VA-003 Practice Test 2 — 25 Questions

Question 1

A company needs to automatically generate short-lived database credentials for developers. Which secrets engine should they use?

Accepted Answer

Database. The Database secrets engine is specifically designed to generate short-lived, dynamic database credentials on demand. It connects to a database and creates unique user accounts with configurable time-to-live (TTL) values, which are automatically revoked when the lease expires. This directly meets the requirement for automatically generating temporary database credentials for developers.

Answer

KV v2

Answer

AWS

Answer

Cubbyhole

Question 2

The token was created 12 hours ago and has not been used yet. What will happen if the token is not used or renewed?

Accepted Answer

It will expire in 12 hours. Vault tokens have a configurable Time-To-Live (TTL) and a maximum TTL. If a token is not used within its TTL, it will expire. Since the token was created 12 hours ago and has not been used, and the default TTL for many token types in Vault is 24 hours, the token will expire in 12 hours (the remaining TTL). This is because the token's TTL begins counting down from creation, not from first use.

Answer

It can be renewed indefinitely if used

Answer

It will expire when the number of uses reaches 0

Answer

It will expire immediately because it was not used within 12 hours

Question 3

A Vault policy includes the following statement: path "secret/data/+/app" { capabilities = ["read"] }. Which paths would match this policy? (Assume KV v2)

Accepted Answer

secret/data/team-a/app. In Vault KV v2, the path structure is `secret/data/<path>`, and the `+` glob matches a single path segment. The policy `secret/data/+/app` matches exactly one segment between `data/` and `/app`. Option D, `secret/data/team-a/app`, has a single segment `team-a` before `app`, so it matches. Options with additional segments (A, B) or missing the required segment (C) do not match.

Answer

secret/data/team-a/app/db

Answer

secret/data/team-a/team-b/app

Answer

secret/data/app

Question 4

A Vault cluster has a performance secondary cluster replicating from a primary. An administrator needs to generate a one-time password (OTP) for an SSH target. They are on the secondary cluster. They run `vault write ssh/otp/otp_role ip=10.0.0.1 username=admin`. What is the expected behavior?

Accepted Answer

The request succeeds because the SSH secret engine is a local mount that exists on the secondary. The SSH secret engine is a local mount, meaning it is not replicated from the primary to the performance secondary cluster. Local mounts exist independently on each cluster, so the secondary can write data to its own local SSH engine. The `vault write ssh/otp/otp_role` command is syntactically correct and will succeed on the secondary as long as the role and engine are configured locally.

Answer

The request fails because the CLI command syntax is wrong

Answer

The request fails because secondary clusters cannot write any data

Answer

The request fails because the SSH secret engine must be replicated to the secondary

Question 5

Which TWO statements about batch tokens are true?

Accepted Answer

They are lightweight and support a high creation rate.. Batch tokens are designed to be lightweight and support a high creation rate, ideal for ephemeral workloads. Option B is correct because batch tokens cannot be used with a use-limit; use-limits are only supported by service tokens. Options C, D, and E are incorrect: batch tokens do not support explicit max TTL (C), they do not have a TTL as they derive their lifetime from the parent token (D), and they are not renewable (E).

Answer

They support explicit max TTL.

Answer

They have a TTL.

Answer

They are renewable.

Question 6

An administrator creates a token role with 'allowed_policies' and tries to create a child token. What does this error indicate?

Accepted Answer

The token role's token_count_limit has been reached. The error 'token count per user (3) exceeded' indicates that the number of tokens issued for that entity (user or role) has exceeded the maximum allowed, which is controlled by the 'token_count_limit' parameter in the token role. Option D correctly identifies this limit as the cause. Option A is irrelevant because revocation count is not involved. Option B is incorrect because the error is about token count, not TTL. Option C is incorrect because the error is about quantity, not policy permissions.

Answer

The token has been revoked too many times

Answer

The token's TTL is too short

Answer

The token's policy is not allowed by the role

Question 7

A development team needs tokens that can be renewed automatically as long as they are still in use, up to a maximum lifetime of 72 hours. Which token type and configuration should be used?

Accepted Answer

Service token with a TTL of 1h and max TTL of 72h. A service token with a TTL of 1 hour and a max TTL of 72 hours allows automatic renewal as long as the token is still in use, up to the maximum lifetime of 72 hours. This configuration ensures that the token's TTL is extended on each use, preventing expiration during active sessions while enforcing an absolute upper limit.

Answer

Periodic token with a TTL of 72h

Answer

Orphan token with a TTL of 1h

Answer

Batch token with a TTL of 72h

Question 8

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Accepted Answer

vault write shared/data/db_password value=s3cret. In Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Answer

vault write shared/db_password value=s3cret

Answer

vault write shared/metadata/db_password value=s3cret

Answer

vault write shared/config/db_password value=s3cret

Question 9

A Vault administrator notices that the audit log file on the Vault server is filling up the disk. What is the best course of action to prevent disk full issues?

Accepted Answer

Configure the file audit device with log rotation.. Configuring log rotation on the file audit device allows the Vault server to automatically archive or delete old audit logs based on size or time thresholds, preventing the disk from filling up while retaining necessary audit data. This is the recommended approach in Vault for managing disk space without disabling security auditing or relying on external infrastructure changes.

Answer

Disable audit logging to reduce disk usage.

Answer

Switch to a syslog audit device.

Answer

Increase the disk size of the Vault server.

Question 10

A team wants to store static secrets like database passwords and rotate them periodically. Which secrets engine should they enable?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is designed for static secrets like database passwords, offering versioning, configurable deletion, and periodic rotation via lease management or external automation. It stores secrets as key-value pairs with metadata, making it ideal for static credentials that need controlled lifecycle management.

Answer

AWS secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 11

A company uses HashiCorp Vault in production to manage secrets for its microservices. One microservice, 'order-svc', authenticates via AppRole and receives a service token with a TTL of 24 hours and a max TTL of 48 hours. Over the past few days, operations teams report that 'order-svc' fails to renew its token after approximately 23 hours, causing authentication failures. The token lookup shows the token is still alive with about 1 hour of TTL remaining, but renewal attempts return a 'permission denied' error. The Vault audit logs show the renewal request is reaching Vault and being denied. The token's policies include 'path "auth/token/renew-self" { capabilities = ["update"] }'. The token was created with the default options. What is the most likely cause of this failure?

Accepted Answer

The token has already been renewed up to its max TTL, so further renewal would exceed the max. The token's max TTL of 48 hours has been reached after repeated renewals. Each renewal extends the token's TTL up to the max TTL, and once that limit is hit, further renewal attempts are denied with a 'permission denied' error, even if the current TTL still shows remaining time. The token lookup showing 1 hour of TTL left indicates the token is still valid, but the renewal is blocked because it would exceed the configured max TTL.

Answer

The token's parent token has been revoked, making it an orphan

Answer

The token is a batch token and cannot be renewed

Answer

The token's num_uses has reached zero

Question 12

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Vault's `vault rewrap` command re-encrypts existing ciphertext with the latest key version without decrypting the underlying plaintext, preserving the data's confidentiality. This is essential after a key rotation to ensure all ciphertext uses the new key, meeting compliance requirements for periodic key rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 13

A DevOps team uses Vault to manage secrets for a microservices application. The application authenticates to Vault using AppRole, and each service obtains a periodic token with a TTL of 24 hours and a period of 1 hour. The tokens are used to read secrets from a path. Recently, the team noticed that some services are unable to read secrets after a few hours, with error messages indicating that the token is not authorized or has expired. Upon investigation, the team finds that the tokens are being renewed properly but still fail after some time. What is the most likely cause of this issue?

Accepted Answer

The tokens have a shorter max TTL than the period, causing them to expire before they can be renewed.. The tokens have a period of 1 hour and a TTL of 24 hours, but the max TTL (maximum allowed lifetime) for the token or the role is likely set to a value shorter than the period. In Vault, the period controls how often the token must be renewed, while the max TTL is the absolute upper limit on the token's lifetime. If the max TTL is less than the period (e.g., 30 minutes), the token will expire before the next renewal attempt, even if renewal logic is correct.

Answer

The Vault server's maximum number of tokens per client has been exceeded.

Answer

The tokens are not being renewed correctly due to a bug in the renewal logic.

Answer

The AppRole secret ID is being revoked, causing tokens to become invalid.

Question 14

A Vault administrator wants to ensure that all secrets are encrypted at rest and in transit. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable TLS on all Vault listener configurations.. Enabling TLS on all Vault listener configurations ensures that data is encrypted in transit between clients and the Vault server, protecting against eavesdropping and man-in-the-middle attacks. Option C is correct because using a seal that provides envelope encryption (e.g., Auto Unseal with a cloud KMS) encrypts the master key and storage backend data, ensuring secrets are encrypted at rest. Together, these two configurations satisfy the requirement for encryption both in transit (TLS) and at rest (seal envelope encryption).

Answer

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Answer

Set the `encrypt` parameter on the audit device configuration.

Answer

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Question 15

A user receives an error 'invalid ciphertext' when trying to decrypt data. The ciphertext was created by another Vault instance. What is the most likely issue?

Accepted Answer

The ciphertext includes key version info that doesn't match. Vault's transit secrets engine appends key version information to the ciphertext by default. When decrypting, Vault checks that the key version embedded in the ciphertext matches a version of the key that exists in the destination Vault instance. If the ciphertext was created by a different Vault instance with a different key version history, the version embedded in the ciphertext will not correspond to any known key version, causing the 'invalid ciphertext' error.

Answer

Different key names

Answer

The Vault instance is sealed

Answer

Different key types

Answer

The user lacks permissions to decrypt

Question 16

A Vault cluster has several policies. One policy, "app-policy", contains: path "secret/data/app/*" { capabilities = ["create", "update"] }. Another policy, "admin-policy", includes: path "secret/data/app/db" { capabilities = ["deny"] }. A token is attached with both policies. Can the token write to "secret/data/app/db"?

Accepted Answer

No, because deny takes precedence over allow.. B is correct because in Vault, the 'deny' capability takes precedence over all other capabilities. When a token has multiple policies attached, Vault evaluates all matching paths and applies the most restrictive result. Since 'admin-policy' explicitly denies access to 'secret/data/app/db', the token cannot write to that path, regardless of the 'create' and 'update' capabilities granted by 'app-policy'.

Answer

No, because the paths conflict.

Answer

Yes, because policies are additive.

Answer

Yes, because the first policy allows create/update.

Question 17

An organization uses the transit engine with key rotation. They want to ensure that data encrypted with an older key version can be decrypted by Vault, but only if the key has not been deleted. Which of the following must be true?

Accepted Answer

The key must not have been archived. In Vault's transit engine, key rotation creates new key versions while preserving older ones. The ability to decrypt data encrypted with an older key version depends on whether that version is still available in the key's version history. Archiving a key removes all versions from the active key ring, making decryption of data encrypted with any version of that key impossible. Therefore, the key must not have been archived to allow decryption of data encrypted with an older key version, provided the key itself has not been deleted.

Answer

The key's `min_decryption_version` must be set to 1

Answer

The key must have the `allow_plaintext_backup` setting enabled

Answer

The key must have a `deletion_allowed` set to false

Answer

The key's `latest_version` must be greater than 0

Question 18

A token is created with policies 'default' and 'web-app'. Later, a parent token's policy is updated to add 'logging'. The child token's policies are not updated. What will happen when the child token is used?

Accepted Answer

The child token will still have only 'default' and 'web-app' policies. In Vault, child tokens inherit the policies of their parent at the time of creation, but subsequent changes to the parent's policies do not propagate to existing child tokens. The child token retains its original policy set ('default' and 'web-app') because policies are evaluated based on the token's own metadata, not the parent's current state. This behavior is by design to ensure token immutability and prevent unintended privilege escalation.

Answer

The child token will be automatically renewed to pick up the new policy

Answer

The child token will automatically gain the 'logging' policy

Answer

The child token will be invalidated due to policy mismatch

Question 19

A Vault administrator needs to allow users to authenticate using their existing corporate Active Directory credentials. The administrator has configured the LDAP authentication method but users cannot log in. The Vault logs show 'LDAP bind successful' but then 'user not found in group' error. What is the most likely issue?

Accepted Answer

The groupfilter or groupattr configuration is incorrect. The error 'LDAP bind successful' confirms that the Vault server can connect and authenticate to the LDAP server using the bind credentials. The subsequent 'user not found in group' error indicates that while the user exists and can bind, the group membership lookup fails. This is most commonly caused by an incorrect `groupfilter` or `groupattr` configuration, which defines how Vault queries the LDAP directory to map users to groups for authorization.

Answer

The LDAP server hostname is incorrect

Answer

The userattr configuration is incorrect

Answer

The LDAP server does not allow anonymous queries

Question 20

An organization is implementing Vault policies for the first time. They want to ensure that policies are easy to manage and follow the principle of least privilege. Which approach should they take when creating policies?

Accepted Answer

Create separate policies for each application and use group aliases to attach them.. It aligns with the principle of least privilege by creating separate policies for each application, ensuring that each application only has access to the specific paths and capabilities it requires. Using group aliases to attach these policies allows for centralized management and simplifies policy updates, as changes can be made at the group level rather than per user or token. This approach also leverages Vault's identity-based policies, which are evaluated based on the entity's group memberships, providing a scalable and maintainable policy structure.

Answer

Create policies with broad paths and then restrict via ACL tokens.

Answer

Create a single policy with a wildcard path '*' and full capabilities for all administrators.

Answer

Create a single policy with all paths and capabilities for all users.