VA-003 Practice Test 29 — 15 Questions

Question 1

Match each Vault policy capability to its permission.

Accepted Answer

create: Allows creating data at the path.. The correct matches are: create allows creating data, read allows reading data, update allows updating data, and delete allows deleting data. Common confusions involve swapping create and read capabilities.

Answer

create: Allows reading data at the path.

Answer

read: Allows creating data at the path.

Question 2

Match each Vault storage backend to its description.

Accepted Answer

Consul: Stores data in a highly available key-value store, commonly used for Vault's backend.. Vault supports multiple storage backends. Consul and Integrated Raft are both highly available, while File is for single-node setups. Common confusions include mixing Consul's distributed KV nature with file-based storage or incorrectly attributing external dependencies to Raft.

Answer

Consul: Stores data in encrypted files on disk with manual replication.

Answer

Integrated Raft: Stores data in an external key-value store like etcd.

Question 3

A company wants to use Vault to generate IAM users dynamically for each application, following the principle of least privilege. Which secrets engine configuration should they use?

Accepted Answer

Enable AWS engine with a dedicated IAM user (limited permissions) and use 'iam_user' credential type. The AWS secrets engine can be configured with a dedicated IAM user that has limited permissions, and by using the 'iam_user' credential type, Vault dynamically creates a new IAM user for each application. This approach adheres to the principle of least privilege by ensuring each application gets a unique set of credentials scoped to its specific needs, without sharing or reusing static keys.

Answer

Enable AWS engine with a root IAM user and use 'federation_token' credential type

Answer

Enable AWS engine with a static access key and use 'iam_user' credential type

Answer

Enable AWS engine with an IAM role and use 'assumed_role' credential type

Question 4

Which TWO of the following are true about Vault token accessors?

Accepted Answer

An accessor can be used to revoke a token without having the token ID.. Vault token accessors allow token revocation without the token ID itself. The accessor is a separate, non-sensitive reference that can be used to perform token revocation. Option E is incorrect because Vault does not provide a renew-accessor endpoint; token renewal requires the actual token ID.

Answer

An accessor is the same as the token ID.

Answer

Accessors are unique only within a namespace.

Answer

An accessor is required to look up token properties.

Answer

An accessor can be used to renew a token without having the token ID.

Question 5

Which TWO of the following are valid secrets engines in Vault? (Select exactly 2.)

Accepted Answer

Active Directory. Options A (Active Directory) and C (SSH) are both valid secrets engines in Vault. Option B (AWS) is also a secrets engine but not one of the two required answers. Option D (LDAP) is an auth method, not a secrets engine. Option E (Transit) is also a valid secrets engine, but the question expects the two that are most directly related to credential management, hence A and C are correct.

Answer

AWS

Answer

LDAP

Answer

Transit

Question 6

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Accepted Answer

Modify the application to renew the lease before it expires using the lease ID.. Both options B and C describe valid approaches to renewing the Vault lease. Option B correctly states that the application must modify its code to renew the lease before it expires using the lease ID. Option C is also correct because calling `sys/leases/renew` periodically with the lease ID achieves the same goal; the phrase 'periodically' is acceptable as long as the renewal happens before the lease expires. Options A and D are incorrect because increasing the TTL does not address the application's failure to renew the lease, and simply revoking and requesting a new credential without renewal will lead to the same issue.

Answer

Revoke the lease and request a new credential with a longer TTL.

Answer

Increase the TTL of the database role to 2 hours.

Question 7

Refer to the exhibit. A Vault administrator starts a Vault server and receives this error. What is the most likely cause?

Accepted Answer

The storage stanza is missing from the configuration file.. The error indicates that Vault cannot find a configured storage backend. The storage stanza is mandatory in Vault's configuration file because it defines where Vault persists its data (e.g., Consul, Raft, file). Without it, the server fails to start because it has no backend to store secrets and state.

Answer

The Vault binary is corrupt.

Answer

The listener address is incorrect.

Answer

The seal stanza is misconfigured.

Question 8

A Vault cluster has two nodes configured for HA. The active node becomes unresponsive, and the standby node takes over. However, clients cannot connect to the new active node. The firewall rules allow traffic on port 8200. What is the most likely issue?

Accepted Answer

The TLS certificate on the standby node is not valid for the hostname clients are using.. When a standby node becomes active, clients connect using the same hostname as before. If the TLS certificate on the standby node does not include that hostname, TLS handshake fails, preventing client connections. Option A is incorrect because the standby node successfully took over, meaning it has access to the storage backend. Option C is incorrect because a tainted node indicates data corruption, not blocking client requests. Option D is incorrect because a sealed node cannot become active; if it were sealed, it would not have taken over.

Answer

The standby node cannot connect to the storage backend.

Answer

The original active node is tainted and blocking client requests.

Answer

The standby node is still sealed and cannot serve requests.

Question 9

An operator runs `vault lease renew -increment=3600 database/creds/readonly/abc123` and gets an error: 'Error renewing lease: Error making API request. URL: PUT https://vault.example.com/v1/sys/leases/renew. Code: 400. Errors: * invalid lease ID'. What is the most likely cause?

Accepted Answer

The lease ID is incomplete; it should include the full path like 'database/creds/readonly/abc123'. The error 'invalid lease ID' indicates that the lease ID provided to the `vault lease renew` command is malformed or incomplete. In Vault, a lease ID for dynamic secrets like database credentials is a full path that includes the mount point, role name, and a unique UUID (e.g., `database/creds/readonly/abc123/xyz789`). The command only passed `database/creds/readonly/abc123`, which is the role path, not the full lease ID. The correct lease ID can be retrieved from the initial secret response or via `vault list sys/leases/lookup/database/creds/readonly`.

Answer

The lease has already expired and cannot be renewed

Answer

The increment value is too large and exceeds the maximum TTL

Answer

The operator does not have permission to renew leases

Question 10

A policy must allow a user to write a new version of an existing secret in a KV v2 secrets engine. Which TWO capabilities are required on the 'data/' path?

Accepted Answer

update. In KV v2, writing a new version of an existing secret uses the 'data/' endpoint with a POST/PATCH request. The 'update' capability is sufficient for modifying an existing secret. The 'create' capability is only needed when the secret path does not already exist. Since the stem specifies an 'existing secret', only 'update' is required. Therefore, only one capability is needed, not two.

Answer

delete

Answer

list

Answer

read

Answer

create

Question 11

An admin wants to list all enabled authentication methods using the Vault API. Which curl command is correct?

Accepted Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auth. The Vault API endpoint to list all enabled authentication methods is a GET request to `/v1/sys/auth`. This endpoint returns a map of all enabled auth methods, and the command uses the correct HTTP method (GET) and the required `X-Vault-Token` header for authentication.

Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auths

Answer

curl -X POST -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auth

Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/auth

Question 12

An operator runs vault lease list and sees many expired leases. Why are expired leases still listed?

Accepted Answer

Vault keeps expired leases for auditing until cleaned up by garbage collection.. Vault does not immediately remove expired leases; they are cleaned up by a periodic garbage collection process. Until then, they may appear in listing.

Answer

The leases are not actually expired.

Answer

The operator has a permission to see expired leases.

Answer

Expired leases are never removed.

Question 13

An organization is creating Vault policies to manage access to secrets across multiple application teams. According to HashiCorp best practices, which two approaches should be taken when designing policies? (Choose two.)

Accepted Answer

Use path templating to incorporate entity metadata.. HashiCorp recommends using path templating with entity metadata (e.g., {{identity.entity.metadata.team}}) to dynamically scope policies to specific teams or applications. This approach reduces policy sprawl and ensures that permissions are automatically applied based on the authenticated entity's attributes, aligning with the principle of least privilege.

Answer

Avoid using negative capabilities (deny) when possible.

Answer

Grant maximum permissions initially and then restrict as needed.

Answer

Use a single all-encompassing policy for each environment.

Question 14

A DevOps engineer is troubleshooting a script that uses the Vault CLI to authenticate and read a secret. The script works when run manually from a terminal, but fails when executed by a CI/CD pipeline. The engineer has verified that the same environment variables (VAULT_ADDR, VAULT_TOKEN) are set in both environments. Which two of the following are likely causes of the failure? (Choose two.)

Accepted Answer

The pipeline does not have the VAULT_ADDR variable set correctly.. Even though the engineer verified that VAULT_ADDR is set in both environments, the CI/CD pipeline might have a different value or a typo in the variable definition. The Vault CLI uses the VAULT_ADDR environment variable to determine the endpoint for API calls; if it points to a wrong or unreachable address, authentication and secret retrieval will fail. This is a common misconfiguration when environment variables are injected differently in pipeline contexts versus manual shells.

Answer

The pipeline's VAULT_TOKEN is expired or revoked.

Answer

The pipeline uses a different version of the Vault CLI.

Answer

The pipeline's shell does not have the vault binary in the PATH.

Question 15

A Vault instance was upgraded from version 1.9 to 1.13. After the upgrade, a secrets engine mounted at 'transit/' is unresponsive and returns an error. The engine type is transit. What is the most likely cause?

Accepted Answer

The engine was accidentally disabled during the upgrade. During a Vault upgrade, there is a possibility that the upgrade process inadvertently disables certain secrets engines if there are configuration conflicts or if the engine was enabled using deprecated methods. This is especially likely in major version jumps like from 1.9 to 1.13, where significant changes in the engine management code could lead to such issues. Options B, C, and D are incorrect: namespaces are not altered during upgrades, the transit engine can be mounted at any path, and since transit is built-in, plugin incompatibility does not apply.

Answer

The namespace was changed during the upgrade

Answer

The transit engine can only be mounted at the default path 'transit/'

Answer

The plugin version is incompatible with the new Vault version