VA-003 Practice Test 25 — 15 Questions

Question 1

Which THREE authentication methods are built into Vault (no plugin required)?

Accepted Answer

OIDC. OIDC (OpenID Connect) is built into Vault as an identity provider and authentication method without requiring any external plugin. It allows clients to authenticate via OIDC providers like Okta or Azure AD, leveraging JWT tokens for identity verification. Vault's built-in OIDC support is configured through the `vault auth enable oidc` command and does not depend on any separate plugin binary.

Answer

SAML

Answer

RADIUS

Question 2

A Vault cluster uses DR replication. The primary cluster fails, and the DR secondary is promoted to primary. After promotion, some secret data written to the primary shortly before the failure is missing on the new primary. What is the most likely reason?

Accepted Answer

The data had not yet been replicated to the DR secondary before the primary failed.. In Vault DR replication, data is asynchronously replicated from the primary to the secondary cluster. If the primary fails before the replication stream has transmitted the most recent writes, those writes are lost. When the DR secondary is promoted to primary, it only contains data that was successfully replicated up to the point of failure. This is the most likely reason the secret data is missing.

Answer

The seal wrapping key was rotated on the primary after the last replication.

Answer

The secret engine was not enabled on the DR secondary.

Answer

The DR secondary was promoted with the 'force' option, which skips replication of the last writes.

Question 3

Which THREE of the following are valid sources of token TTL?

Accepted Answer

System default TTL. Vault has a system default TTL that applies to tokens when no other TTL source is specified. This default is typically 32 days (2764800 seconds) and serves as the maximum possible TTL for a token unless overridden by a shorter TTL from another source. The system default TTL is defined in the Vault server configuration and acts as a fallback to ensure tokens do not live indefinitely.

Answer

Mount path configuration

Answer

Policy TTL

Question 4

Refer to the exhibit. A token was created with a creation_ttl of 24h, explicit_max_ttl of 10h, and a current ttl of 12h. What will happen when the token reaches its explicit_max_ttl?

Accepted Answer

The token will be revoked immediately.. The explicit_max_ttl overrides any other TTL settings. When the token reaches its explicit_max_ttl (10h from creation), it will be revoked by Vault regardless of renewable or creation_ttl. Options suggesting renewal or extension are incorrect.

Answer

The token will be automatically renewed by Vault.

Answer

The token will remain valid until the creation_ttl expires.

Answer

The token will have its TTL extended to 24h.

Question 5

A company needs to generate short-lived, dynamic database credentials for its MySQL instances. Which secrets engine should be configured?

Accepted Answer

Database secrets engine. The Database secrets engine is specifically designed to generate short-lived, dynamic credentials for databases like MySQL. It creates unique, time-bound usernames and passwords on demand, which aligns with the requirement for temporary database access without manual credential management.

Answer

KV secrets engine

Answer

AWS secrets engine

Answer

PKI secrets engine

Question 6

A security engineer needs to ensure that if a key is compromised, previous ciphertext can be re-encrypted with a new key version without exposing the plaintext. Which Vault operation should they use?

Accepted Answer

Rewrap. The Rewrap operation in Vault allows a ciphertext to be decrypted with the current key version and re-encrypted with a new key version without exposing the plaintext to the caller. This ensures that if a key is compromised, previous ciphertext can be rotated to a new key version while maintaining data confidentiality.

Answer

Rotate

Answer

Encode

Answer

Transform

Answer

Rekey

Question 7

A development team is using Vault to dynamically generate PostgreSQL credentials for their application. They configured a database role with a max_lease_ttl of 24 hours. However, credentials are becoming invalid after only 1 hour, causing application errors. The team has verified that the credentials are not being explicitly revoked. Which action should the Vault administrator take to resolve this issue?

Accepted Answer

Update the database role's default_lease_ttl to 24 hours.. The issue is that the credentials are expiring after 1 hour, which is the default value for `default_lease_ttl` in Vault database roles. Even though the `max_lease_ttl` is set to 24 hours, the actual lease duration for each credential is determined by the `default_lease_ttl` unless it is explicitly configured. By setting `default_lease_ttl` to 24 hours, the administrator ensures that each generated credential has a lease duration matching the maximum allowed, preventing premature expiration.

Answer

Extend the TTL of the token used to generate credentials.

Answer

Increase the database engine's max_lease_ttl to 48 hours.

Answer

Instruct the team to renew the lease every 30 minutes.

Question 8

A Vault administrator has enabled the PKI secrets engine and configured a root CA. They now need to issue certificates for multiple internal services, each with its own common name (CN). Which is the most efficient way to issue certificates while maintaining security?

Accepted Answer

Create a separate role for each service with specific allowed domains. Creating a separate role for each service allows you to enforce least-privilege by restricting each role to specific allowed domains (e.g., via `allowed_domains` and `allow_subdomains`). This ensures that each service can only request certificates for its own CN, preventing cross-service impersonation while maintaining efficient, role-based issuance. The PKI secrets engine uses roles to define TTL, key type, and domain constraints, making per-service roles the most secure and manageable approach.

Answer

Create one role with the allow_any_name parameter set to true

Answer

Create one role with a wildcard allowed domain and use the common_name parameter when issuing

Answer

Create one role without any allowed domains and specify the common name in the request

Question 9

A company runs a monolithic application that reads database credentials from Vault KV v2 secrets engine at path 'app/db'. The application authenticates using an AppRole with a periodic token that renews automatically. Recently, the application started failing with permission denied errors when reading the secret. The administrator checks the AppRole's secret-id and token but they are valid. The administrator then runs `vault token capabilities $(cat /tmp/token) app/db/data` and gets an empty list. The administrator knows that the token has the 'app-policy' policy attached. They also run `vault read sys/policy/app-policy` and see the policy rules. The policy allows explicit 'read' on 'app/db/data'. What could be the issue?

Accepted Answer

The secret at 'app/db/data' does not exist. The policy explicitly allows 'read' on 'app/db/data', so the issue is not a policy path mismatch. The empty capabilities list from `vault token capabilities` suggests that the secret at 'app/db/data' does not exist, and Vault returns an empty capabilities list for non-existent paths when no policy grants access to that exact path. Since the application receives permission denied errors, the most likely cause is that the secret has not been created or has been deleted.

Answer

The policy path is incorrect because KV v2 requires granting access to 'app/db/data' but the policy might be written for KV v1 syntax

Answer

The token has expired and needs to be renewed

Answer

The Capabilities command does not work with AppRole tokens

Question 10

Refer to the exhibit. A developer reports that they cannot read secrets under 'secret/data/kv-v2/engineering/db-pass' using a token that has the above policy attached. What is the most likely cause?

Accepted Answer

The token does not have the policy attached.. The policy shown in the exhibit defines a path with a glob pattern (`secret/data/kv-v2/engineering/*`), which matches the secret path `secret/data/kv-v2/engineering/db-pass`. However, the developer reports they cannot read the secret, indicating the token likely does not have this policy attached. In Vault, a token must have a policy explicitly attached to it; merely having the policy defined in Vault does not grant permissions unless the token is associated with that policy.

Answer

The policy requires the 'sudo' capability for reading secrets.

Answer

The secret does not exist because the path is incorrect.

Answer

The path uses a glob that does not match the exact secret path.

Question 11

A DevOps team needs to encrypt sensitive configuration data before storing it in a version control system. They want to use Vault's encryption as a service to encrypt the data using a named encryption key. Which Vault path should they use to perform the encryption?

Accepted Answer

POST /v1/transit/encrypt/my-key. The correct path for encrypting data using Vault's encryption-as-a-service is POST /v1/transit/encrypt/my-key. The Transit secrets engine provides encryption as a service, and the /encrypt endpoint is specifically designed to encrypt plaintext data using a named encryption key. The key name 'my-key' in the path identifies which key in the Transit engine should be used for the encryption operation.

Answer

POST /v1/transit/sign/my-key

Answer

POST /v1/transit/hmac/my-key

Answer

POST /v1/transit/random

Answer

POST /v1/transit/decrypt/my-key

Question 12

Refer to the exhibit. A user deletes the current version of 'secret/myapp' using 'vault kv delete secret/myapp'. What happens to the version?

Accepted Answer

It is deleted and can be undeleted if not destroyed. With default delete_version_after=0s and max_versions=0, deleting a version marks it as deleted but does not destroy it. The version can be undeleted. The cas_required setting affects write operations, not delete. Permanent destruction requires a separate 'destroy' command or automatic cleanup if delete_version_after is set.

Answer

It is destroyed because cas_required is true

Answer

It is permanently deleted immediately

Answer

It is marked as deleted but can be undeleted because cas_required is true

Question 13

An organization previously used userpass auth and is migrating to LDAP auth. After enabling LDAP and configuring the bind user, users can authenticate but their policies do not apply. What is the most likely cause?

Accepted Answer

LDAP groups are not mapped to Vault policies. When users can authenticate but policies do not apply, it indicates that authentication itself is working (LDAP bind succeeded), but Vault has no way to associate the authenticated user with the correct policies. In Vault, LDAP authentication relies on group membership mapping: the LDAP server returns the user's groups, and Vault must have those groups mapped to Vault policies via `vault write auth/ldap/groups/ policies=`. Without this mapping, the user authenticates but receives no policies, resulting in an empty token with no permissions.

Answer

The bind credentials are incorrect

Answer

The userpass auth method is still enabled

Answer

The LDAP server is unreachable

Question 14

Match each Vault audit device to its output destination.

Accepted Answer

File: Writes audit logs to a local file. The correct matches are: File writes to a local file, Syslog sends to syslog, Socket sends to a TCP/UDP endpoint. Common confusions mix the output destinations.

Answer

File: Sends audit logs to syslog

Answer

Syslog: Writes audit logs to a file

Answer

Socket: Writes audit logs to a file

Question 15

After a failover event in a Vault HA cluster with Integrated Storage, the new active node reports a 'sealed' status incorrectly in monitoring metrics, but the cluster is still functioning correctly. What is the most likely cause?

Accepted Answer

Inconsistent seal configuration across nodes.. When a Vault HA cluster with Integrated Storage experiences a failover, the new active node must have a seal configuration that matches the cluster's unseal mechanism. If the seal configuration (e.g., Shamir threshold, auto-unseal KMS key, or transit engine path) is inconsistent across nodes, the new active node may report as 'sealed' in monitoring metrics even though the cluster is functional. This happens because the monitoring endpoint reads the node's local seal status, which can differ from the actual cluster state if the node cannot properly verify its own unseal state due to misconfiguration.

Answer

The new active node is actually a standby.

Answer

The Vault token used for monitoring has expired.

Answer

The storage backend is corrupted.