VA-003 Practice Test 27 — 15 Questions

Question 1

Refer to the exhibit. A Vault administrator configures a three-node cluster with the above configuration on all nodes (with appropriate node_id). After starting all nodes, the administrator unseals node2 and node3. Node1 remains sealed. What will be the cluster state?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Nodes 2 and 3 will form a quorum and elect a leader; Node1 will be a standby when unsealed.. In a Vault cluster, a quorum requires a majority of nodes to be unsealed and available. With three nodes, the quorum size is 2. Nodes 2 and 3, both unsealed, form a quorum and elect a leader among themselves. Node1, though sealed, is still a cluster member; once unsealed, it will join as a standby node, not as a leader, because the leader election has already occurred.

Answer

Nodes 2 and 3 will each try to become leader, causing a split-brain.

Answer

Node1 will automatically join the cluster once unsealed.

Answer

The cluster will be unavailable because Node1 is sealed.

Question 2

Which TWO are core components of Vault's architecture?

Accepted Answer

Seal. The Seal is a core component of Vault's architecture because it provides the mechanism to encrypt and decrypt the master key, which is used to protect all other keys and data within Vault. When Vault is sealed, the master key is encrypted and cannot be accessed, rendering the Vault unable to decrypt its data. Unsealing requires a threshold of unseal keys to reconstruct the master key, ensuring that no single individual can access the Vault's secrets.

Answer

Audit device

Answer

Auth method

Answer

Replication

Question 3

A Vault administrator needs to create a policy for a developer who must read and list secrets from the path 'secret/data/engineering/' and create new secrets under 'secret/data/engineering/projects/'. Which two policy statements should the administrator include? (Choose two.)

Accepted Answer

path "secret/data/engineering/projects/*" { capabilities = ["create"] }. The developer needs to create new secrets under 'secret/data/engineering/projects/', which requires the 'create' capability on that path. Option E is correct because the developer needs to read and list secrets from 'secret/data/engineering/', and the wildcard 'secret/data/engineering/*' covers all paths under that prefix, including the base path itself when using KV v2 (the 'data/' prefix is part of the path).

Answer

path "secret/data/engineering/projects/*" { capabilities = ["create","update"] }

Answer

path "secret/data/engineering" { capabilities = ["read","list"] }

Answer

path "secret/engineering/*" { capabilities = ["read","list"] }

Question 4

A large enterprise runs Vault in a production environment with multiple secrets engines, including databases, AWS, and PKI. Recently, the operations team noticed that the number of active leases has grown significantly, causing performance degradation in Vault. The team suspects that many leases are orphaned or expired but not cleaned up. They run the vault lease tidy command regularly, but the issue persists. The vault audit logs show no errors during revocation. However, the team observes that the database credentials are being revoked correctly, but the PKI certificates are not being revoked when their leases expire. Additionally, some AWS IAM user leases seem to persist beyond their max TTL. What is the most likely cause of this issue?

Accepted Answer

The PKI and AWS secrets engines require explicit revocation of the underlying secret, which is not triggered by lease expiration alone.. In Vault, lease expiration triggers revocation only for secrets engines that support automatic revocation at the Vault level. The PKI secrets engine does not automatically revoke issued certificates when a lease expires; it only removes the lease metadata. Similarly, AWS IAM user credentials are not automatically revoked upon lease expiration because the underlying secret (the IAM user or access key) must be explicitly revoked via the AWS API. The `vault lease tidy` command cleans up stale lease entries in Vault's storage but does not trigger revocation of the underlying secrets for these engines.

Answer

The max_ttl setting for the PKI and AWS roles is set incorrectly.

Answer

The vault lease tidy command is not effective for PKI and AWS secrets engines.

Answer

The Vault server's clock is out of sync, causing lease expiration calculations to be inaccurate.

Question 5

A company has deployed Vault with an LDAP auth method and has created entity aliases for all users. The company uses KV v2 secrets engine mounted at 'secret/'. Each team's secrets are stored under a path like 'secret/data/team_<team_name>/'. They have multiple teams (engineering, marketing, sales). Currently, an administrator manually creates a separate policy for each team, e.g., path "secret/data/team_engineering/*" { capabilities = ["read", "list"] }. This is becoming cumbersome as new teams are added. The administrator wants to create a single policy that dynamically grants read access to the secrets path corresponding to the user's team, which is stored in the entity's metadata as 'team'. The LDAP auth method is configured to sync group memberships and map to entity aliases, and the entity metadata is correctly populated. Which approach should the administrator take?

Accepted Answer

Create a policy using a templated path: path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }.. Vault's ACL policy templating allows dynamic path construction using entity metadata. By using `{{identity.entity.metadata.team}}` in the policy path, the policy automatically resolves to the team name stored in the user's entity metadata, granting read/list access only to that team's secrets path. This eliminates the need for per-team policies while maintaining least-privilege access.

Answer

Create a policy using a wildcard alias for each team in the entity alias.

Answer

Create a policy that uses the 'default' policy to allow all reads and then restrict with ACL tokens.

Answer

Create a policy with path "secret/data/*" { capabilities = ["read", "list"] } and assign it to all users.

Question 6

An admin needs to store a configuration value that is unique to each Vault client and must not be shared. Which secrets engine should they use?

Accepted Answer

Cubbyhole. The Cubbyhole secrets engine creates a private, ephemeral storage space that is scoped to the requesting token. Each token gets its own isolated cubbyhole, and no other client or token can read or write to it, even with root privileges. This makes it the only built-in engine that guarantees a configuration value is unique to each Vault client and cannot be shared.

Answer

AWS

Answer

KV v2 at a client-specific path

Answer

Transit

Question 7

This Vault agent configuration section is incomplete. What is missing for the AWS auto-auth method to function correctly?

Accepted Answer

AWS credentials must be provided via environment variables or instance metadata. The AWS auth method in Vault requires valid AWS credentials to authenticate against AWS STS. These credentials can be provided via environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or automatically retrieved from instance metadata when running on an EC2 instance. Without them, Vault cannot sign the STS request to verify the caller's identity, causing authentication to fail.

Answer

The configuration needs a 'region' parameter

Answer

The role name 'my-role' is invalid

Answer

The method type should be 'iam' instead of 'aws'

Question 8

A security policy requires that encryption keys used in transit must never leave Vault's memory. However, development teams need to perform encryption offline in CI/CD pipelines. How can this be accomplished?

Accepted Answer

Use Vault's datakey endpoint to get a wrapped key that can be unwrapped offline. Vault's `datakey` endpoint generates a data encryption key (DEK) that is wrapped by a Vault-managed key. The wrapped DEK can be safely stored and used offline in CI/CD pipelines, while the unwrapped key material never leaves Vault's memory — the DEK is unwrapped only when needed, and the wrapping key remains in Vault. This satisfies the policy requirement that encryption keys used in transit must never leave Vault's memory, as the DEK itself is not a transit key but a data key that can be used offline.

Answer

Use exportable keys and export them

Answer

Use Vault's transit encrypt with context

Answer

Use Vault's ciphertext rewrap

Answer

It is not possible; keys must stay in Vault

Question 9

Which THREE statements about token accessors are true?

Accepted Answer

They can be used to look up token metadata without the token ID. Token accessors have multiple capabilities. Option A is correct because accessors allow lookup of token metadata without the token ID via the lookup-accessor endpoint. Option B is correct because the renew-accessor endpoint allows token renewal using only the accessor. Option C is correct because the revoke-accessor endpoint allows token revocation using the accessor. Option E is correct because each token has a unique accessor generated at creation. Option D is incorrect because accessors are UUID strings, not human-readable.

Answer

They are human-readable strings

Question 10

A DevOps engineer needs to create a token that can only read secrets under the path 'secret/engineering'. What is the recommended approach?

Accepted Answer

Create a policy that allows read on secret/engineering/* and attach it to the token. Vault's recommended approach for granting least-privilege access is to create a policy that explicitly defines the allowed actions and paths, then attach that policy to the token. A policy with `path "secret/engineering/*" { capabilities = ["read"] }` ensures the token can only read secrets under that specific path, adhering to the principle of least privilege.

Answer

Create a token with a short TTL so it expires quickly

Answer

Create a token with the default policy only

Answer

Use the root token and restrict usage with a low TTL

Question 11

A security team needs to automate the rotation of a database password stored in Vault. The password is currently written as a static secret at 'database/creds/prod'. They want to use the Vault API to read and rewrite the secret, ensuring that the previous version is preserved for audit. The script must handle the case where the secret path may not exist. Which approach should they use?

Accepted Answer

Use POST to write a new version at the secret path, which automatically preserves previous versions. Vault's KV Secrets Engine (version 2) uses POST to create a new version of a secret at a given path, automatically preserving previous versions for audit. This approach ensures the password is rotated without data loss, and the API handles non-existent paths by creating the secret if it does not exist, satisfying the requirement to handle missing paths gracefully.

Answer

Use GET on the secret path, then PUT with the new data including the old version's data

Answer

Use DELETE to remove the old secret, then POST to create a new one

Answer

Use PUT to write the new password directly, then use GET to verify

Question 12

Which THREE of the following are true about using the Vault API with response wrapping? (Choose three.)

Accepted Answer

The wrapping token can only be used once to unwrap the response. The Vault API's response wrapping feature is designed for one-time use: the wrapping token can be used only once to unwrap the response. After the client successfully calls the sys/wrapping/unwrap endpoint with the wrapping token, the token is immediately revoked, and the wrapped secret is deleted from the cubbyhole. This ensures that the secret is delivered securely and cannot be retrieved again with the same token.

Answer

The wrapping token never expires

Answer

The original token used to make the wrapped request is required to unwrap the response

Question 13

A team wants to use Vault's AWS auth method to authenticate EC2 instances. Which architectural requirement must be met?

Accepted Answer

Vault must be able to reach the AWS metadata endpoint. The AWS auth method in Vault authenticates EC2 instances by verifying the instance's identity via the AWS metadata endpoint (http://169.254.169.254/latest/meta-data/). Vault must be able to reach this endpoint to retrieve the instance's PKCS7 signature, instance ID, and account ID, which are used to validate the instance's IAM role and ensure it matches the configured auth role. Without network access to the metadata endpoint, Vault cannot perform the cryptographic verification required for authentication.

Answer

Each EC2 instance must have an IAM role attached

Answer

Vault must have AWS API credentials configured

Answer

Vault must be deployed on an EC2 instance in the same region

Question 14

A Vault operator runs 'vault token lookup s.abc123' and sees that the token type is 'service', renewable is true, but the ttl is 30m and creation_ttl is 1h. The token has num_uses set to 0. What is the most likely explanation for the discrepancy between ttl and creation_ttl?

Accepted Answer

30 minutes have elapsed since the token was created. The token's current TTL (30m) is shorter than its creation_ttl (1h) because 30 minutes have already elapsed since the token was issued. The TTL dynamically decreases as time passes, while creation_ttl remains fixed at the original value set at token creation. This is normal behavior for a renewable service token with num_uses=0.

Answer

The token has renewable set to false

Answer

The token type is service, so it cannot be renewed

Answer

The token has been used and num_uses decremented

Question 15

A junior administrator is writing a shell script that will be used by other team members to retrieve static secrets from Vault. The secrets are stored in the KV v2 secrets engine mounted at `secret/`. One particular secret, `credentials`, is located under the path `secret/data/credentials`. The administrator has already authenticated using the Vault CLI with a token that has read access specifically to that path. The environment variables `VAULT_ADDR` and `VAULT_TOKEN` are set correctly to point to the Vault server at `https://vault.example.com:8200` and the valid token. The script needs to run the correct command to retrieve the secret and output its key-value pairs for use by an application. Which command should the administrator include in the script?

Accepted Answer

vault kv get secret/credentials. `vault kv get secret/credentials` is the proper command for the KV v2 secrets engine. The KV v2 engine automatically appends `/data/` to the path when reading secrets, so specifying the full path `secret/data/credentials` would result in a double `/data/` prefix, causing a 404 error. Since the environment variables are set and the token has read access, this command will retrieve the secret and output its key-value pairs.

Answer

vault kv get secret/data/credentials

Answer

vault read secret/data/credentials

Answer

vault read secret/credentials