VA-003 Practice Test 4 — 25 Questions

Question 1

A development team wants to authenticate to Vault using a method that does not require storing secrets in source code and supports automatic rotation of credentials. Which authentication method best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS IAM authentication. AWS IAM authentication allows Vault to authenticate using AWS IAM credentials (access key/secret key or instance metadata) without storing any secrets in source code. It supports automatic credential rotation by leveraging AWS IAM roles and STS to generate temporary credentials, which Vault can validate via the AWS API. This eliminates the need for long-lived secrets in code and enables seamless rotation.

Answer

Token authentication

Answer

LDAP authentication

Answer

Userpass authentication

Question 2

A developer has a policy that grants 'create' capability on path 'secret/data/team/*'. They successfully create a new secret using 'vault kv put secret/data/team/db', but when they try to update the same secret with new data, they get a permission denied error. What is the most likely cause?

Accepted Answer

The policy does not include the 'update' capability, which is required for modifying existing secrets.. In Vault, the 'kv put' command performs a 'create' operation when the secret does not exist, but an 'update' operation when it does. The policy only grants 'create' capability on 'secret/data/team/*', which allows the initial write but not subsequent modifications. To update an existing secret, the policy must also include the 'update' capability on the same path, as Vault's ACL system enforces separate capabilities for creating and updating secrets.

Answer

The developer does not have the 'create' capability on the parent path.

Answer

The policy needs the 'list' capability on the path.

Answer

The developer's token lacks the 'sudo' capability for updates.

Question 3

A finance company runs a microservices architecture on Kubernetes. Each microservice has its own service account and uses Kubernetes auth to authenticate to Vault and read secrets. Recently, a new microservice 'payment' was deployed in the 'prod' namespace with service account 'payment-sa'. The team created a Vault role with bound_service_account_names=['payment-sa'] and bound_service_account_namespaces=['prod']. The microservice can authenticate and obtains a token, but when it tries to read the secret at path 'secret/data/payments/db', it gets a permissions error. Other microservices in the same namespace with similar roles work fine. The Vault policy for the role includes read access to 'secret/data/payments/*'. What is the most likely issue and correct action?

Accepted Answer

Update the Vault role to include the policy 'payments-read' in the token_policies parameter.. The Vault role is configured with `token_policies` that grant read access to `secret/data/payments/*`, but the role itself does not include that policy in its `token_policies` parameter. When the microservice authenticates via Kubernetes auth, the token issued by Vault only carries policies explicitly attached to the role. Without the policy being listed in `token_policies`, the token lacks the necessary permissions to read the secret, even though the policy exists. Updating the role to include the policy in `token_policies` resolves the permissions error.

Answer

Increase the TTL of the Vault token to give more time for the secret read.

Answer

Add the microservice's service account to the bound_service_account_names of an existing role that works.

Answer

Change the authentication method to AppRole for the payment microservice.

Question 4

A Vault administrator is configuring Consul as the storage backend. The Consul cluster will span three data centers with low latency links. Which Consul deployment is recommended for Vault to ensure data safety?

Accepted Answer

5 Consul servers in a single datacenter. Vault requires a strong consistency guarantee for its storage backend, and Consul achieves this via the Raft consensus protocol, which requires a majority of servers to be available. A single datacenter with 5 Consul servers provides the necessary fault tolerance and quorum (3 out of 5) to survive failures while maintaining data safety. Spreading servers across datacenters with low latency links still introduces network partitions and higher latency, which can break Raft's stability and lead to split-brain scenarios or degraded performance.

Answer

3 Consul servers across 3 datacenters (1 per DC)

Answer

3 Consul servers in each datacenter (total 9)

Answer

3 Consul servers in one datacenter with agents in others

Question 5

A DevOps engineer needs to create a token with a specific policy attached using the Vault API. Which API endpoint and request should they use?

Accepted Answer

POST /v1/auth/token/create with JSON body {"policies":["my-policy"]}. The Vault API endpoint for creating tokens with specific policies is POST /v1/auth/token/create, and the JSON body must include the 'policies' key as an array of strings. This endpoint is part of the token auth method and allows attaching policies at token creation time.

Answer

POST /v1/auth/token/create-orphan with JSON body {"policies":["my-policy"]}

Answer

POST /v1/token/create with JSON body {"policy":"my-policy"}

Answer

POST /v1/sys/token with JSON body {"policy":"my-policy"}

Question 6

Drag and drop the steps to configure Vault's audit logging to a file into the correct order.

Accepted Answer

Enable audit device, then perform operations to generate log entries, then verify the audit log.. The correct sequence for configuring Vault's audit logging to a file is: first enable the audit device (e.g., 'vault audit enable file file_path=...'), then perform operations (e.g., read/write secrets) to generate audit log entries, and finally verify the log file to confirm entries are being recorded. Common mistakes include enabling after generating logs, verifying too early, or skipping the generation step.

Answer

Perform operations to generate log entries, then enable audit device, then verify the audit log.

Answer

Verify audit log, then enable audit device, then perform operations to generate log entries.

Answer

Enable audit device, then verify the audit log, then perform operations to generate log entries.

Question 7

Which TWO authentication methods support multi-factor authentication (MFA) natively within Vault Enterprise?

Accepted Answer

Userpass authentication. Userpass authentication in Vault Enterprise supports MFA natively because it can be configured with a second factor such as TOTP, Duo, or Okta directly within the auth method's configuration. This allows the userpass method to enforce both a password and an additional authentication factor without requiring an external identity provider or custom wrapper.

Answer

AWS IAM authentication

Answer

Token authentication

Answer

Kubernetes authentication

Question 8

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Accepted Answer

The binddn or bindpass configured in Vault is incorrect. The error 'LDAP bind failed: invalid credentials' specifically indicates that the authentication attempt to the LDAP server using the configured binddn and bindpass failed. Since the LDAP server is reachable, the most direct cause is that the bind credentials stored in Vault's LDAP configuration do not match what the LDAP server expects. This is a configuration mismatch, not a connectivity or TLS issue.

Answer

Vault is not configured to use SSL/TLS for LDAP

Answer

The LDAP server does not allow anonymous binds

Answer

The LDAP server certificate is not trusted by Vault

Question 9

During an audit, it is discovered that a single AppRole role is used by hundreds of applications, and it is impossible to revoke access for a single compromised application without affecting others. What should be done to improve the security posture?

Accepted Answer

Create a unique AppRole role for each application. Creating a unique AppRole role for each application ensures that each application has its own set of credentials (RoleID and SecretID). This allows you to revoke access for a single compromised application by deleting or disabling its specific AppRole role, without impacting other applications. This directly addresses the core issue of shared credentials and provides granular access control.

Answer

Schedule periodic secret ID rotation

Answer

Reduce the token TTL to 1 minute

Answer

Add CIDR bindings to the AppRole role

Question 10

A multi-national company uses Vault's AWS secrets engine to manage access to multiple AWS accounts. They have a central Vault cluster and need to generate IAM users in account A that assume a role in account B for cross-account access. The team has configured the AWS secrets engine with the root credentials of account A. They created a role on the engine that should generate STS credentials for the cross-account role. However, when they try to generate credentials, Vault returns an error: 'AccessDenied: User: arn:aws:iam:::user/vault-user is not authorized to perform: STS:AssumeRole on resource: arn:aws:iam:::role/CrossAccountRole'. What additional configuration is required?

Accepted Answer

Attach an IAM policy to the Vault user in account A that allows sts:AssumeRole on the cross-account role ARN.. The error indicates that the Vault user in account A lacks the IAM permission to call sts:AssumeRole on the cross-account role in account B. Even though the AWS secrets engine is configured with root credentials of account A, the engine uses those credentials to make API calls on behalf of the Vault user. Therefore, you must attach an IAM policy to the Vault user in account A that explicitly allows sts:AssumeRole on the target role ARN in account B. This is a prerequisite for cross-account access via STS.

Answer

Create a new role in the AWS secrets engine that uses the cross-account role ARN directly.

Answer

Change the AWS secrets engine mount path to avoid conflicts.

Answer

Set up AWS federation with SAML to allow cross-account access.

Question 11

A DevOps team wants to authenticate a CI/CD pipeline running on a Jenkins server outside Kubernetes. The pipeline needs to obtain short-lived tokens to read secrets. Which authentication method should be used?

Accepted Answer

AppRole auth. AppRole auth is designed for machine-to-machine authentication, allowing Jenkins (outside Kubernetes) to obtain short-lived tokens by providing a RoleID and SecretID. This method supports automated workflows without human intervention, making it ideal for CI/CD pipelines that need to read secrets from Vault.

Answer

LDAP auth

Answer

Kubernetes auth

Answer

GitHub auth

Question 12

An administrator wants to allow human users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP auth. LDAP (Lightweight Directory Access Protocol) authentication allows integration with corporate Active Directory by binding to the directory service using a user's credentials. This enables centralized authentication against existing AD user objects without duplicating accounts in the Vault system.

Answer

Token auth

Answer

GitHub auth

Answer

Userpass auth

Question 13

A company uses OIDC auth for human users. After the OIDC provider rotates its signing keys, some users report that they cannot authenticate. The Vault logs show that the OIDC response validation fails. What is the most likely cause?

Accepted Answer

Vault's OIDC cache has old JWKS keys. When an OIDC provider rotates its signing keys, Vault must fetch the new JWKS (JSON Web Key Set) to validate the token signature. Vault caches the JWKS for performance, and if the cache still holds the old keys, signature validation fails for tokens signed with the new key. This matches the symptom of OIDC response validation failing immediately after a key rotation.

Answer

The OIDC role is misconfigured

Answer

The client's OIDC token is expired

Answer

The OIDC provider is down

Question 14

What is the purpose of the `storage` stanza in a Vault server configuration file?

Accepted Answer

Defines where Vault stores encrypted data.. The `storage` stanza in a Vault server configuration file defines the backend where Vault stores all encrypted data, including secrets, tokens, and metadata. This backend can be a file system, Consul, Raft, or other supported storage backends, and it is the persistent layer that holds the encrypted data after it has been processed by the seal mechanism. Without a properly configured `storage` stanza, Vault cannot persist any data and will fail to start.

Answer

Defines the encryption algorithm for secrets.

Answer

Defines the seal mechanism.

Answer

Defines the listener address.

Question 15

A security auditor requires that all encryption keys used to protect customer data must be periodically rotated according to company policy. The company uses Vault's Transit secrets engine. What is the recommended approach to rotate the encryption key?

Accepted Answer

Use the `vault write -f transit/keys/my-key/rotate` command to rotate the key. The Vault Transit secrets engine provides a dedicated `rotate` endpoint that creates a new encryption key version while keeping the previous version available for decryption of existing ciphertext. This allows the key to be rotated without re-encrypting all data, and the new key version is automatically used for future encryption operations. The `-f` flag forces the rotation without requiring interactive confirmation.

Answer

Use Vault's key rotation endpoint to rewrap the key

Answer

Delete the existing key and create a new one with the same name

Answer

Generate a new key with a different name and update the application configuration

Question 16

An administrator enables the database secrets engine for PostgreSQL. After configuring the connection, running `vault write database/config/someconfig` yields error: 'x509: certificate signed by unknown authority'. What is the most likely cause?

Accepted Answer

The PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle. The error 'x509: certificate signed by unknown authority' indicates that Vault, when connecting to the PostgreSQL database, received a TLS certificate from the server that was not signed by any Certificate Authority (CA) present in Vault's trusted CA bundle. Vault uses its system's CA pool or a custom CA bundle configured in the connection string to verify the database server's certificate. If the PostgreSQL server uses a self-signed certificate or one issued by an internal CA not trusted by Vault, this error occurs. Option B correctly identifies that the PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle.

Answer

The connection string is incorrect

Answer

The database engine is not enabled

Answer

The Vault server's TLS certificate is self-signed

Question 17

A team is evaluating which secrets engines to use for different use cases. Which TWO statements about secrets engines are true?

Accepted Answer

The KV v2 secrets engine supports versioning and can store metadata like TTL. The KV v2 secrets engine stores multiple versions of a secret, supports metadata such as TTL and deletion time, and allows check-and-set operations for conflict detection. This makes it suitable for use cases requiring secret rotation and audit trails.

Answer

The AWS secrets engine can only generate static access keys

Answer

The Database secrets engine requires a root database user for all configurations

Answer

The Transit secrets engine can generate dynamic database credentials

Question 18

An application needs to obtain short-lived, time-limited credentials to access an external database using username/password authentication. Which secrets engine should be used?

Accepted Answer

Database secrets engine. The Database secrets engine is designed specifically to generate short-lived, dynamic credentials for databases, including external databases accessed via username/password authentication. It creates unique, time-limited usernames and passwords on-the-fly, which are automatically revoked after a configurable TTL, meeting the requirement for temporary credentials.

Answer

KV v2 secrets engine

Answer

Consul secrets engine

Answer

Identity secrets engine

Question 19

Refer to the exhibit. An application token has the above policy. Which operation will fail?

Accepted Answer

Listing keys in the transit engine. The policy shown in the exhibit grants 'create', 'update', 'delete', and 'deny' capabilities on the transit engine, but it does not include a 'list' capability. In Vault's transit secrets engine, listing keys requires the 'list' capability on the engine path. Without it, the operation will fail due to insufficient permissions, even though other key management operations are allowed.

Answer

Rotating the key mykey

Answer

Decrypting data using the key mykey

Answer

Encrypting data using the key mykey

Answer

Deleting the key mykey

Question 20

An operator needs to enable the KV v2 secrets engine at the path 'team-alpha'. Which command should they run?

Accepted Answer

vault secrets enable -path=team-alpha kv-v2. The `vault secrets enable` command with the `-path` flag specifies the mount path as 'team-alpha', and `kv-v2` is the correct engine type for the KV v2 secrets engine. This command mounts the KV v2 engine at the desired path, enabling versioned key-value storage.

Answer

vault secrets enable kv-v2 team-alpha

Answer

vault secrets enable -path=team-alpha kv

Answer

vault secrets mount -path=team-alpha kv