VA-003 Practice Test 24 — 15 Questions

Question 1

A company uses Vault to manage SSH OTP credentials. They set the role with default_ttl=5m and max_ttl=30m. Users report that they receive an error when trying to renew the OTP after 10 minutes. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The OTP key is only valid for one-time use and cannot be renewed.. Vault SSH OTP credentials are designed for one-time use: the OTP is generated, used to authenticate an SSH session, and then immediately invalidated. Once the OTP has been used, it cannot be renewed because the lease is tied to a credential that has already been consumed. The error after 10 minutes occurs because the OTP was used within that window, making renewal impossible regardless of TTL settings.

Answer

The renewable flag is set to false on the role.

Answer

The user's token does not have permission to renew leases.

Answer

The max_ttl of 30m is reached, but the OTP has already been used.

Question 2

A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?

Accepted Answer

Migrate users to an external identity provider and use LDAP or OIDC auth.. The Userpass auth method in Vault does not natively support password complexity or expiration policies. Migrating to an external identity provider (IdP) via LDAP or OIDC allows the organization to enforce these policies externally, where they are natively supported, and then federate authentication into Vault. This approach leverages the IdP's mature password management capabilities while maintaining Vault's authorization and audit controls.

Answer

Switch to token-based authentication and issue tokens with TTL.

Answer

Use Vault's password policy plugin with Userpass.

Answer

Configure password policies in Vault's Userpass auth method.

Question 3

A company wants to use Vault's Key Management Secrets Engine (KMSE) to encrypt data stored in AWS S3. The security team requires that the encryption key used by Vault is never exposed to the application. Which Vault architecture component ensures that the encryption key remains within the Vault boundary and is not accessible to the application?

Accepted Answer

Vault's Transit Secrets Engine. Transit Secrets Engine performs encryption/decryption using keys stored entirely within Vault. The application sends data to Vault, which processes it with the key and returns the result, ensuring the key is never exposed. KMSE (B) delegates key storage to an external KMS, placing the key outside Vault's boundary, which contradicts the requirement that the key remains within Vault.

Answer

Vault's Cubbyhole Response Wrapping

Answer

Vault's Key Management Secrets Engine (KMSE)

Answer

Vault's PKI Secrets Engine

Question 4

An operator needs to create a periodic token with a period of 36 hours. Which command should they use?

Accepted Answer

vault token create -period=36h. The `vault token create -period=36h` command creates a periodic token with a specified renewal period of 36 hours. Periodic tokens have no explicit TTL; their lifetime is tied to the renewal period, and they can be renewed indefinitely as long as the parent token is valid. This matches the requirement for a token that automatically extends its lifetime every 36 hours.

Answer

vault token create -period=36h -explicit-max-ttl=36h

Answer

vault token create -ttl=36h

Answer

vault token create -explicit-max-ttl=36h

Question 5

A company is migrating from a file storage backend to Consul. Which Vault command should be used to move the data?

Accepted Answer

vault operator migrate. The `vault operator migrate` command is specifically designed to move Vault data from one storage backend to another, such as from a file storage backend to Consul. It handles the safe transfer of all encrypted data, including secrets, policies, and tokens, while ensuring consistency and minimal downtime during the migration process.

Answer

vault operator rekey

Answer

vault operator unseal

Answer

vault operator init

Question 6

Which THREE are requirements for a Vault High Availability (HA) cluster?

Accepted Answer

A shared storage backend accessible by all nodes.. Vault HA clusters require a shared storage backend (e.g., Consul, Integrated Storage, or Raft) that all nodes can access to maintain consistent state. Without shared storage, standby nodes cannot synchronize data or take over seamlessly if the active node fails.

Answer

Standby nodes must be able to serve read requests.

Answer

A load balancer in front of all nodes.

Question 7

A Vault administrator needs to manage leases for dynamic secrets. Which TWO of the following are valid operations related to lease management?

Accepted Answer

Call the sys/leases/renew endpoint to renew a lease.. The `sys/leases/renew` endpoint is the standard Vault API endpoint used to renew the lease of a dynamic secret, extending its time-to-live (TTL) within the maximum allowed limit. Option C is correct because the `sys/leases/revoke` endpoint is the designated API endpoint to immediately invalidate a lease and its associated secret, preventing further use and cleaning up the secret engine's state.

Answer

Call the sys/leases/list endpoint to disable a lease.

Answer

Call the sys/leases/extend endpoint to increase the lease duration.

Answer

Call the sys/leases/rotate endpoint to rotate the secret associated with a lease.

Question 8

Refer to the exhibit. A Vault policy allows 'list' on 'secret/data/*'. A user tries to list keys under 'secret/data/' and gets a permission denied error. What is the most likely reason?

Accepted Answer

The path must be 'secret/metadata/*' for list. C is correct because in Vault, listing keys under a KV v2 secrets engine requires the 'list' capability on the 'secret/metadata/*' path, not 'secret/data/*'. The 'data' path is used for reading and writing actual secret values, while 'metadata' is the correct path for listing and deleting metadata (including key names). The policy only grants 'list' on 'secret/data/*', which does not cover the list operation on the metadata endpoint, resulting in a permission denied error.

Answer

The user's token has no default policy

Answer

The policy lacks 'read' capability

Answer

The secrets engine is not enabled

Question 9

Which TWO components are required for Vault to process client requests after startup?

Accepted Answer

Unseal key shares. C is correct because Vault starts in a sealed state and requires a threshold of unseal key shares to reconstruct the master key and decrypt the storage backend. Without unsealing, Vault cannot access any data or process client requests. E is correct because an enabled auth method is necessary to authenticate clients; Vault rejects all unauthenticated requests by default.

Answer

Audit Device

Answer

A policy

Answer

A secrets engine

Question 10

Refer to the exhibit. Based on the policy shown, which statement is true?

Accepted Answer

A user can read all secrets under secret/data/engineering/.. The policy shown grants 'read' capability on the path 'secret/data/engineering/*'. In Vault, the 'read' capability allows listing and reading secrets at that path, but not creating, updating, or deleting them. Therefore, a user can read all secrets under secret/data/engineering/.

Answer

A user can create secrets under secret/data/engineering/.

Answer

A user can delete secrets under secret/data/engineering/.

Answer

A user can update secrets under secret/data/engineering/.

Question 11

A company with strict security requirements uses Vault's Transit secrets engine to encrypt data in a microservices architecture. They have multiple applications that each require a unique encryption key. The security team wants to enforce key rotation every 30 days for all keys, and also require that keys be destroyed after they are no longer used. The application team is concerned that key rotation might cause downtime because applications need to re-encrypt data. The Vault architect needs to design a key management solution. What is the best approach?

Accepted Answer

Use the Transit engine's key rotation capability with versioning and configure applications to use the latest key version for encryption, while keeping old versions for decryption.. Vault's Transit secrets engine supports key rotation with versioning, where each rotation creates a new key version while retaining older versions for decryption. This allows applications to always encrypt using the latest version (via the `encrypt` endpoint) and decrypt using any previous version (via the `decrypt` endpoint), ensuring zero downtime during rotation. The security team's requirement for key destruction after disuse can be met by trimming or deleting old key versions once all data encrypted with them is re-encrypted.

Answer

Manually rotate keys every 30 days and update applications with new key IDs.

Answer

Set the key TTL to 30 days and configure Vault to automatically re-encrypt data when keys are rotated.

Answer

Use a single key for all applications and rotate it by creating a new key and deleting the old one.

Question 12

A developer wants to encrypt data using Vault's transit engine with a key named 'payment-key'. The key already exists and is set to allow encryption. Which API path should the developer use to encrypt the data?

Accepted Answer

POST /v1/transit/encrypt/payment-key. The Vault transit engine exposes the `/v1/transit/encrypt/<key_name>` endpoint for encrypting plaintext data using a named encryption key. Since the key 'payment-key' already exists and is allowed to encrypt, a POST request to this path will perform the encryption operation and return the ciphertext.

Answer

POST /v1/transit/decrypt/payment-key

Answer

POST /v1/transit/rewrap/payment-key

Answer

POST /v1/transit/keys/payment-key

Question 13

A security policy requires that all leases must be revoked within 1 hour of creation. Which setting should be configured on the secret engine mount?

Accepted Answer

default_lease_ttl = 1h and max_lease_ttl = 1h. The security policy requires that all leases must be revoked within 1 hour of creation, meaning no lease can exceed 1 hour. The `default_lease_ttl` sets the initial TTL for leases when no specific TTL is provided, and the `max_lease_ttl` enforces an absolute upper limit that no lease can exceed. Configuring both to 1h ensures that every lease starts with a 1-hour TTL and cannot be renewed or extended beyond that hard cap, guaranteeing revocation within 1 hour.

Answer

default_lease_ttl = 1h

Answer

token_ttl = 1h

Answer

max_lease_ttl = 1h

Question 14

A company runs a microservices architecture where each service authenticates to Vault using AppRole and is assigned a role with a periodic token. The operations team notices that some services experience authentication failures after exactly 24 hours of uptime, even though their tokens were initially issued with a TTL of 24 hours and 'renewable' set to true. The services are configured to renew their tokens automatically before expiry. Upon investigation, the Vault logs show the error: 'failed to renew token: token has exceeded its max TTL'. The Vault server is configured with a default 'max_lease_ttl' of 24 hours and a 'default_lease_ttl' of 1 hour at the system level. The AppRole role has no explicit TTL or max TTL set. What is the most likely cause of the failure?

Accepted Answer

The periodic token's max TTL is set by the system's 'max_lease_ttl' of 24 hours, and once that time is reached, renewal is no longer allowed.. The periodic token's max TTL is derived from the system's 'max_lease_ttl' of 24 hours when no explicit max TTL is set on the AppRole role. Even though the token is renewable and the services attempt to renew before expiry, the token cannot be renewed once its cumulative lifetime reaches the max TTL of 24 hours, causing the 'token has exceeded its max TTL' error. The periodic token's TTL is reset on each renewal, but the max TTL is a hard limit on the total lifespan of the token.

Answer

The token's lease duration is actually 1 hour (the default) and the services fail to renew before expiry.

Answer

The AppRole role has an implicit max TTL of 0, which prevents any renewal after the initial TTL.

Answer

The services are not renewing their tokens because the 'renewable' flag is ignored by periodic tokens.

Question 15

A development team is building a microservices application that needs to encrypt sensitive customer data before storing it in a shared database. They want to minimize changes to their existing code and avoid managing encryption keys themselves. Which Vault feature should they use?

Accepted Answer

Vault's Transit secrets engine. The Transit secrets engine is designed for encryption-as-a-service, allowing applications to encrypt data without exposing encryption keys to the application code. It performs encryption and decryption operations on the Vault server, so the development team can minimize code changes and avoid managing keys themselves.

Answer

Vault's Database secrets engine

Answer

Vault's PKI secrets engine

Answer

Vault's Key Management Secrets Engine