A user with this policy attempts to read 'secret/data/team/admin'. What will happen?

Accepted Answer

Read fails because deny overrides the broader path.. Vault's policy evaluation uses a deny-by-default model where explicit deny rules override any allow rules. The policy first allows read on 'secret/data/team/*' but then explicitly denies read on 'secret/data/team/admin'. Since the deny rule is more specific and matches the exact path, it takes precedence, causing the read operation to fail.

Answer

Read succeeds because the first path allows read.

Answer

Read fails because the path does not exist.

Answer

Read succeeds if the user also has sudo capability.

Question 9

A small company uses Vault with LDAP authentication for their employees. They configured the LDAP auth method pointing to their on-premises Active Directory. Several users report that they can log in to the Vault UI, but they cannot see any secrets in the paths they expect. The administrator verified that the users are in the correct AD groups. The Vault policies are defined and assigned to groups via the LDAP auth method's group mapping. However, the users still have no permissions. What is the most likely root cause and the correct fix?

Accepted Answer

The group mapping in Vault does not match the AD group names (case or syntax).. The most likely root cause is that the group mapping in Vault does not match the AD group names due to case sensitivity or syntax differences. Vault's LDAP auth method performs exact string matching when mapping LDAP groups to Vault policies; if the group names in the Vault configuration (e.g., 'Domain Admins') differ from the actual AD group names (e.g., 'Domain Admins' with a trailing space or different case), the mapping fails, resulting in no policy assignment and thus no permissions.

Answer

The LDAP bind credentials are incorrect.

Answer

The LDAP auth method is not enabled.

Answer

The Vault token's TTL is too short.

Question 10

A security audit reveals that many Vault tokens in an organization are orphan tokens (tokens with no parent). The tokens were created using a batch token creation script that did not set an explicit parent. The security team is concerned about these orphan tokens because they cannot be managed through the usual parent-child hierarchy. They want to revoke all orphan tokens created more than 30 days ago. However, the team does not have a list of token IDs for these tokens. Which approach should the team take to revoke the orphan tokens?

Accepted Answer

If the team stored token accessors at creation time, use the accessors to revoke the tokens via the /auth/token/revoke-accessor endpoint.. Token accessors are non-sensitive identifiers that can be used to revoke tokens without needing the token ID itself. If the team stored the accessors when the batch tokens were created, they can call the `/auth/token/revoke-accessor` endpoint to revoke each orphan token individually. This approach directly addresses the lack of a token ID list while respecting the security requirement to revoke only orphan tokens older than 30 days.

Answer

Reinitialize Vault and restore from a snapshot taken before the orphan tokens were created.

Answer

Use the token's parent token (the batch token creation script's token) to recursively revoke all children, which includes orphan tokens.

Answer

Revoke the batch token creation script's token and all its children, which will indirectly revoke orphan tokens associated with that script.

Question 11

Refer to the exhibit. A user authenticates via the userpass method. The token helper stores the token. The user's default policy grants read access to secret/data/engineering. The user attempts to read secret/data/engineering using `vault kv get secret/engineering`. The command fails with "permission denied". What is the most likely reason?

Accepted Answer

The token helper is interfering by providing an expired token.. The token helper stores the token, but if the token has expired, the request will fail with 'permission denied' even though the policy grants access to the correct path. The user may be using a previously stored token that is no longer valid.

Answer

The default policy does not include the path "secret/data/engineering".

Answer

The CLI command should use `vault read secret/data/engineering` instead.

Answer

The userpass authentication method requires a one-time password for each operation.

Question 12

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 13

A Vault policy must allow a service to read secrets from "secret/data/app" and also be able to renew its own token. Which two policy statements are necessary and sufficient for this requirement? (Select two.)

Accepted Answer

path "secret/data/app" { capabilities = ["read"] }. The policy must grant read access to the specific path 'secret/data/app' for the service to retrieve secrets. Option B is correct because renewing a token requires the 'update' capability on the 'auth/token/renew-self' endpoint, which allows the service to extend its own token's TTL without needing broader token management privileges.

Answer

path "auth/token/renew" { capabilities = ["update"] }

Answer

path "secret/data/app/*" { capabilities = ["read"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Question 14

Which two commands can be used to manually revoke leases? (Choose two.)

Accepted Answer

vault lease revoke . The `vault lease revoke ` command is specifically designed to manually revoke a single lease by its unique identifier. This directly terminates the associated secret's validity and any derived tokens, aligning with the requirement to manually revoke leases in Vault.

Answer

vault secrets disable <path>

Answer

vault token revoke <token>

Answer

vault lease renew <lease_id>

Question 15

Which THREE factors influence the maximum TTL of a token?

Accepted Answer

The max TTL of the auth method or mount.. The maximum TTL of a token is capped by the max TTL configured on the auth method or mount path. Even if a role or system default allows a longer TTL, the auth mount's max TTL acts as an upper boundary that cannot be exceeded. This ensures that each mount path enforces its own security limits independent of role-level settings.

Answer

The TTL set on the token role.

Answer

The token's current TTL.