VA-003 Practice Test 23 — 15 Questions

Question 1

A Vault administrator needs to create a policy for a developer who must read and list secrets from the path 'secret/data/engineering/' and create new secrets under 'secret/data/engineering/projects/'. Which two policy statements should the administrator include? (Choose two.)

Accepted Answer

path "secret/data/engineering/projects/*" { capabilities = ["create"] }. The correct statements are A and D. Statement A grants read and list on all secrets under engineering/. Statement D grants create on the projects/ subpath. Other options either have incorrect paths (B, E) or grant unnecessary capabilities (C).

Answer

path "secret/data/engineering/projects/*" { capabilities = ["create","update"] }

Answer

path "secret/data/engineering" { capabilities = ["read","list"] }

Answer

path "secret/engineering/*" { capabilities = ["read","list"] }

Question 2

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Accepted Answer

Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.. Option A is correct because increasing the default lease TTL to 8 hours reduces the frequency of lease renewals, directly addressing the performance issue. Configuring periodic tokens with a short TTL ensures that the token itself still rotates frequently, maintaining security by limiting the window of exposure if a token is compromised. This balances reduced renewal overhead with strong security posture.

Answer

Remove the TTL entirely so that credentials never expire.

Answer

Decrease the default lease TTL from 1 hour to 30 minutes.

Answer

Increase the maximum TTL for the role to 24 hours.

Question 3

A DevOps team needs to provide temporary database credentials to applications without storing long-lived passwords. Which secrets engine should they use?

Accepted Answer

Database secrets engine. The Database secrets engine is designed to generate dynamic, short-lived database credentials on demand, allowing applications to access databases without storing long-lived passwords. It creates unique credentials for each request and automatically revokes them after a configurable TTL, meeting the requirement for temporary access without persistent secrets.

Answer

KV v2 secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 4

A company is migrating from on-premises to cloud and needs to authenticate applications using short-lived credentials. They have a mix of workloads: some on AWS EC2, some on Kubernetes, and some in their own datacenter. Which Vault authentication method provides a unified solution that works across all these environments without requiring a shared secret?

Accepted Answer

JWT/OIDC authentication. JWT/OIDC authentication is the correct choice because it provides a unified, standards-based method for verifying identity across AWS EC2, Kubernetes, and on-premises environments without requiring a shared secret. By leveraging OpenID Connect (OIDC) identity tokens issued by trusted providers (e.g., AWS IAM Identity Center, Kubernetes service account token, or an on-premises IdP), Vault can validate the token's signature and claims to authenticate workloads. This eliminates the need for pre-shared secrets or per-environment-specific integrations, making it ideal for heterogeneous deployments.

Answer

AWS IAM authentication

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 5

An organization uses Vault with the JWT/OIDC authentication method. After configuring the provider, users can authenticate, but the scopes requested do not include the email claim needed for policy mapping. What should the administrator do?

Accepted Answer

Add the 'email' scope to the OIDC auth method config. The email claim is not included in the JWT because the OIDC provider was not requested to issue it. In OIDC, claims are delivered only when the corresponding scope (e.g., 'email') is included in the authentication request. Adding the 'email' scope to the Vault OIDC auth method configuration ensures the provider returns the email claim, which can then be used for policy mapping.

Answer

Add a policy that uses the email claim

Answer

Modify the OIDC provider's configuration in Vault

Answer

Create a custom claim mapping in the OIDC auth method

Question 6

Which TWO of the following are differences between using Vault's token auth method and other auth methods? (Choose two.)

Accepted Answer

Token auth is always enabled and cannot be disabled. Token auth is always enabled and cannot be disabled because it is the core authentication mechanism that Vault uses internally to represent all authenticated sessions. Every other auth method ultimately produces a Vault token, making the token auth method the foundational layer that cannot be removed or turned off without breaking Vault's entire authentication model.

Answer

Token auth does not support policies

Answer

Token auth is the only method that can create periodic tokens

Answer

Token auth cannot be used to create a root token

Question 7

An administrator wants to allow users to authenticate to Vault using their existing corporate GitHub accounts. Which authentication method should be enabled?

Accepted Answer

GitHub. The GitHub authentication method in Vault allows users to authenticate using their existing corporate GitHub accounts by mapping GitHub teams to Vault policies. This is the only option that directly integrates with GitHub's OAuth-based authentication flow, enabling single sign-on without requiring additional directory services or identity providers.

Answer

LDAP

Answer

Okta

Answer

Username & password (userpass)

Question 8

Refer to the exhibit. Which authentication method is currently enabled for production applications?

Accepted Answer

AppRole. The exhibit shows that the production applications are configured with the 'AppRole' authentication method, which is indicated by the presence of a RoleID and SecretID in the application configuration. AppRole is a machine-oriented authentication method in HashiCorp Vault that allows applications to authenticate using a pair of credentials (RoleID and SecretID), making it suitable for automated, non-human workflows. The other methods listed (Token, LDAP, Userpass) are either human-centric or not configured for these applications.

Answer

Token

Answer

LDAP

Answer

Userpass

Question 9

Which THREE authentication methods support generating tokens with TTL and renewable options?

Accepted Answer

Userpass authentication. Userpass authentication (B) is correct because Vault's userpass auth method supports token generation with configurable TTL (time-to-live) and renewable options via the `token_ttl` and `token_renewable` parameters in the auth method configuration or role settings. This allows administrators to enforce session lifetimes and permit token renewal for user accounts authenticated via username/password.

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 10

A Vault administrator needs to allow users to authenticate using their existing corporate Active Directory credentials. The administrator has configured the LDAP authentication method but users cannot log in. The Vault logs show 'LDAP bind successful' but then 'user not found in group' error. What is the most likely issue?

Accepted Answer

The groupfilter or groupattr configuration is incorrect. The error 'LDAP bind successful' confirms that the Vault server can connect and authenticate to the LDAP server using the bind credentials. The subsequent 'user not found in group' error indicates that while the user exists and can bind, the group membership lookup fails. This is most commonly caused by an incorrect `groupfilter` or `groupattr` configuration, which defines how Vault queries the LDAP directory to map users to groups for authorization.

Answer

The LDAP server hostname is incorrect

Answer

The userattr configuration is incorrect

Answer

The LDAP server does not allow anonymous queries

Question 11

A company uses AWS IAM auth for EC2 instances. An instance with an IAM role 'app-role' successfully logs in, but another instance with the same IAM role receives a permission denied error when trying to authenticate. The Vault server and AWS account are healthy. What is the most likely cause?

Accepted Answer

The second instance does not have the IAM role attached to its instance profile. Option A is correct because the second instance likely does not have the IAM role 'app-role' attached to its instance profile. For Vault's AWS IAM auth method, the EC2 instance must have the IAM role attached to its instance profile at launch time; the Vault server uses the instance's credentials (via the instance metadata service) to verify the role. If the role is not attached, the instance cannot present valid credentials for authentication, resulting in a permission denied error even though the Vault server and AWS account are healthy.

Answer

The Vault server's AWS credentials are expired

Answer

The Vault role for AWS auth is configured with a wrong bound IAM role ARN

Answer

The IAM role's trust policy does not allow Vault to assume the role

Question 12

Which TWO of the following are valid authentication methods in HashiCorp Vault? (Choose two.)

Accepted Answer

GitHub. GitHub is a valid authentication method in HashiCorp Vault. It allows users to authenticate using their GitHub personal access tokens, which are mapped to Vault policies based on the user's team membership in a specified GitHub organization. This method is commonly used for integrating Vault with existing GitHub workflows.

Answer

SAML

Answer

RADIUS

Answer

SSH

Question 13

What is the primary purpose of the Vault transit secrets engine?

Accepted Answer

Encryption and decryption as a service. The Vault transit secrets engine is designed to provide encryption and decryption as a service, allowing applications to encrypt and decrypt data without managing cryptographic keys directly. It offloads the cryptographic operations to Vault, which securely stores and rotates the encryption keys, ensuring that plaintext data never leaves the application unencrypted. This enables centralized key management and policy-based access control for encryption operations.

Answer

Token generation

Answer

Certificate management

Answer

Dynamic database credentials

Answer

Secure storage of secrets

Question 14

A security engineer needs to ensure that if a key is compromised, previous ciphertext can be re-encrypted with a new key version without exposing the plaintext. Which Vault operation should they use?

Accepted Answer

Rewrap. The Rewrap operation in Vault allows a ciphertext to be decrypted with the current key version and re-encrypted with a new key version without exposing the plaintext to the caller. This ensures that if a key is compromised, previous ciphertext can be rotated to a new key version while maintaining data confidentiality.

Answer

Rotate

Answer

Encode

Answer

Transform

Answer

Rekey

Question 15

An administrator is reviewing Vault token policies and wants to ensure that tokens created by a specific application cannot be renewed and have a fixed lifetime. Which two token configurations should be applied?

Accepted Answer

Set renewable to false.. To prevent renewal and fix the lifetime, set 'explicit_max_ttl' to the desired maximum TTL (which cannot be extended) and set 'renewable' to false so that renewal is not allowed. Option B (max_ttl) is a limit but doesn't prevent renewal, Option D (ttl=0) is not valid, and Option E (no_default_policy) is unrelated.

Answer

Set max_ttl on the role to a very large value.

Answer

Set ttl on the token to 0.

Answer

Set no_default_policy to true.