VA-003 Practice Test 24 — 15 Questions

Question 1

A Vault administrator is configuring a new Vault cluster with Integrated Storage (Raft). The administrator wants to ensure that the cluster can tolerate the failure of one node without data loss and that writes remain available. What is the minimum number of nodes required, and what is the recommended configuration for high availability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Three nodes, with one active and two standby nodes, because Raft requires a quorum of (N/2)+1 nodes to commit writes.. For a Vault cluster using Integrated Storage (Raft) to tolerate one node failure and maintain write availability, a minimum of three nodes is required. Raft uses a quorum of (N/2)+1 nodes to commit writes; with three nodes, a quorum is two, so one failure is tolerated. One node acts as the active leader, and the others are standbys.

Answer

Two nodes, with one active and one standby, because Raft only needs a majority to elect a leader and two nodes provide a majority if one fails.

Answer

One node, because Integrated Storage (Raft) can operate in a single-node cluster and still provide high availability through automatic failover to a standby.

Answer

Five nodes, with one active and four standby, because Raft requires an odd number of nodes and five is the minimum for production.

Question 2

A Vault operator discovers that a service account token was compromised, and that token had created several dynamic database credentials across multiple roles. The operator needs to invalidate every lease created by that token as quickly as possible rather than waiting for each lease to expire. Which action accomplishes this?

Accepted Answer

Revoke the compromised token, which also revokes the leases that were created by that token.. Revoking a token causes Vault to revoke the leases created by that token, providing precise containment for a compromised identity. This targets only the credentials spawned by the leaked token while leaving unrelated leases intact. More disruptive actions such as revoking the mount or sealing the cluster are unnecessary and cause collateral impact.

Answer

Seal the Vault cluster, which revokes all outstanding leases cluster-wide and requires unsealing afterward.

Answer

Revoke the database secrets engine mount, which forcibly expires all credentials issued from any token.

Answer

Rotate the database root credentials, which immediately invalidates every dynamic credential in the database.

Question 3

A security architect is designing a system where one microservice writes encrypted records and a separate reporting microservice reads them. The architect wants the writer to be unable to decrypt anything, while the reader can decrypt but cannot create new ciphertext. Which Vault policy design achieves this with the transit engine?

Accepted Answer

Grant the writer update on transit/encrypt/orders and the reader update on transit/decrypt/orders.. Transit authorizes each operation by path, so splitting update on the encrypt path for the writer and update on the decrypt path for the reader enforces the desired asymmetry. The writer can only produce ciphertext and the reader can only recover plaintext, neither gaining the other's ability. Managing keys or sharing a combined token would grant broader capability than the design intends.

Answer

Grant both services a shared token with a policy allowing update on transit/encrypt/orders and transit/decrypt/orders.

Answer

Grant both services update on transit/keys/orders and let the application decide which operation to call.

Answer

Grant the writer read on transit/encrypt/orders and the reader read on transit/decrypt/orders.

Question 4

A platform team must let a batch job encrypt large files, up to several gigabytes each, using Vault transit. Sending entire files to Vault would exhaust request size limits and add latency. Which approach correctly uses the transit engine while keeping key material inside Vault?

Accepted Answer

Generate a data key with `transit/datakey/plaintext/<key>`, encrypt the file locally with that data key, and store the returned wrapped key alongside the ciphertext.. For large payloads, Vault recommends envelope encryption: the transit engine generates a data key, the application encrypts the file locally with that data key, and only the wrapped data key is stored or transmitted. The wrapping key remains inside Vault and is used later to unwrap the data key for decryption. Sending whole files to transit, exporting key material, or misusing rewrap all fail the size, security, or correctness requirements.

Answer

Enable `exportable=true` on the transit key, export it, and use the exported key material to encrypt files locally.

Answer

Use `transit/rewrap` to convert the plaintext file into ciphertext in a single call.

Answer

Call `transit/encrypt/<key>` once per file and pass the file bytes base64-encoded in the request body.

Question 5

A payment processing team needs an application to encrypt transaction payloads without ever handling the raw encryption key material. The application will call Vault over mTLS, and the security team insists that the plaintext never leave the application process. Which Vault capability best satisfies this requirement?

Accepted Answer

The transit secrets engine's encrypt endpoint, where Vault performs the cryptographic operation and returns ciphertext to the caller.. Encryption as a service means the cryptographic operation happens inside Vault, so key material never leaves the trusted boundary. The transit engine's encrypt endpoint accepts plaintext, applies the named key, and returns ciphertext, letting the application satisfy the requirement without ever seeing the key. Static secret storage, certificate issuance, and response wrapping all leave the application responsible for the actual encryption step.

Answer

The kv secrets engine storing the encryption key as a versioned secret so the application can retrieve and use it locally.

Answer

The pki secrets engine issuing client certificates so the application can establish its own TLS session and encrypt payloads.

Answer

Vault's key/value version 2 engine with response wrapping, which protects the key while it is delivered to the application.

Question 6

A Vault administrator is configuring a new Vault server and wants to ensure that audit logs capture every request and response, including the ability to detect tampering. Which Vault architectural component is responsible for providing this capability?

Accepted Answer

The audit device, which is configured with a type such as file or syslog and logs all requests and responses.. Audit devices are specifically designed to log every request and response that passes through Vault. They support multiple backends and include HMAC hashing to protect sensitive values while still allowing verification. Enabling at least one audit device is a best practice for production, and it is the only component that provides the described logging and tamper-evidence.

Answer

The seal/unseal process, which records all administrative actions during unsealing.

Answer

The barrier, which encrypts audit data before writing it to the storage backend.

Answer

The storage backend, which persists all audit entries in an encrypted log.

Question 7

A Vault operator is examining the architecture of a Vault cluster and wants to understand how client requests are routed to the active node. Which component is responsible for forwarding requests from standby nodes to the active node?

Accepted Answer

The standby nodes automatically forward client requests to the active node using the cluster's internal forwarding mechanism.. Standby nodes in a Vault HA cluster forward client requests to the active node using Vault's internal forwarding mechanism. This allows clients to connect to any node, simplifying configuration and improving availability. The active node processes the request and returns the response through the standby node.

Answer

The storage backend, such as Integrated Storage (Raft), handles request forwarding between nodes.

Answer

The load balancer must be configured to route all requests only to the active node, as standby nodes cannot forward requests.

Answer

The active node polls standby nodes for pending requests and pulls them for processing.

Question 8

An application encrypts records with the transit engine and stores the ciphertext. A compliance requirement mandates rotating the encryption key every 90 days, but the existing records must remain readable and the application cannot be changed to re-encrypt them all at once. What should the operator do?

Accepted Answer

Rotate the key on schedule; existing ciphertext remains decryptable because old key versions are retained, and optionally rewrap records over time.. Rotating the existing transit key satisfies the 90-day requirement because encryption begins using a new key version while prior versions remain available for decryption, so existing records stay readable without application changes. Rewrap can then migrate stored ciphertext to the newest version at a controlled pace, avoiding a disruptive bulk re-encryption.

Answer

Export the key material, rotate it externally, then import the rotated key back so Vault can continue decrypting old records.

Answer

Create a brand-new transit key each quarter and update the application to reference the new key name for all reads and writes.

Answer

Delete the current key and recreate it with the same name so that the name stays stable while the underlying material changes.

Question 9

A Vault cluster uses a Consul storage backend. During a maintenance window, the Consul cluster is taken offline for upgrades. Vault nodes remain running but become unresponsive. After Consul is restored, Vault nodes resume normal operation without manual intervention. Which Vault architectural property explains this behavior?

Accepted Answer

Vault treats the storage backend as a dependency and will resume normal operation once the backend is reachable again, without requiring a restart.. Vault's architecture treats the storage backend as an external dependency. When the backend is unavailable, Vault cannot perform operations that require storage access, leading to unresponsiveness. Once the backend is restored, Vault reconnects and resumes without manual intervention, as long as the backend data is intact and Vault remains unsealed.

Answer

Vault uses the storage backend only for persistence and can operate independently once unsealed.

Answer

Vault caches all secrets in memory, so it can continue serving requests during a storage outage.

Answer

Vault automatically switches to a local file storage backend when the primary backend is unavailable.

Question 10

A Vault administrator is explaining the role of the storage backend in Vault's architecture. A new team member asks where Vault stores its encrypted data and what the storage backend is responsible for. Which statement accurately describes the storage backend's role?

Accepted Answer

The storage backend stores encrypted data and provides durability, but it does not perform encryption or decryption.. Vault's storage backend is responsible for durably storing encrypted data. It does not perform encryption, decryption, or key management; those are handled by Vault's security barrier and core. The backend simply persists the ciphertext. This design allows Vault to support various storage backends like Integrated Storage, Consul, or file, while maintaining a consistent security model. The separation of concerns ensures that storage compromise does not lead to data exposure.

Answer

The storage backend provides authentication and authorization services for Vault clients.

Answer

The storage backend is responsible for encrypting and decrypting data before it is written to disk.

Answer

The storage backend manages the unseal keys and distributes them to Vault nodes during initialization.

Question 11

A Vault administrator is reviewing token behaviors and needs to understand which actions are possible with a token's accessor. Which two statements about token accessors are true? (Choose two.)

Accepted Answer

An accessor can be used to revoke the token.. Token accessors provide a way to manage tokens without exposing the token string. They can be used to look up a token's metadata and to revoke the token. They cannot be used to renew the token, create child tokens, or authenticate to Vault. This design allows administrators to audit and revoke tokens while minimizing the risk of token leakage. The correct statements are that an accessor can be used for lookup and for revocation.

Answer

An accessor can be used to create child tokens with the same policies.

Answer

An accessor can be used to renew the token if the token is renewable.

Answer

An accessor can be used to authenticate to Vault and access secrets.

Question 12

A Vault administrator is writing a policy that uses a templated path to allow each user to access their own secrets. The policy is:

path "secret/data/users/{{identity.entity.id}}/*" {
  capabilities = ["read", "list"]
}

When a user with entity ID "1234" attempts to read 'secret/data/users/1234/profile', they receive a permission denied error. The secret exists, and the user's token has this policy attached. What is the most likely reason for the failure?

Accepted Answer

The policy path uses 'identity.entity.id' but the token is not associated with an entity, so the template cannot be resolved.. Templated policies require the token to be associated with an entity. If the token lacks an entity association, the template variable cannot be resolved, and Vault denies access. The user must have an entity in the identity store, and the token must be linked to that entity. This is a common oversight when using templated policies.

Answer

Templated policies are only supported in Vault Enterprise, not in Vault Open Source.

Answer

The template variable 'identity.entity.id' is incorrect; it should be 'identity.entity.id' without the curly braces.

Answer

The policy must use 'identity.entity.name' instead of 'identity.entity.id' to match the user's entity ID.

Question 13

An application stores ciphertext produced by a Vault transit key named `orders` in a database. The security team rotates the key with `vault write -f transit/keys/orders/rotate`. After rotation, the application reports that decryption of previously stored records fails. The key was never deleted or reconfigured. What is the most likely cause?

Accepted Answer

The application stripped or altered the `vault:vN:` version prefix from the stored ciphertext.. Transit ciphertext embeds the key version in a prefix like `vault:v1:`, and Vault relies on that prefix to choose which key version decrypts the data. Rotation adds a new version without invalidating old ones, so decryption normally continues to work. When it fails after rotation while the key still exists, the prefix has usually been stripped or corrupted in storage, removing Vault's ability to identify the correct version.

Answer

The application must re-encrypt all existing records with the new key version before decryption is possible.

Answer

The application is decrypting with the wrong key name because rotation renamed the key.

Answer

Rotation automatically deletes the previous key version, so old ciphertext can never be decrypted.

Question 14

A company's CI system runs outside any cloud provider and must authenticate to Vault without embedding a long-lived secret in its build scripts. The security team wants the CI job to prove its identity using a credential that Vault validates against the CI platform itself. Which auth method best fits this requirement?

Accepted Answer

JWT/OIDC auth method. JWT/OIDC auth is the right fit because the CI platform can mint a short-lived signed JWT that Vault validates against the platform's keys, proving the job's identity without a stored static secret. Userpass and token auth both require long-lived credentials, and cert auth relies on a stored client certificate rather than a platform-issued token.

Answer

Token auth method

Answer

Cert auth method

Answer

Userpass auth method

Question 15

An application stores user profile documents in a database and must encrypt field values with Vault's transit engine. A reviewer notes that anyone with the application's token could still send arbitrary ciphertext to the decrypt endpoint and read the result. The team wants to limit blast radius if the token leaks. Which transit engine capability best reduces this risk?

Accepted Answer

Use a Vault policy that grants only 'encrypt' capability on the key path, and issue decrypt rights to a separate, more tightly scoped identity.. The transit engine authorizes each endpoint path independently, so a token can be given encrypt-only rights. That means a leaked application token cannot decrypt stored ciphertext, and decryption can be reserved for a separate identity. Exporting keys or relying on post-hoc auditing does not prevent the misuse the reviewer described.

Answer

Set a short TTL on the transit key so it expires and can no longer decrypt.

Answer

Rely on the audit log to detect misuse after the fact and alert on decrypt calls from unexpected tokens.

Answer

Enable 'exportable=true' so the team can move the key to a hardware security module and remove it from Vault.