VA-003 Practice Test 25 — 15 Questions

Question 1

A Vault administrator is investigating a production incident where an application's dynamic database credentials stopped working earlier than expected, even though the lease had not reached its maximum TTL. The administrator reviews the role configuration and finds default_ttl=1h and max_ttl=24h. The application typically renews its lease every 30 minutes. Which factor most likely explains why the credentials became invalid before max_ttl was reached?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The underlying database user's password was rotated or the user was dropped outside of Vault, invalidating the credential independently of the lease.. Vault leases govern Vault-side lifecycle, but the credential's validity in the target system is separate. If a database administrator rotates the password or removes the user outside Vault, the credential stops working even though the Vault lease is still active and renewable. This mismatch between Vault lease state and external system state is a common cause of premature credential failure.

Answer

Vault's max_ttl of 24h was reached because the application renewed too frequently, exhausting the lease budget.

Answer

The application's Vault token expired, so Vault automatically revoked all leases created by that token.

Answer

The default_ttl of 1h caused Vault to revoke the credential after one hour regardless of renewals.

Question 2

A security team is configuring the AWS secrets engine to issue dynamic IAM credentials. They want to allow Vault to assume an IAM role and generate temporary credentials for consumers. Which TWO configuration elements are required to enable this workflow? (Choose two.)

Accepted Answer

Create a role of type 'assumed_role' that specifies the ARN of the IAM role Vault should assume.. To issue dynamic IAM credentials with the AWS secrets engine, Vault needs AWS credentials with the right permissions and a role that defines what to create or assume. For assumed_role, the role specifies the target IAM role ARN and Vault calls sts:AssumeRole. AWS auth, sudo policies, and KV v2 storage are not prerequisites for this secrets engine workflow.

Answer

Enable the AWS auth method and bind an IAM principal to a Vault policy before creating the role.

Answer

Enable the KV v2 secrets engine and store the AWS access key and secret key as a static secret.

Answer

Create a Vault policy that grants 'sudo' capability on the AWS secrets engine role path.

Question 3

An operator has authenticated to Vault and wants to inspect the metadata of the currently active token, including its accessor, policies, and creation time, without exposing the token's secret value. Which CLI command returns this information?

Accepted Answer

vault token lookup. `vault token lookup` without arguments queries the token auth method's lookup-self endpoint and returns metadata for the token in use, including accessor, policies, TTL, and creation time. It deliberately omits the token's secret value, so an operator can audit the active session safely. Other token subcommands perform renewal, capability checks, or creation instead.

Answer

vault token renew

Answer

vault read auth/token/lookup-self

Answer

vault token capabilities

Question 4

A security engineer creates a service token with a TTL of 1 hour and a max TTL of 4 hours. The token is used by an application that renews it every 30 minutes. After 3 hours, the engineer revokes the token using its accessor. What happens to the token's child tokens?

Accepted Answer

All child tokens are immediately revoked.. Revoking a token in Vault triggers a cascading revocation of all its child tokens. This behavior ensures that compromised or expired parent tokens do not leave valid child tokens that could be used for unauthorized access. The accessor allows revocation without knowing the token ID, but the effect on children remains the same.

Answer

Child tokens are revoked only if they have no other parent.

Answer

Child tokens are orphaned and become root tokens.

Answer

Child tokens remain valid until their own TTLs expire.

Question 5

A developer wants to log in to Vault from a terminal by supplying a username and password that Vault stores and manages internally, without relying on any external identity system. Which auth method should be enabled?

Accepted Answer

Userpass auth method. Userpass keeps user records and password hashes within Vault, so it delivers exactly the self-contained username and password login described. LDAP and OIDC both depend on external systems, and token auth only consumes a pre-existing token rather than authenticating a user with credentials.

Answer

Token auth method

Answer

OIDC auth method

Answer

LDAP auth method

Question 6

An operations team manages Vault leases for dynamic database credentials. They need to extend the life of an active lease without issuing a new credential, and they also want to confirm the lease's remaining time before doing so. Which two commands or operations should they use? (Choose two.)

Accepted Answer

vault lease lookup database/creds/app-role/abc123. To extend an active lease without issuing new credentials, use vault lease renew with the lease ID. To check how much time remains before renewal, use vault lease lookup, which reports the lease's expiration and TTL. Together these operations let the team confirm the remaining lifespan and then extend the existing lease in place.

Answer

vault lease revoke database/creds/app-role/abc123

Answer

vault write database/creds/app-role

Answer

vault token renew -accessor <accessor-id>

Question 7

A financial services company uses Vault's PKI secrets engine to issue short-lived TLS certificates to internal services. An administrator configured the PKI role with default_ttl=24h and max_ttl=72h. A service requests a certificate with an explicit TTL of 120h. What will Vault do in this situation?

Accepted Answer

Vault issues the certificate with a TTL capped at 72h, the role's max_ttl.. The max_ttl on a PKI role establishes the absolute maximum lifetime for any certificate issued by that role. When a client requests a TTL beyond that value, Vault clamps the issued lease to max_ttl, so the certificate is valid for 72 hours. The default_ttl only applies when no TTL is specified.

Answer

Vault rejects the request with an error because the requested TTL exceeds max_ttl.

Answer

Vault issues the certificate with a TTL of 120h because the requested TTL overrides the role's max_ttl.

Answer

Vault issues the certificate with a TTL of 24h, the role's default_ttl, ignoring the requested value entirely.

Question 8

A security team is evaluating the Vault transit secrets engine as an encryption-as-a-service platform for several applications. They want to understand which capabilities the transit engine actually provides. (Choose two.)

Accepted Answer

It can validate the integrity of data by generating and verifying HMAC signatures.. The transit engine provides cryptographic services over its API without persisting the data it processes, and it can generate and verify HMACs in addition to encrypting and decrypting. Dynamic database credentials, X.509 certificate issuance, and network traffic proxying belong to other secrets engines or external components, so they are outside the transit engine's scope.

Answer

It can serve as a transparent proxy that encrypts traffic between microservices on the network.

Answer

It can generate and manage database credentials for PostgreSQL and MySQL.

Answer

It can dynamically issue X.509 certificates from an internal certificate authority.

Question 9

A platform team manages a fleet of on-premises Linux servers that are not joined to any cloud provider or Active Directory domain. They want each server to authenticate to Vault automatically at boot without embedding a long-lived token in a configuration file. The team already maintains an internal PKI that issues X.509 certificates to every server. Which authentication method should they enable to meet these requirements with the least new infrastructure?

Accepted Answer

Enable the cert auth method and configure a trusted CA certificate so each server presents its PKI-issued certificate during login.. Certificate authentication leverages the PKI certificates the servers already possess, so no new credential distribution channel is needed. During the TLS handshake the server presents its certificate, and Vault validates it against the trusted CA configured on the cert mount. This yields automatic, secret-free login for on-premises hosts that have no cloud identity.

Answer

Enable the aws auth method and bind each server to an IAM role so it can call STS GetCallerIdentity during login.

Answer

Enable the approle auth method and distribute a role_id and secret_id to each server's configuration file.

Answer

Enable the ldap auth method and point it at the internal directory where each server has a service account.

Question 10

A role in Vault's database secrets engine is configured with default_ttl=30m and max_ttl=2h. An application requests credentials and then successfully renews the lease twice, each time receiving the full default TTL. What is the longest total time the credential can remain valid from its original issue time?

Accepted Answer

2 hours. The max_ttl on the role is the hard ceiling on a lease's total lifetime from issuance. Renewals can extend expiration in increments up to the default TTL, but the expiration manager refuses to push past max_ttl, after which the application must obtain brand-new credentials through the creds endpoint.

Answer

4 hours

Answer

1 hour 30 minutes

Answer

Unlimited, as long as the application renews before each expiry

Question 11

A Vault administrator is designing a disaster-recovery runbook for dynamic secrets and needs to document the ways leases can be terminated or cleaned up. Which two statements correctly describe lease revocation behavior in Vault? (Choose two.)

Accepted Answer

Revoking a token revokes the leases of secrets that were created using that token, in addition to the token itself.. Token revocation cascades to the leases that token created, and revoking a dynamic secret's lease instructs the secrets engine to delete the external credential. Revocation is scoped rather than mount-wide, revoked leases cannot be revived, and normal revocation cleans up the external system instead of merely dropping Vault's record.

Answer

Deleting the lease record from Vault's storage with a storage operation leaves the external credential valid until its natural expiry.

Answer

Revoking a lease automatically revokes every other lease issued by the same secrets engine mount.

Answer

Once a lease is revoked, the same lease ID can be renewed again if the client still holds it.

Question 12

A Vault administrator is troubleshooting a Vault cluster using integrated storage (Raft). The cluster has three nodes: node1 (active), node2 (standby), and node3 (standby). The administrator runs `vault operator raft list-peers` and sees that node3 is listed as a non-voter. What is the most likely reason for node3 being a non-voter?

Accepted Answer

Node3 was recently added to the cluster and has not yet been promoted to a voter by autopilot.. In Vault's integrated storage, when a new node joins the cluster, it starts as a non-voter. Autopilot is responsible for promoting non-voters to voters once they are healthy and stable. This prevents a new, potentially unstable node from affecting the cluster's quorum. Therefore, node3 is likely a recently added node that has not yet been promoted to voter by autopilot.

Answer

Node3 has a different Vault version than the other nodes, so it is automatically demoted to a non-voter.

Answer

Node3 is configured as a performance standby, which prevents it from being a voter.

Answer

Node3 is a standby node and therefore cannot be a voter in the Raft configuration.

Question 13

A security team needs to grant a service account the ability to read secrets from the path 'secret/data/backup' and also to update the secret at that same path. Which policy correctly implements this requirement?

Accepted Answer

path "secret/data/backup" { capabilities = ["read", "update"] }. For KV v2 secrets, reading and updating a secret at a specific path requires capabilities read and update on secret/data/<path>. The update capability allows modifying an existing secret, which is necessary here. Using create instead of update would not allow modifying an existing secret. Specifying the exact path without a wildcard ensures least privilege.

Answer

path "secret/backup" { capabilities = ["read", "update"] }

Answer

path "secret/data/backup" { capabilities = ["read", "create"] }

Answer

path "secret/data/backup/*" { capabilities = ["read", "update"] }

Question 14

A security team needs to create a Vault policy that allows a token to read secrets under 'secret/data/finance/*' but explicitly denies access to 'secret/data/finance/salaries'. The policy must also allow listing all secrets under 'secret/data/finance/'. Which policy definition correctly achieves this?

Accepted Answer

path "secret/data/finance/*" {
  capabilities = ["read", "list"]
}
path "secret/data/finance/salaries" {
  capabilities = ["deny"]
}. Vault policies use a deny capability that overrides any other capability on a path. To deny access to a specific path while allowing a broader wildcard, you create a separate path block for the denied path with capabilities = ["deny"]. The order of blocks is irrelevant because Vault evaluates all matching paths and deny always wins. This is the correct and supported method.

Answer

path "secret/data/finance/*" {
  capabilities = ["read", "list"]
}
path "secret/data/finance/salaries" {
  capabilities = ["read", "list"]
  allowed_parameters = { "deny" = [] }
}

Answer

path "secret/data/finance/*" {
  capabilities = ["read", "list"]
}
path "secret/data/finance/salaries" {
  capabilities = ["read"]
}

Answer

path "secret/data/finance/*" {
  capabilities = ["read", "list"]
  denied_parameters = ["salaries"]
}

Question 15

A platform team runs a Vault cluster where many applications obtain dynamic AWS credentials from the aws secrets engine. During an incident, an operator needs to stop all credential usage tied to a compromised IAM role without disrupting other roles. The operator has a root token and wants to revoke every lease associated with that specific role. Which approach accomplishes this?

Accepted Answer

Run vault lease revoke -prefix aws/creds/ to revoke all leases under that role's path.. The vault lease revoke command with the -prefix flag revokes all leases whose IDs share a given path prefix. Because AWS dynamic credentials are issued under aws/creds/, using that prefix scopes the revocation to the compromised role only, achieving rapid containment without tearing down the secrets engine or affecting other roles.

Answer

Delete the AWS IAM role directly in AWS and wait for Vault leases to expire naturally.

Answer

Disable the aws secrets engine mount, which immediately revokes all leases issued by that mount.

Answer

Run vault token revoke -self to revoke the token that requested the credentials.