VA-003 Practice Test 27 — 15 Questions

Question 1

A platform team runs Vault in an on-premises data center. Their legacy monitoring appliance cannot present a TLS client certificate and has no cloud identity provider, but it does have a dedicated filesystem path where it can read a small configuration file written at deployment time. The team wants the appliance to authenticate on a schedule with credentials that can be issued per appliance, scoped by policy, and revoked without affecting other appliances. Which authentication method best fits this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AppRole. AppRole is the machine-oriented authentication method that issues each client a RoleID and a SecretID, both of which can be delivered through a file on the appliance. Roles are bound to policies, and SecretIDs can be revoked individually, allowing the platform team to isolate and revoke a single appliance without impacting others. The other methods require capabilities the appliance does not have.

Answer

JWT/OIDC

Answer

TLS Certificates

Answer

Username & Password

Question 2

An admin is troubleshooting a Vault cluster where some dynamic secrets leases are not being revoked after their TTL expires. The admin confirms that the TTLs are set correctly. Which Vault component is responsible for revoking expired leases?

Accepted Answer

The expiration manager. The expiration manager is the Vault internal component that tracks lease TTLs and triggers revocation when leases expire. If leases are not being revoked despite correct TTLs, the expiration manager is the primary suspect. It runs within the Vault core and coordinates with secrets engines to revoke credentials. Other components like storage, audit, and secrets engines do not initiate revocation.

Answer

The audit device

Answer

The Vault storage backend

Answer

The secrets engine plugin

Question 3

A developer is writing a microservice that must encrypt a small JSON payload using the transit secrets engine's 'orders' key, but the service must never be able to read the key material itself. Which API call should the service use to obtain ciphertext?

Accepted Answer

POST /v1/transit/encrypt/orders with the base64-encoded plaintext in the request body.. Encryption as a service means the application sends plaintext to Vault and receives ciphertext, while the key stays inside Vault's barrier. The encrypt endpoint on the named key is the only listed call that performs the operation server-side without exposing key material, and it records the operation for auditing.

Answer

PUT /v1/transit/keys/orders with the plaintext in the request body to have Vault store and encrypt it.

Answer

GET /v1/transit/keys/orders to retrieve the key, then encrypt with it in application code.

Answer

POST /v1/transit/datakey/plaintext/orders to obtain a data key and encrypt the payload locally.

Question 4

An application team needs to encrypt short-lived session tokens before writing them to a Redis cache. They want to avoid handling or storing encryption keys in the application and need the ability to decrypt tokens later without re-encrypting. Which Vault transit secrets engine operation should they use to protect the data at write time?

Accepted Answer

transit/encrypt/<key_name>. Encryption as a service means Vault performs the cryptographic operation and returns ciphertext while keeping the key inside Vault. The transit encrypt endpoint is the direct way to protect plaintext so it can later be recovered with decrypt. Endpoints like datakey, rewrap, and hmac serve different purposes such as envelope encryption, key rotation, or integrity checking.

Answer

transit/hmac/<key_name>

Answer

transit/datakey/plaintext/<key_name>

Answer

transit/rewrap/<key_name>

Question 5

A platform team runs Vault in a hybrid cloud and wants to let engineers log in with their existing corporate identities held in Okta, without creating separate Vault usernames or passwords. The Okta tenant supports OpenID Connect and exposes a discovery document. Which authentication method should they enable to meet this requirement with the least administrative overhead?

Accepted Answer

Enable the OIDC auth method and configure it with the Okta discovery URL and a client ID/secret registered in Okta.. Federated login against an OIDC-capable identity provider is served by Vault's OIDC auth method, which consumes the provider's discovery document and validates ID tokens. The other methods either require a static bind credential, depend on an unrelated identity source, or duplicate credentials inside Vault, none of which satisfies least-overhead federation with Okta.

Answer

Enable the Username & Password auth method and synchronize Okta user records into Vault on a schedule.

Answer

Enable the GitHub auth method and map Okta users by their GitHub organization membership.

Answer

Enable the LDAP auth method and bind Vault to the Okta LDAP interface using a service account.

Question 6

An operator runs `vault token create -policy=app -ttl=1h -explicit-max-ttl=2h` and then checks the token's properties with `vault token lookup`. The token is renewable. A developer asks whether the token can be kept alive indefinitely by renewing it every 30 minutes. What should the operator tell the developer?

Accepted Answer

The token can be renewed only until its explicit max TTL of 2 hours is reached; after that, renewal fails and the token expires.. The token was created with an explicit max TTL, which acts as a hard cap on its total lifetime. Renewals are permitted only while the token's age is less than the explicit max TTL. Once that limit is reached, Vault refuses further renewals and the token expires. The developer cannot keep the token alive indefinitely by renewing it; they must obtain a new token. This behavior ensures that tokens cannot outlive their configured maximum lifetime.

Answer

The token can be renewed indefinitely because the default max TTL of 32 days overrides the explicit max TTL.

Answer

The token can be renewed indefinitely because it has a TTL and is renewable.

Answer

The token cannot be renewed at all because an explicit max TTL disables renewal.

Question 7

An operator creates a batch token for a one-time database migration. The migration finishes, and the operator wants the token to be unusable immediately, even before its TTL expires, and wants to confirm the token no longer appears in the token list. Which Vault command accomplishes this?

Accepted Answer

vault token revoke <token_id>. Revocation is the only operation that immediately invalidates a token before its TTL elapses. Using vault token revoke with the specific token ID destroys that token and its descendants, so subsequent requests fail and the token no longer appears in token listings. Renewal extends life, self-revocation targets the caller, and lookup is read-only.

Answer

vault token renew <token_id>

Answer

vault token revoke -self

Answer

vault token lookup <token_id>

Question 8

An administrator is configuring Vault to allow employees to log in using their existing corporate credentials managed by an external identity provider that supports OIDC. The administrator wants to avoid creating local Vault users. Which authentication method should be used?

Accepted Answer

OIDC auth method. OIDC auth method enables authentication via an external OIDC identity provider, allowing employees to use corporate credentials without local Vault users. It supports standard OIDC flows and JWT validation, making it the right choice for integrating with an OIDC-capable IdP.

Answer

Okta auth method

Answer

LDAP auth method

Answer

Username & Password auth method

Question 9

A Vault administrator is troubleshooting a batch of revoked database credentials. An application reported that its lease stopped working even though the application had been renewing it every few minutes. Reviewing the mount configuration, the administrator sees default_lease_ttl set to 15m and max_lease_ttl set to 2h. The application log shows successful renewals until roughly the two-hour mark, after which the renew call returned an error and the credential failed. What is the most likely explanation?

Accepted Answer

The lease reached the mount's max_lease_ttl, so renewal could no longer extend it and the credential had to be reissued.. The mount's max_lease_ttl defines the absolute cumulative lifetime of a lease, and renewal cannot push a lease past that boundary. The application's renewals succeeded until the lease reached two hours, at which point renewal failed and the credential expired. The correct remediation is for the application to request a new credential when renewal is no longer granted.

Answer

The database engine rotated its root credentials, which invalidated every outstanding dynamic credential at once.

Answer

The application's token expired, causing all leases it created to be revoked automatically at the same time.

Answer

The application exceeded its allowed renewal count, and Vault rejected the renewal after a fixed number of attempts.

Question 10

A cloud operations team wants to use Vault to generate dynamic credentials for an AWS RDS MySQL database. They have configured the database secrets engine and created a role named 'app-role' that maps to a database creation statement. A developer needs to obtain a username and password to connect to the database. Which command should the developer run to retrieve the dynamic credentials?

Accepted Answer

vault read database/creds/app-role. Dynamic database credentials are generated by reading from the 'creds' endpoint of the database secrets engine for a specific role. The 'vault read database/creds/app-role' command triggers Vault to execute the role's creation statements and return a new username and password. Other commands either configure the role, target static roles, or use the wrong secrets engine.

Answer

vault read database/static-creds/app-role

Answer

vault kv get database/creds/app-role

Answer

vault write database/roles/app-role

Question 11

An administrator is troubleshooting a policy where a token unexpectedly has permission to read 'secret/data/finance/payroll' even though the attached policy only contains a statement for 'secret/data/hr/*'. The administrator confirms the policy is attached correctly and the path is not covered by any wildcard in it. What is the most likely explanation?

Accepted Answer

The token also has the default policy or another policy attached that contains a matching statement for the finance path.. Vault authorization is the union of every policy attached to the token, and a single matching statement anywhere in that set is enough to allow a request. A policy scoped to the hr prefix cannot grant finance access by itself, so the presence of extra policies, including the default policy, is the logical explanation. Auditing the token's complete policy list confirms it.

Answer

Wildcard matching in Vault is greedy, so the hr wildcard also matches sibling prefixes like finance.

Answer

Reading a KV v2 secret requires only the metadata path, so the finance secret is exposed through an unrelated metadata grant.

Answer

The policy was written with a trailing wildcard that Vault silently strips, leaving a root-level grant.

Question 12

A team wants to store encrypted backups in object storage and needs the ability to rotate the wrapping key over time without re-uploading every backup object. They also want the plaintext data key to be used only in memory by the backup agent. Which combination of Vault transit operations best fits this design?

Accepted Answer

Use transit/datakey/plaintext to obtain a data key, encrypt the backup locally, store the wrapped key alongside the object, and later use transit/rewrap on the wrapped key when rotating.. Envelope encryption keeps large payloads out of Vault: datakey supplies a plaintext data key plus a wrapped copy, the agent encrypts locally, and only the wrapped key is stored with the object. Rewrap then rotates the wrapper under a new transit key version without re-uploading data. This separates the bulk ciphertext from the key-protection layer and meets the in-memory requirement.

Answer

Use transit/encrypt on each backup and store only the returned ciphertext.

Answer

Use transit/sign to sign the backup, then store the signature as the encryption key.

Answer

Use transit/hmac to derive a key from the backup contents and store that digest with the object.

Question 13

A security engineer needs to create a batch token that will be used by an external system for a one-time operation. The token must be self-contained and not stored in Vault's storage backend. Which token type should be used, and what is a key limitation of that token type?

Accepted Answer

Batch token; it cannot be renewed or revoked, and it is not stored in Vault's storage backend.. Batch tokens are designed to be lightweight and self-contained, meaning they are not persisted in Vault's storage backend. This makes them suitable for ephemeral use cases where the token will not be renewed or revoked. The key limitation is that they cannot be renewed or revoked individually, which is acceptable for a one-time operation.

Answer

Periodic token; it can be renewed indefinitely but is stored in Vault's storage backend.

Answer

Root token; it is not stored in Vault's storage backend and can be used for any operation.

Answer

Service token; it cannot be renewed or revoked individually.

Question 14

A small development team wants engineers to log in to Vault with a username and password stored directly in Vault, without integrating any external directory or identity provider. Which authentication method should the administrator enable to satisfy this requirement?

Accepted Answer

userpass. Userpass is the built-in method that keeps usernames and password hashes inside Vault's storage backend, requiring no external directory or identity service. Administrators manage users and their policies directly through the auth mount, which fits a small team that wants simple, self-contained authentication with minimal setup.

Answer

github

Answer

ldap

Answer

okta

Question 15

A Vault administrator is configuring a new Vault server. The server will store secrets in a HashiCorp Consul cluster. The administrator writes a configuration file with the `storage` stanza pointing to Consul and starts Vault. After initialization and unsealing, the administrator notices that Vault is functioning but wants to ensure that the storage backend is highly available. Which statement about Vault's storage backend is accurate?

Accepted Answer

Vault requires a storage backend that supports high availability, and Consul provides that by allowing multiple Vault nodes to access the same data.. Consul is a supported high-availability storage backend for Vault. It allows multiple Vault servers to share the same storage, enabling a cluster with one active node and multiple standby nodes. This provides failover capabilities and ensures that Vault remains available if the active node fails. Other backends like integrated storage (Raft) also provide HA, but Consul is a common choice for external storage.

Answer

The storage backend must be a local file system for Vault to function correctly; network-based storage is not supported.

Answer

Vault encrypts data before sending it to the storage backend, so the backend does not need to provide encryption at rest.

Answer

Vault's storage backend is only used for storing the encryption keys and not for secret data, so high availability is not a concern.