VA-003 Practice Test 23 — 15 Questions

Question 1

A Vault admin needs to revoke all leases under the `database/creds/readonly` path without revoking leases from other paths. Which command should the admin use?

Accepted Answer

vault lease revoke -prefix database/creds/readonly. To revoke all leases under a specific secrets engine path, the admin must use `vault lease revoke -prefix <path>`. The `-prefix` flag tells Vault to revoke every lease whose ID begins with the given string, which effectively targets all leases generated by that path. Other flags either expect a full lease ID or revoke everything cluster-wide.

Answer

vault lease revoke -force database/creds/readonly

Answer

vault lease revoke database/creds/readonly

Answer

vault lease revoke -all database/creds/readonly

Question 2

A platform team runs Vault with a transit secrets engine mount at transit/. An application requests a new data encryption key with a 30-minute TTL, and the returned lease_id is recorded by the app. Twenty minutes later, the app calls the renew endpoint for that lease. The mount was configured with max_lease_ttl of 1h. What is the maximum TTL the lease can be extended to by this renewal?

Accepted Answer

The lease can be renewed up to 1 hour total from its original creation time, because the mount's max_lease_ttl caps the cumulative lease lifetime.. A renewable lease is bounded by the mount's max_lease_ttl, which acts as a cumulative ceiling measured from lease creation. Renewal can extend the lease's expiration toward that ceiling but never beyond it. With a 1-hour max and 20 minutes already elapsed, the lease can be renewed only to the 1-hour mark, after which it must be reissued.

Answer

The lease can be renewed indefinitely as long as the client keeps renewing before expiration, because transit keys have no maximum lifetime.

Answer

The lease can be renewed only up to the original 30-minute TTL, because transit leases cannot be extended beyond creation TTL.

Answer

The lease can be renewed to 30 minutes from the moment of the renewal call, giving it a total lifetime of 50 minutes.

Question 3

A cloud operations team needs Vault to issue short-lived credentials for an external MySQL database. They want Vault to create and revoke users dynamically based on a role. Which secrets engine should they enable and configure?

Accepted Answer

The database secrets engine. Dynamic database credentials are the core use case of the database secrets engine. It connects to the database with configured credentials, creates users per role using creation statements, and revokes them when the lease expires. KV v2 stores static secrets, Transit performs cryptographic operations, and PKI issues certificates, so none of those provide dynamic database users.

Answer

The PKI secrets engine

Answer

The Transit secrets engine

Answer

The KV v2 secrets engine

Question 4

A security engineer configures the Transit secrets engine at transit/ to encrypt application data. The application must be able to decrypt data but must not be able to create new encryption keys or rotate existing ones. Which policy snippet correctly grants only the required capability for the application's token?

Accepted Answer

path "transit/decrypt/app-key" { capabilities = ["update"] }. In the Transit secrets engine, decryption is invoked as a write operation, so the policy must grant update on the transit/decrypt/<key> path. This allows the application to decrypt without granting capabilities on key creation or rotation paths, which are separate and can be restricted independently.

Answer

path "transit/decrypt/app-key" { capabilities = ["read"] }

Answer

path "transit/encrypt/app-key" { capabilities = ["update"] }

Answer

path "transit/keys/app-key" { capabilities = ["read"] }

Question 5

An administrator is configuring a new PKI secrets engine at pki/ to issue TLS certificates for internal services. The security team requires that the intermediate CA certificate and its private key are generated inside Vault, and that the root CA remains offline. Which command should the administrator run to create the intermediate CA and generate a CSR for signing by the offline root?

Accepted Answer

vault write pki/intermediate/generate/internal common_name="Internal Intermediate CA". Generating the intermediate inside Vault with the internal variant keeps the private key within Vault's storage barrier while returning only a CSR, which the offline root can sign. Importing the signed certificate afterward completes the chain. This workflow satisfies both the key-containment policy and the offline-root requirement without ever exposing the intermediate private key.

Answer

vault write pki/root/generate/internal common_name="Internal Intermediate CA"

Answer

vault write pki/intermediate/set-signed certificate=@intermediate.crt

Answer

vault write pki/intermediate/generate/exported common_name="Internal Intermediate CA"

Question 6

A Vault operator deploys a single Vault server using Integrated Storage (Raft) as the storage backend. After initializing Vault, the operator notices that the server is marked as sealed and cannot serve requests. The operator has the unseal keys but wants to understand the architectural reason why Vault starts sealed after initialization. Which statement best explains why Vault is sealed immediately after initialization?

Accepted Answer

Vault's security barrier is active by default; initialization generates the master key and unseal keys, but the master key must be provided via unseal keys to decrypt the barrier and access storage.. Vault's security barrier encrypts all data before it reaches the storage backend. During initialization, Vault generates a master key and splits it into unseal keys. The barrier remains sealed until a threshold of unseal keys is provided to reconstruct the master key. This ensures that storage alone is insufficient to access secrets. The other options confuse Raft quorum, root token usage, or TLS with the unsealing mechanism.

Answer

Vault is sealed because the TLS certificate for the API listener has not been configured, and Vault refuses to serve requests without encryption in transit.

Answer

The Integrated Storage backend automatically seals Vault after initialization to prevent unauthorized access until the root token is used.

Answer

Vault requires a quorum of Raft peers to unseal automatically, and with only one node, quorum cannot be achieved.

Question 7

A cloud operations team needs to provide temporary, dynamically generated credentials for an AWS IAM user to a CI/CD pipeline. The credentials must be automatically revoked when the lease expires. They have configured the AWS secrets engine at 'aws/' with root credentials. Which configuration step is required to allow the pipeline to assume a specific IAM role and receive credentials?

Accepted Answer

Create a role in the AWS secrets engine that specifies the credential type as 'assumed_role' and provides the ARN of the IAM role.. To generate temporary credentials that assume a specific IAM role, the AWS secrets engine role must have credential_type set to 'assumed_role' and include the role_arns parameter with the ARN of the target role. This leverages AWS STS AssumeRole, producing credentials that automatically expire with the lease. Other credential types produce different kinds of credentials that do not meet the dynamic, role-assuming requirement.

Answer

Create a role with credential_type=federation_token and specify the role ARN in the policy document.

Answer

Create a role with credential_type=assumed_role and set the policy_arns parameter to the ARN of the IAM role.

Answer

Create a role with credential_type=iam_user and attach a policy that allows sts:AssumeRole.

Question 8

An organization uses the KV v2 secrets engine mounted at 'kv/'. They need to permanently delete all versions of a secret at path 'kv/apps/prod/db' and also remove all associated metadata, including custom metadata and version history. Which command should they run?

Accepted Answer

vault kv metadata delete kv/apps/prod/db. In KV v2, deleting all versions and metadata requires the 'vault kv metadata delete' command. This operation removes the secret entirely, including all version data and custom metadata. Other commands like 'delete' only soft-delete the latest version, 'destroy' removes specific versions but leaves metadata, and 'undelete' restores data. The metadata delete is the only one that fully purges the secret.

Answer

vault kv delete kv/apps/prod/db

Answer

vault kv undelete -versions=1,2,3 kv/apps/prod/db

Answer

vault kv destroy -versions=1,2,3 kv/apps/prod/db

Question 9

An application authenticates to Vault using the AppRole auth method and needs to retrieve the token's remaining TTL and renewable status programmatically. The application already has a valid token and calls the lookup-self endpoint. Which response fields should it read to determine whether the token can be renewed and how long it remains valid?

Accepted Answer

ttl and renewable. The token lookup-self response exposes `ttl` (remaining seconds) and `renewable` (boolean). An application reading these two fields can decide whether to renew the token before it expires or to re-authenticate. Timestamps, use counts, and policies are informative but do not answer the renewability and remaining-lifetime question on their own.

Answer

lease_duration and renewable

Answer

creation_time and expire_time

Answer

num_uses and policies

Question 10

A platform team wants to provide applications with short-lived AWS credentials that are automatically revoked when their lease expires, without managing long-term IAM users. They also need to allow the applications to assume a role for cross-account access. Which secrets engine should the team enable and configure?

Accepted Answer

The AWS secrets engine with an assumed role type role. The AWS secrets engine's assumed_role credential type issues STS temporary credentials by assuming a role, so leases expire naturally and cross-account access works when the target role trusts the Vault-provided identity. This avoids the operational overhead of IAM user creation and deletion while supporting the cross-account pattern described.

Answer

The AWS secrets engine with an IAM user type role

Answer

The AWS secrets engine with an access key type role

Answer

The AWS secrets engine with a federation token type role

Question 11

A Vault admin wants to revoke a specific lease for a dynamic database credential. The admin has the lease ID. Which command should the admin use?

Accepted Answer

vault lease revoke . To revoke a single lease, the admin should run `vault lease revoke ` without any additional flags. This command targets exactly that lease and triggers the appropriate secrets engine to revoke the underlying credential. Using `-prefix` would revoke multiple leases, while `-all` and `-force` are either invalid or overly broad.

Answer

vault lease revoke -prefix <lease_id>

Answer

vault lease revoke -force <lease_id>

Answer

vault lease revoke -all <lease_id>

Question 12

A Vault administrator is building a policy for an application team that needs to manage PKI certificates issued by the 'pki_int' intermediate mount. The team must be able to generate new certificates from the 'web-server' role and revoke certificates, but must not be able to modify the role, generate a root CA, or configure the mount. (Choose two.)

Accepted Answer

path "pki_int/issue/web-server" { capabilities = ["create", "update"] }. Vault PKI separates consuming a role from managing it. Writing to the issue endpoint generates certificates, and writing to the revoke endpoint revokes them, so those two statements cover the operational needs. Role definitions, root generation, and mount configuration are administrative surfaces that must remain outside the team's policy to satisfy the stated restrictions.

Answer

path "pki_int/root/generate/internal" { capabilities = ["create", "update"] }

Answer

path "pki_int/config/*" { capabilities = ["create", "update"] }

Answer

path "pki_int/roles/web-server" { capabilities = ["create", "update"] }

Question 13

A Vault operator is troubleshooting a newly deployed Vault server that is initialized but not yet unsealed. The operator needs to understand which component is responsible for holding the unseal keys and root token during the initialization process. Which statement accurately describes the role of the barrier in Vault's architecture?

Accepted Answer

The barrier is the encryption layer that protects data at rest and must be unsealed using unseal keys before Vault can access storage.. The barrier is Vault's encryption layer that protects data at rest. It must be unsealed using unseal keys (or auto-unseal) to reconstruct the master key and allow Vault to read and write secrets. It is not a network interface, audit log, or auto-unseal mechanism. Understanding the barrier is fundamental to Vault's security model.

Answer

The barrier is the network interface that Vault uses to communicate with the storage backend, and it must be configured with TLS certificates.

Answer

The barrier is the audit log that records all requests and responses, and it must be enabled before unsealing to capture initialization events.

Answer

The barrier is the seal mechanism that automatically unseals Vault when it detects a trusted cloud provider's instance identity.

Question 14

A cloud engineer is scripting against the Vault HTTP API and must authenticate, then read a KV v2 secret, using only `curl`. Which TWO request elements are required for the read to succeed? (Choose two.)

Accepted Answer

A GET to the path `/v1/secret/data/apps/web/config`.. API reads require a valid token in the `X-Vault-Token` header and, for KV v2, a GET to the `/v1//data/` endpoint. The token authorizes the call against policy, while the data endpoint routes to the versioned secret store. Namespace and request-marker headers are situational and not required for a root-namespace read.

Answer

The header `X-Vault-Request: true` on the request.

Answer

A POST to the path `/v1/secret/apps/web/config` with a JSON body.

Answer

The header `X-Vault-Namespace: root` on the request.

Question 15

A security architect is designing a Vault deployment where the root key must never exist in plaintext outside of memory and must be split among five key holders. After initialization, the architect wants to ensure that no single administrator can unseal the vault alone. Which Vault architectural feature directly enforces this requirement?

Accepted Answer

Shamir's Secret Sharing with a threshold greater than one, configured during initialization.. Shamir's Secret Sharing is the core Vault feature that splits the master key into shares and requires a threshold to reconstruct it. By setting a threshold greater than one, the architect ensures that multiple key holders must cooperate to unseal the vault, directly meeting the separation-of-duties requirement.

Answer

Auto-unseal using a cloud KMS, which stores the master key in a hardware security module (HSM).

Answer

The recovery key mechanism, which allows a quorum of operators to generate a new root token.

Answer

Seal Wrap, which encrypts the master key with a hardware-backed key before writing it to storage.