VA-003 Practice Test 23 — 15 Questions

Question 1

An organization has two Vault clusters in different geographic regions and wants to replicate secrets from the primary cluster to the secondary cluster for disaster recovery. Which Vault replication feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disaster Recovery (DR) replication. Disaster Recovery (DR) replication is the correct Vault feature for replicating secrets from a primary cluster to a secondary cluster in a different geographic region for disaster recovery. DR replication copies all data, including secrets, policies, and tokens, in a one-way direction from primary to secondary, ensuring the secondary cluster can be promoted if the primary fails. This is distinct from performance replication, which is designed for load distribution and allows writes on both sides.

Answer

Cluster replication

Answer

Active Directory replication

Answer

Performance replication

Question 2

Which THREE operations does the transit secrets engine support?

Accepted Answer

Encrypt data using a named key. The transit secrets engine in Vault is designed to perform cryptographic operations on data in transit, and encrypting data using a named key is one of its primary supported operations. The engine allows you to encrypt plaintext with a specified key, returning ciphertext that can later be decrypted using the same key.

Answer

Generate a new key in an external KMS

Answer

Generate a hash using SHA256

Question 3

A company is using the PKI secrets engine to issue certificates for internal services. They want to ensure that certificates are automatically revoked if a service is decommissioned. What should they implement?

Accepted Answer

Use Vault's built-in lifecycle management and revocation capabilities.. Vault's PKI secrets engine includes built-in lifecycle management that can automatically revoke certificates when a lease expires or when a secret is deleted via the API. This allows you to tie certificate validity to the service's lifecycle in Vault, ensuring decommissioned services have their certificates revoked without manual intervention.

Answer

Implement certificate pinning in all services.

Answer

Set a very short TTL on certificates so they expire quickly.

Answer

Configure a Certificate Revocation List (CRL) that clients check.

Question 4

Refer to the exhibit. Based on this policy, which actions can the associated token perform? (Assume all paths exist.)

Accepted Answer

Create, read, update, delete keys; encrypt and decrypt data.. The exhibit shows a policy that grants the 'manage' capability on a key, which in Vault (the implied technology) includes create, read, update, and delete operations. Additionally, the policy includes 'encrypt' and 'decrypt' capabilities, allowing the token to perform both key management and cryptographic operations. Therefore, the token can create, read, update, delete keys, and encrypt/decrypt data.

Answer

Only encrypt and decrypt data.

Answer

Create and read keys, encrypt and decrypt data.

Answer

Only manage keys, not encrypt/decrypt.

Answer

Create keys only.

Question 5

Which TWO methods can be used to revoke a token without knowing the token ID?

Accepted Answer

Using `vault token revoke -mode path` on the auth mount.. `vault token revoke -mode path` allows revocation of all tokens issued by a specific auth mount (e.g., `userpass/` or `ldap/`) without needing individual token IDs. This method uses the mount's accessor path to revoke all tokens associated with that mount, effectively cleaning up tokens in bulk when their IDs are unknown.

Answer

Using the token's role name if it has one.

Answer

Using the token's policy name.

Answer

Using the token's creation time.

Question 6

Which TWO of the following Vault CLI commands can be used to write data to Vault?

Accepted Answer

vault write. `vault write` is the primary Vault CLI command for writing data directly to a specified path, including secrets, policies, or configuration. Option E is correct because `vault kv put` is the dedicated command for writing key-value pairs to the KV secrets engine, which is a common use case for storing secret data.

Answer

vault set

Answer

vault put

Answer

vault push

Question 7

An administrator wants to retrieve the value of a secret stored at the path 'kv/secret/mykey' using the Vault CLI. Which command should they use?

Accepted Answer

vault read kv/secret/mykey. The correct command to retrieve a secret from Vault's KV secrets engine is `vault read`. This command is used to read data and metadata from a specified path. Option D is correct because `vault read kv/secret/mykey` will retrieve the value stored at that path, assuming the KV engine is mounted at `kv/`.

Answer

vault get kv/secret/mykey

Answer

vault retrieve kv/secret/mykey

Answer

vault show kv/secret/mykey

Question 8

Based on the exhibit, what is the maximum lifetime of this token?

Accepted Answer

The token will expire at expire_time unless renewed. The token will expire at the absolute timestamp shown in `expire_time` unless it is renewed before that time. While `max_ttl` (not displayed in the exhibit) defines the absolute maximum lifetime if the token is repeatedly renewed, the token's current expiration is `expire_time`. Therefore, given the options, the token will expire at that time unless renewed.

Answer

720 hours

Answer

The max TTL is shown as 'ttl' and cannot exceed that

Answer

The token is valid indefinitely because it is renewable

Question 9

Refer to the exhibit. Which authentication method is currently enabled for production applications?

Accepted Answer

AppRole. The exhibit shows that the production applications are configured with the 'AppRole' authentication method, which is indicated by the presence of a RoleID and SecretID in the application configuration. AppRole is a machine-oriented authentication method in HashiCorp Vault that allows applications to authenticate using a pair of credentials (RoleID and SecretID), making it suitable for automated, non-human workflows. The other methods listed (Token, LDAP, Userpass) are either human-centric or not configured for these applications.

Answer

Token

Answer

LDAP

Answer

Userpass

Question 10

A token has the properties shown in the exhibit. A user attempts to use this token to write a secret to 'secret/data/myapp'. The token fails with a permission denied error. What is the most likely cause?

Accepted Answer

The token's policies do not grant write capability on the target path.. The token's policies define the access control rules for paths in Vault. Since the user received a permission denied error when attempting to write to 'secret/data/myapp', the most likely cause is that the token's attached policies do not include a 'write' or 'create' capability on that specific path. Policies are evaluated based on the path and the requested operation, and without the appropriate capability, the request is denied regardless of other token properties.

Answer

The token has an explicit max TTL of 0s, which prevents write operations.

Answer

The token is a service token but the write operation requires a batch token.

Answer

The token is orphaned, so it cannot be used for write operations.

Question 11

A Vault administrator wants to ensure that when a parent token is revoked, all child tokens are also automatically revoked. Which option should they use?

Accepted Answer

Use the 'cascade=true' parameter when revoking the parent token. Vault's token revocation system supports a 'cascade' parameter that, when set to 'true', ensures that revoking a parent token also revokes all its child tokens. This is the intended mechanism for hierarchical token cleanup, as child tokens are tracked via the parent token's accessor and are recursively invalidated.

Answer

Use the 'force' parameter when revoking the parent token

Answer

Revoke the parent token using the 'revoke-orphan' endpoint

Answer

Set the parent token's orphan property to 'false'

Question 12

A company uses Vault for secrets management. They want to authenticate using GitHub tokens, but only for users who are members of a specific GitHub team. What must be configured?

Accepted Answer

Map the GitHub team to a Vault policy in the auth method configuration.. Vault's GitHub auth method requires mapping GitHub teams to Vault policies. When a user authenticates with a GitHub personal access token, Vault checks the token's associated teams against the configured team-to-policy mappings. Only users belonging to a mapped team receive the corresponding Vault policy, enabling access control based on team membership.

Answer

Vault validates the token's scope.

Answer

Users must generate a personal access token with repo scope.

Answer

The GitHub token must include the team scope.

Question 13

The CLI command returns a 403 error. What is the most likely cause?

Accepted Answer

The token does not have a policy allowing read on 'database/creds/readonly'. A 403 Forbidden error from Vault indicates that the request was authenticated (the token is valid) but the token's policies do not grant permission for the requested action. Since the command attempts to read from 'database/creds/readonly', the most likely cause is that the token lacks a policy allowing read access on that path. This is a standard authorization failure, not an authentication or configuration issue.

Answer

The role 'readonly' does not exist

Answer

The database secrets engine is not mounted at 'database/'

Answer

The field 'value' does not exist in the secret

Question 14

A company uses AWS IAM auth for EC2 instances. An instance with an IAM role 'app-role' successfully logs in, but another instance with the same IAM role receives a permission denied error when trying to authenticate. The Vault server and AWS account are healthy. What is the most likely cause?

Accepted Answer

The second instance does not have the IAM role attached to its instance profile. The second instance likely does not have the IAM role 'app-role' attached to its instance profile. For Vault's AWS IAM auth method, the EC2 instance must have the IAM role attached to its instance profile at launch time; the Vault server uses the instance's credentials (via the instance metadata service) to verify the role. If the role is not attached, the instance cannot present valid credentials for authentication, resulting in a permission denied error even though the Vault server and AWS account are healthy.

Answer

The Vault server's AWS credentials are expired

Answer

The Vault role for AWS auth is configured with a wrong bound IAM role ARN

Answer

The IAM role's trust policy does not allow Vault to assume the role

Question 15

A company has multiple AWS accounts and wants to allow EC2 instances to authenticate to Vault without storing any secrets on the instances. Which authentication method should they use?

Accepted Answer

AWS. (AWS) is correct because the AWS authentication method in Vault allows EC2 instances to authenticate using their AWS instance identity documents and PKCS#7 signatures, without requiring any long-lived secrets to be stored on the instances. Vault verifies the instance's identity by calling the AWS EC2 API to validate the document and signature, then binds the instance to a Vault role. This eliminates the need to store tokens or credentials on the instance, meeting the requirement of secretless authentication.

Answer

OIDC

Answer

TLS Certificates

Answer

AppRole