VA-003 Practice Test 22 — 15 Questions

Question 1

A platform team runs a nightly batch job that authenticates to Vault with the AppRole auth method and receives a token with a 30-minute TTL. The job occasionally overruns and hits 'permission denied' errors mid-run. The team wants the token to stay valid as long as the job keeps working, without the job re-authenticating. Which token attribute should the AppRole role be configured with when the token is issued?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set token_period to 30m on the AppRole role so the token is a periodic token. The requirement is a token that stays valid as long as it keeps being renewed, which is exactly the behavior of a periodic token. Configuring token_period on the AppRole role makes issued tokens periodic, so the nightly job can renew indefinitely before each period lapses instead of being cut off by a fixed TTL or an absolute maximum lifetime.

Answer

Set token_explicit_max_ttl to 24h on the AppRole role

Answer

Increase the token_ttl to 24h and disable renewal on the AppRole role

Answer

Set token_no_default_policy to true on the AppRole role

Question 2

A security engineer is comparing the AppRole and Kubernetes auth methods for a containerized application. The application runs in a Kubernetes cluster and needs to authenticate to Vault. The engineer wants to minimize the risk of secret leakage and avoid manual secret rotation. Which statement best describes the advantage of Kubernetes auth over AppRole in this scenario?

Accepted Answer

Kubernetes auth uses a service account token that is automatically mounted and rotated by Kubernetes, eliminating the need to store a static secret_id.. Kubernetes auth uses the pod's service account token, which Kubernetes automatically mounts and rotates. This removes the need to store a static secret_id, reducing leakage risk and manual rotation. AppRole requires a secret_id that must be protected and rotated, making Kubernetes auth advantageous in this containerized scenario.

Answer

Kubernetes auth automatically rotates the Vault token every 24 hours without any configuration.

Answer

AppRole is always more secure because it supports CIDR binding, while Kubernetes auth does not.

Answer

Kubernetes auth requires a secret_id that is stored in a Kubernetes Secret and manually rotated.

Question 3

A platform team stores KV v2 secrets under the mount 'kv-prod'. They need a policy that lets an application read only the metadata (not the underlying secret values) for every path under 'kv-prod/apps/', including the ability to enumerate keys. Which policy stanza satisfies this requirement?

Accepted Answer

path "kv-prod/metadata/apps/*" { capabilities = ["read", "list"] }. KV v2 splits each secret into a data endpoint that returns values and a metadata endpoint that returns version information. To inspect versions without exposing secret material, the policy must target the metadata path and include list so the prefix can be enumerated. Pointing the stanza at the data path leaks values, and omitting list breaks key discovery.

Answer

path "kv-prod/data/apps/*" { capabilities = ["read", "list"] }

Answer

path "kv-prod/metadata/apps/*" { capabilities = ["read"] }

Answer

path "kv-prod/apps/*" { capabilities = ["read", "list"] }

Question 4

A consulting firm deploys Vault to multiple tenants. Each tenant uses the OIDC auth method with its own identity provider, but the security team observes that users from one tenant occasionally receive policies intended for another tenant. The OIDC mounts were configured separately, and each uses a distinct default_role. Which configuration issue most likely explains the cross-tenant policy assignment?

Accepted Answer

The user_claim and groups_claim settings on each role resolve to values that collide across tenants, and Vault maps them to the same external group aliases.. Identity group aliases created from OIDC group claims are stored on the identity backend and are not isolated per auth mount. When claim values coincide across tenants, Vault treats them as the same external group and attaches that group's policies to all matching users. Auditing the user_claim and groups_claim values, and namespacing alias names, resolves the collision.

Answer

Each OIDC mount uses the same bound_issuer value, so tokens from either provider are treated as originating from a single issuer.

Answer

The OIDC discovery URL for one tenant was entered with a trailing slash, causing claim parsing to fall back to defaults.

Answer

The OIDC role's bound_audiences value includes an audience shared by both identity providers.

Question 5

A Vault administrator is writing a policy for a monitoring tool that must be able to list all secrets under the 'secret/metadata/finance/' path and read the metadata of individual secrets, but must not read the secret data itself. Which policy snippet correctly grants only these permissions?

Accepted Answer

path "secret/metadata/finance/*" { capabilities = ["list", "read"] }. In Vault's KV v2 secrets engine, metadata operations such as listing secrets and reading secret metadata are performed on the metadata/ path, while reading and writing secret data uses the data/ path. To allow listing and reading metadata without accessing secret data, the policy must grant list and read on secret/metadata/finance/*. The other options either target the wrong path or omit required capabilities.

Answer

path "secret/data/finance/*" { capabilities = ["list", "read"] }

Answer

path "secret/metadata/finance/*" { capabilities = ["read"] }

Answer

path "secret/finance/*" { capabilities = ["list", "read"] }

Question 6

A junior administrator writes a policy file and applies it with 'vault policy write app-read app-read.hcl'. Later, a token created against this policy can read secrets it was never meant to see. The administrator wants to confirm exactly what the policy grants before rotating credentials. Which command displays the parsed, effective rules of the stored policy?

Accepted Answer

vault policy read app-read. Stored policies are inspected with the dedicated policy read subcommand, which returns the server-side document as parsed, exposing any difference from the local HCL file. Listing policies only yields names, the raw sys endpoint returns an opaque string, and the capabilities subcommand requires a token and a path rather than a policy name.

Answer

vault policy list

Answer

vault read sys/policy/app-read

Answer

vault token capabilities app-read

Question 7

A developer authenticates with the userpass auth method and receives a token. The developer needs to perform a sensitive operation but the token lacks the required policy. Before asking an administrator, the developer wants to determine whether their current token is permitted to update the secret at secret/data/payments. Which command should the developer run?

Accepted Answer

vault token capabilities secret/data/payments. The capabilities endpoint is designed to answer exactly this question: it returns the set of actions the current token may perform on a specified path. Running vault token capabilities against secret/data/payments reveals whether update is allowed, without reading the secret or requiring administrator involvement.

Answer

vault kv get secret/data/payments

Answer

vault token lookup

Answer

vault policy read default

Question 8

A new engineer authenticates to Vault and receives a token. The engineer's manager asks which policies are attached to that token and when it will expire, so the team can plan a permissions review. Which command should the engineer run to display this information about their own token?

Accepted Answer

vault token lookup. Token inspection is performed with vault token lookup, which returns the token's policies, TTL, renewability, and accessor when run against the current token. That directly supplies the policy list and expiration information needed for the review, without creating new tokens or querying unrelated auth and secrets mounts.

Answer

vault auth list

Answer

vault secrets list

Answer

vault token create

Question 9

An administrator is evaluating Kubernetes auth for workloads running in a cluster. A developer asks whether a pod can authenticate by presenting a service account token directly to Vault without Vault contacting the Kubernetes API. Which statement best describes how the Kubernetes auth method actually validates a login?

Accepted Answer

Vault forwards the service account token to the Kubernetes TokenReview API and checks that the returned identity matches the role's bound service account names and namespaces.. Kubernetes auth validates a login by presenting the supplied service account token to the cluster's TokenReview API and then checking the confirmed identity against the role's bound service account name and namespace. This keeps the cluster authoritative about token validity and requires Vault to reach the API server and hold a reviewer token with tokenreviews permissions.

Answer

Vault compares the token against a static list of service account tokens stored in the role definition at configuration time.

Answer

Vault decodes the service account token as a JWT and trusts its claims without contacting the cluster, provided the issuer matches the configured value.

Answer

Vault verifies the service account token locally using a public key cached during configuration, so no API call is needed.

Question 10

A security team wants to audit all tokens created by a specific authentication method. They need to list all tokens and retrieve details such as creation time, TTL, and policies. Which Vault command should they use?

Accepted Answer

vault list auth/token/accessors. To audit tokens, administrators can list all token accessors using `vault list auth/token/accessors`. Each accessor can then be used with `vault token lookup` to retrieve detailed information about the corresponding token. This approach avoids exposing the actual token IDs while still allowing comprehensive auditing of token properties such as creation time, TTL, and policies.

Answer

vault token create -list

Answer

vault token lookup

Answer

vault read auth/token/accessors

Question 11

A security engineer is onboarding a new application team to Vault. The team needs to understand how Vault manages the lifecycle of secrets issued by the database secrets engine. The engineer explains that Vault attaches a lease to dynamic secrets and that the lease defines the secret's validity period. Which statement accurately describes the relationship between a lease and a dynamic secret?

Accepted Answer

A lease is metadata that records the secret's validity period, renewal eligibility, and revocation behavior, and it is created alongside the dynamic secret.. Vault issues dynamic secrets together with a lease that records the secret's time-to-live, whether it can be renewed, and how it should be revoked. This server-side metadata is what allows Vault to automatically revoke credentials when they are no longer valid, which is a core security benefit of using dynamic secrets over static credentials.

Answer

A lease is a static configuration setting on the secrets engine that applies the same TTL to every secret issued from that mount.

Answer

A lease is a client-side token stored by the application that must be presented to Vault before the secret can be used.

Answer

A lease is created only when an administrator manually enables lease tracking on a secrets engine mount.

Question 12

A Vault administrator is creating a policy for an application that needs to read a PKI role configuration and also generate certificates using that role. The PKI secrets engine is mounted at 'pki/'. Which policy snippet grants the minimum required capabilities?

Accepted Answer

path "pki/roles/app-role" { capabilities = ["read"] } path "pki/issue/app-role" { capabilities = ["create", "update"] }. The PKI secrets engine uses pki/roles/ for reading role configuration and pki/issue/ for generating certificates. Generating a certificate is a write operation, so the policy must grant create or update on the issue path. Reading the role requires read on the roles path. The sign endpoint is for signing CSRs, not for generating certificates.

Answer

path "pki/roles/app-role" { capabilities = ["read", "list"] }
path "pki/issue/app-role" { capabilities = ["read"] }

Answer

path "pki/roles/app-role" { capabilities = ["read"] }
path "pki/sign/app-role" { capabilities = ["create", "update"] }

Answer

path "pki/roles/app-role" { capabilities = ["read"] }
path "pki/issue/app-role" { capabilities = ["sudo"] }

Question 13

A security engineer enables the Transit secrets engine at 'transit/' and creates an encryption key named 'payments' with `vault write -f transit/keys/payments`. The engineer then wants to rotate the key so that new data is encrypted with a new key version while existing ciphertext can still be decrypted. Which command accomplishes this without invalidating existing ciphertext?

Accepted Answer

vault write -f transit/keys/payments/rotate. Transit key rotation creates a new key version and designates it for future encryption, while retaining prior versions so existing ciphertext can still be decrypted. The rotate endpoint performs this immediately. Automatic rotation via a rotation period is a separate configuration and does not trigger an instant new version. Rewrap and trim serve different purposes and do not create a new key version.

Answer

vault write -f transit/keys/payments/trim min_available_version=2

Answer

vault write transit/keys/payments/config rotation_period=24h

Answer

vault write transit/keys/payments/rewrap ciphertext=<ciphertext>

Question 14

A security team must delegate policy management to a group of operators without giving them the ability to grant themselves capabilities on protected paths such as 'sys/*' or 'auth/token/*'. Which combination of policy rules best implements this delegation safely?

Accepted Answer

Grant 'create' and 'update' on 'sys/policies/acl/*' and additionally restrict the operators through a Sentinel or policy-as-code layer that rejects stanzas referencing 'sys/*' or 'auth/token/*'.. Because Vault treats a policy document as opaque content and does not verify that the author could exercise the capabilities being granted, write access to the policy endpoint is effectively administrative. Safe delegation therefore requires an external validation layer that inspects submitted stanzas and rejects protected paths, rather than relying on sudo, TTLs or imagined self-escalation checks.

Answer

Grant 'create' and 'update' on 'sys/policies/acl/*' plus 'read' on 'sys/policies/acl', and rely on Vault's default behavior that operators can only write policies they themselves could exercise.

Answer

Grant 'create' and 'update' on 'sys/policies/acl/*' and require operators to authenticate with a token that has a short TTL, since Vault re-evaluates policy contents against the author's ACL at token creation time.

Answer

Grant 'sudo' on 'sys/policies/acl/*' along with 'create' and 'update', because the sudo capability makes Vault validate that submitted policies do not exceed the author's own privileges.

Question 15

A team maintains a shared policy that many tokens reference. An administrator needs to add a new path stanza to the policy while preserving every existing rule, without risking a typo that silently removes access. Which approach is correct?

Accepted Answer

Edit the existing HCL to append the new stanza, then run 'vault policy write shared-policy shared-policy.hcl' to replace the policy with the complete updated document.. Policy writes in Vault are full replacements, not merges or patches. The reliable method is to retrieve the current document, append the new stanza locally, and write the complete file back so every prior rule is preserved. Deleting and recreating the policy does not propagate changes to already-issued tokens, and no patch subcommand exists.

Answer

Delete the policy with 'vault policy delete shared-policy', recreate it with the additional stanza, and let Vault reattach it to all dependent tokens automatically.

Answer

Run 'vault policy write shared-policy -' and pipe in only the new stanza, because Vault merges the submitted document with the stored policy.

Answer

Run 'vault policy patch shared-policy' with the new stanza, since the patch subcommand performs a partial update of an existing policy.