VA-003 Practice Test 26 — 15 Questions

Question 1

A security team must immediately invalidate every dynamic database credential issued under a specific role named app-readonly, across all database mounts, without knowing individual lease IDs. Which Vault command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vault lease revoke -prefix database/creds/app-readonly. Revoking by prefix targets all leases under the role's creds path in one operation and triggers the secrets engine to remove the corresponding database accounts. Forcing deletion skips backend cleanup, token revocation is scoped to tokens rather than roles, and disabling the mount destroys configuration the team still needs.

Answer

vault secrets disable database

Answer

vault lease revoke -force database/creds/app-readonly

Answer

vault token revoke -accessor app-readonly

Question 2

An application team is using a batch token to authenticate to Vault for a long-running data processing job. The token was created with a TTL of 8 hours and no explicit max TTL. After 4 hours, the application attempts to renew the token but receives an error. What is the most likely reason for the renewal failure?

Accepted Answer

The token is a batch token, which cannot be renewed.. Batch tokens are a special type of Vault token that are not persisted to storage and are designed for high scalability. They are not renewable, meaning they cannot be extended beyond their initial TTL. In this scenario, the application's attempt to renew the batch token fails because batch tokens do not support renewal, regardless of the remaining TTL.

Answer

The token's max TTL is less than 8 hours.

Answer

The token's TTL has already expired.

Answer

The token does not have a renewable flag set.

Question 3

A platform team is standardizing on the transit secrets engine for application-level encryption and wants to understand what the engine can and cannot do before rollout. Which TWO statements accurately describe transit engine behavior? (Choose two.)

Accepted Answer

The engine can generate a data key that returns both a plaintext key and a wrapped copy, so the caller may encrypt large payloads locally.. Transit ciphertext carries a key version so rotation does not break decryption of existing data, and the datakey endpoint supports envelope encryption for payloads too large for the encrypt endpoint. The engine deliberately does not store plaintext or ciphertext, and its default encryption is randomized rather than deterministic, so the claims about audit retention and identical ciphertext do not hold.

Answer

Deleting a transit key immediately makes all ciphertext ever produced with it permanently undecryptable in every deployment mode.

Answer

The engine stores the plaintext payloads it encrypts so that administrators can audit what data was protected.

Answer

Encrypting the same plaintext twice with the same key always yields identical ciphertext, which is required for indexing.

Question 4

A Vault operator needs to let an on-premises LDAP directory's groups map directly to Vault policies, but the directory does not implement any OIDC or SAML endpoints. Which auth method should the operator enable to authenticate users against that directory?

Accepted Answer

LDAP auth method. The LDAP auth method is designed to authenticate against an LDAP directory using standard bind operations and can map directory groups to Vault policies. Because the directory lacks OIDC or SAML capabilities, methods built on those protocols cannot be used, and a cloud-specific method like GitHub auth is unrelated to the on-premises directory.

Answer

GitHub auth method

Answer

SAML auth method

Answer

OIDC auth method

Question 5

A security architect is designing authentication for an internal tool that must verify a user's hardware-backed token on a smart card before granting access to secrets. The tool already has a PKI issuing client certificates to each user, and the architect wants Vault to validate the client certificate chain during login. Which auth method should be used, and what is the key configuration requirement?

Accepted Answer

Cert auth, with the trusted CA certificate uploaded so Vault can validate the presented client certificate against that CA.. Cert auth is purpose-built to authenticate clients from their TLS client certificates by validating the chain against a trusted CA configured on the mount. The architect must upload the issuing CA certificate and define role bindings such as allowed_common_names so the verified certificate maps to Vault policies, which aligns with the smart-card PKI already in place.

Answer

Username & Password auth, with the smart card PIN used as the Vault password and the certificate serial as the username.

Answer

JWT auth, with the smart card's certificate serial number embedded as a claim in a JWT signed by the internal PKI.

Answer

TLS certificate auth, with the certificate's private key imported into Vault so Vault can re-sign the client's requests.

Question 6

A security team encrypts records with a transit key and stores the resulting ciphertext. Months later they rotate the key several times. An application now needs to read old records, and the team also wants future writes to use only the newest key version without breaking decryption of the legacy rows. What is the accurate behavior of the transit engine in this situation?

Accepted Answer

Old ciphertext decrypts normally because the version prefix selects the correct key version, and new encrypt calls automatically use the latest version.. Transit ciphertext carries its key version, and Vault keeps prior versions available for decryption by default. Rotation therefore changes which version new encryptions use while leaving existing data readable. Rewrapping is an optional forward-migration step, not a requirement, and rotation does not purge older versions.

Answer

Decryption of old ciphertext fails after rotation, so every stored record must be re-encrypted with the new key version.

Answer

The application must call the rewrap endpoint on every stored record before any decryption can succeed after a rotation.

Answer

Rotation deletes older key versions by default, so only ciphertext produced after the most recent rotation can be decrypted.

Question 7

A security engineer is reviewing Vault's architecture and asks about the component that stores the actual encrypted data. Which Vault component is responsible for persisting encrypted secrets and configuration data?

Accepted Answer

The storage backend, such as Integrated Storage (Raft) or Consul, which stores encrypted data at rest.. The storage backend is the component that persists encrypted data at rest. Vault encrypts all data via the barrier before writing to the storage backend, which can be Integrated Storage (Raft), Consul, or a file system. This ensures that even if the storage is compromised, the data remains confidential.

Answer

The token store, which manages client tokens and their associated policies and metadata.

Answer

The audit device, which logs all requests and responses and stores them in a persistent file or syslog.

Answer

The seal mechanism, which holds the master key and unseal keys in memory during operation.

Question 8

A database secrets engine is configured at database/ with a connection to PostgreSQL and a role named app-readonly. The role uses creation_statements to create a user with a random password and a TTL of one hour. An application retrieves credentials and uses them successfully, but after the lease expires the database user still exists and can log in. Which configuration change should the administrator make to ensure the user is removed when the lease ends?

Accepted Answer

Add revocation_statements to the role that drop the user, and ensure the connection user has permission to execute them.. Dynamic database credentials are cleaned up by executing the role's revocation_statements when the lease is revoked or expires. If those statements are absent or the connection user lacks the privilege to run them, the created user remains. Supplying correct DROP USER statements and ensuring the connection user can execute them restores proper lifecycle management.

Answer

Enable the database secrets engine with a root rotation schedule to force user cleanup.

Answer

Set the role's credential_type to static_role and rely on automatic revocation.

Answer

Increase the default_ttl on the role to match the maximum_ttl so the lease never expires.

Question 9

A Vault administrator needs to delegate the ability to create tokens to a user without granting full administrative privileges. Which token type should the administrator create for the user to allow them to create tokens with specific policies?

Accepted Answer

A service token with a policy that includes the 'create' capability on the 'auth/token/create' path.. Delegating token creation requires a token that can be assigned policies allowing the creation of tokens. A service token with a policy that permits the 'create' capability on the token creation endpoint enables the user to create tokens with specified policies. This approach follows the principle of least privilege by limiting the user's abilities to exactly what is needed.

Answer

A batch token

Answer

An orphan token

Answer

A root token

Question 10

A platform engineer has issued dynamic AWS credentials through Vault's AWS secrets engine and wants to extend the usable lifetime of that credential before it expires. Which Vault CLI command allows the engineer to request additional time on the lease?

Accepted Answer

vault lease renew <lease_id>. Leases on dynamic secrets can be extended with vault lease renew, which asks the secrets engine to grant more time within the role's max_ttl boundary. Revoking destroys the credential, renewing a token affects authentication rather than the secret, and re-writing the creds path issues a separate credential instead of extending the current one.

Answer

vault token renew <token>

Answer

vault write aws/creds/my-role ttl=1h

Answer

vault lease revoke <lease_id>

Question 11

A security engineer is troubleshooting why a Vault token cannot be renewed. The token was created with a TTL of 4 hours and is renewable. After 2 hours, the engineer attempts to renew it using `vault token renew <token>` but receives the error: "lease not found". The engineer confirms the token is still valid and not expired. Which of the following is the most likely cause?

Accepted Answer

The token's lease was revoked or expired, possibly due to a parent token revocation or lease cleanup, even though the token itself remains valid.. The "lease not found" error during token renewal typically means the lease record for the token is no longer present in Vault's storage. This can occur if the token's parent was revoked, which cascades to revoke child tokens and their leases, or if the lease was manually revoked or expired due to a separate lease ID. The token itself may still be within its TTL and appear valid, but without a lease, renewal is impossible. The engineer should investigate recent revocations or lease cleanup operations.

Answer

The token's TTL has been exceeded, causing Vault to delete the lease record.

Answer

The token was created with the -no-default-policy flag, which disables renewal.

Answer

The token was created with a period but no explicit max TTL, and the period has not yet elapsed.

Question 12

A Vault operator needs to enable the `userpass` auth method at the path `auth/legacy-userpass` and then create a user named `svc-backup` with a password, all from a CI script. Which single command correctly enables the auth method at that custom path?

Accepted Answer

vault auth enable -path=legacy-userpass userpass. The `vault auth enable` command mounts an auth method, and its `-path` flag sets a custom mount path so the method lives at `auth/legacy-userpass` rather than the default `auth/userpass`. The method type is the trailing positional argument. Using `vault secrets enable` targets secrets engines instead, and writing to `sys/auth` directly is the raw API path rather than the intended CLI interface.

Answer

vault auth enable userpass -path=legacy-userpass

Answer

vault write sys/auth/legacy-userpass type=userpass

Answer

vault secrets enable -path=legacy-userpass userpass

Question 13

A platform team is designing an encryption-as-a-service layer with the transit secrets engine for several internal applications. They want to minimize the amount of sensitive data that reaches application memory and reduce the operational cost of rotating keys. Which TWO design choices align with how the transit engine is intended to be used? (Choose two.)

Accepted Answer

Have applications call the encrypt and decrypt endpoints so plaintext never leaves the application but key material never reaches it.. The transit engine supports two complementary patterns: direct encrypt/decrypt calls that keep keys inside Vault, and envelope encryption using the datakey endpoint so bulk data is encrypted locally with a wrapped key stored alongside it. Both minimize key exposure and make rotation manageable. Exporting keys, disabling versioning, or persisting plaintext data keys all undermine those goals.

Answer

Export the transit key and distribute copies to each application so they can encrypt without any runtime dependency on Vault.

Answer

Disable key versioning on all keys so that rotation does not create new versions that applications must track.

Answer

Store the plaintext data key in the application's configuration file so services can reuse it across restarts and avoid extra Vault calls.

Question 14

A developer wants to inspect the metadata of the current Vault token, including its attached policies, TTL, and whether it is renewable, using a single CLI command. Which command should the developer run?

Accepted Answer

vault token lookup. The `vault token lookup` command retrieves metadata for the calling token when no token argument is supplied, exposing fields like `policies`, `ttl`, `renewable`, and `accessor`. It is a read-only operation with no side effects, unlike renewal. Commands such as `vault auth list` or `vault token capabilities` serve entirely different purposes and cannot report the token's policies and TTL.

Answer

vault token renew

Answer

vault auth list

Answer

vault token capabilities

Question 15

A compliance team is evaluating the Vault transit secrets engine as encryption as a service for several internal applications. They want to confirm which statements accurately describe how the engine behaves. (Choose two.)

Accepted Answer

The transit engine supports key rotation while retaining prior versions so previously produced ciphertext remains decryptable.. The transit engine performs cryptographic operations inside Vault and returns only protected output, keeping keys non-exportable. It supports versioned key rotation so old ciphertext still decrypts, which is essential for long-lived data. It does not store plaintext, does not require sealing to mount, and does not export keys by default, so those statements misrepresent its security model and operational behavior.

Answer

Enabling the transit engine requires Vault to be sealed and then unsealed before any key can be created.

Answer

The transit engine stores plaintext copies of all encrypted data for audit and recovery purposes.

Answer

Transit keys are exportable by default so applications can cache them locally for offline encryption.