VA-003 Practice Test 30 — 15 Questions

Question 1

A DevOps engineer creates the configuration above. After testing, they notice that the generated database credentials are not being revoked after the TTL expires. What is the most likely cause?

Accepted Answer

The database configuration uses a connection_url with template variables but provides static admin credentials, not root rotation. The database secrets engine requires root credential rotation to enable automatic revocation of generated credentials. When the `connection_url` uses template variables like `{{username}}` and `{{password}}` but the admin credentials are static (not rotated via `rotate_root`), Vault cannot track the actual root password. Without root rotation, Vault lacks the ability to execute `REVOKE` commands after TTL expiry because it cannot authenticate to the database with the current root credentials to perform cleanup.

Answer

The creation_statements do not include the REVOKE command

Answer

The role definition has a syntax error in the creation_statements

Answer

The secrets engine is enabled at a path other than 'database/'

Question 2

A DevOps team wants to authenticate to Vault using short-lived tokens without storing a secret in their CI/CD pipeline. Which authentication method best meets this requirement?

Accepted Answer

JWT/OIDC. JWT/OIDC authentication allows a DevOps pipeline to exchange a signed JSON Web Token (JWT) from an external identity provider (e.g., GitHub Actions, GitLab CI) for a short-lived Vault token. This eliminates the need to store a long-lived secret in the CI/CD pipeline because the JWT is dynamically generated by the CI platform and validated by Vault using the OIDC provider's public keys. The resulting Vault token has a configurable TTL, typically minutes, aligning with the requirement for short-lived credentials.

Answer

AWS IAM

Answer

AppRole

Answer

Username & Password

Question 3

Which TWO of the following are valid paths for reading and writing data in the KV v2 secrets engine? (Choose two.)

Accepted Answer

secret/data/myapp. In the KV v2 secrets engine, the `/data/` path is the only endpoint for reading and writing actual secret data. The `/metadata/` path is used for managing metadata (e.g., versions, deletion), not for reading and writing data. Therefore, only option B is correct.

Answer

secret/delete/myapp

Answer

secret/destroy/myapp

Answer

secret/myapp

Answer

secret/metadata/myapp

Question 4

An operator notices that after a network partition, a Vault cluster with integrated storage (Raft) has a node that is unreachable and does not automatically rejoin. The cluster has 5 nodes with a minimum quorum of 3. What is a likely cause for the node not rejoining?

Accepted Answer

The cluster may have lost quorum due to other nodes also being down. In a Raft-based Vault cluster with 5 nodes and a quorum of 3, if a node becomes unreachable due to a network partition and does not automatically rejoin, the most likely cause is that additional nodes are also down or unreachable, causing the cluster to lose quorum. Without a majority of nodes (3 out of 5) able to communicate, the Raft consensus protocol cannot elect a leader or process log entries, so the isolated node cannot rejoin because the cluster itself is in a degraded state. The node not rejoining is a symptom of the broader quorum loss, not an isolated issue with that node.

Answer

The node's raft index is ahead of the leader's

Answer

The node's clock skew is causing Raft timeouts

Answer

The node must be manually removed from the raft configuration and re-added

Question 5

A developer needs to manually revoke a token but only knows its accessor. Which Vault API endpoint can be used to revoke the token using only the accessor?

Accepted Answer

auth/token/revoke-accessor. The `auth/token/revoke-accessor` endpoint is specifically designed to revoke a token when only its accessor is known. The accessor is a non-sensitive identifier that Vault uses to perform token operations without exposing the actual token ID, making this endpoint the appropriate choice for revocation by accessor.

Answer

auth/token/accessors

Answer

auth/token/renew-accessor

Answer

auth/token/revoke

Question 6

An organization uses Vault's AWS secrets engine to generate temporary IAM credentials. The Vault administrator has set the default lease TTL on the AWS mount to 15 minutes. A developer creates a role with role TTL of 30 minutes and explicit max TTL of 1 hour. Which TWO statements are true regarding the lease behavior for credentials generated under this role?

Accepted Answer

The initial lease duration will be 30 minutes (the role TTL).. When a role has an explicit role TTL (30 minutes), Vault uses that value as the initial lease duration for credentials generated under that role, overriding the default mount TTL. The default lease TTL of 15 minutes on the AWS mount only applies when no role TTL is specified.

Answer

The lease can be renewed indefinitely up to the system max TTL.

Answer

The initial lease duration will be 15 minutes (the default lease TTL).

Answer

The lease duration is the minimum of default lease and role TTL.

Question 7

A compliance requirement states that encryption keys must be automatically rotated every 90 days. Which Vault feature can be used to enforce this?

Accepted Answer

Setting `auto_rotate` on the transit key. The Vault Transit Secrets Engine supports an `auto_rotate` parameter that can be set on a key to enforce automatic rotation every 90 days. When enabled, Vault automatically rotates the encryption key at the specified interval without manual intervention, directly meeting the compliance requirement for automated 90-day rotation.

Answer

Using Vault's cron-like scheduler

Answer

Periodic rotation using the transit engine's `min_decryption_version`

Answer

Key rotation schedule policy

Answer

Using a periodic token to call the rotate endpoint

Question 8

A security team wants to enforce that all tokens created by a specific AppRole can only be used to read secrets from the path 'secret/data/team-a/*'. They have configured the AppRole with token_policies that include that path. However, a developer uses the token created from this AppRole to create a child token with broader policies, granting access to 'secret/data/team-b/*'. The security team wants to prevent such privilege escalation. Which action should be taken to ensure that child tokens cannot have broader policies than the parent?

Accepted Answer

Configure the AppRole with 'token_allowed_policies' to restrict which policies child tokens can use. In Vault, when a token creates a child token, the child can be assigned any policies that the parent token has access to, including broader policies, unless the parent token has an `allowed_policies` metadata that restricts which policies the child can use. By configuring the AppRole with `token_policies` and setting `allowed_policies` on the generated token (or on the AppRole itself via `token_allowed_policies`), the parent token can only create child tokens with those specific policies, preventing privilege escalation. Option A is reactive and does not prevent escalation. Option C is incorrect because root tokens can create any token without restriction. Option D is incorrect because setting `orphan=true` makes the token independent but does not restrict child token policies.

Answer

Regularly audit and revoke tokens that violate policy

Answer

Use a root token to create all tokens and distribute them securely

Answer

Set the parent token's 'orphan' property to 'true'

Question 9

Refer to the exhibit. An operator issues a certificate using this intermediate CA. The resulting certificate uses SHA1 signature algorithm. The operator wants SHA256. What should they do?

Accepted Answer

Generate a new intermediate with signature_bits=256. The signature algorithm used by an intermediate CA is determined by the `signature_bits` parameter set when the intermediate CA's certificate is generated. To issue end-entity certificates with SHA256, the intermediate CA itself must be created with `signature_bits=256`. Simply changing a role or issuer after the intermediate exists does not retroactively alter the CA's signing key algorithm.

Answer

Set the issuer's signature_bits to 256 using vault write

Answer

Use a different issuer_name that already has SHA256

Answer

Change the role's signature_bits to 256

Question 10

A Vault cluster uses Integrated Storage. During a planned upgrade, the administrator wants to minimize downtime. Which upgrade strategy should be used?

Accepted Answer

Perform a rolling upgrade one node at a time. Integrated Storage (Raft-based) requires a quorum of nodes to maintain cluster availability. A rolling upgrade, where each node is upgraded one at a time, ensures that the cluster never loses quorum (more than half of the nodes remain online and functional), minimizing downtime while the upgrade proceeds.

Answer

Upgrade all nodes at once

Answer

Stop all nodes, upgrade, then start

Answer

Add new upgraded nodes then remove old ones

Question 11

A startup is deploying Vault for the first time. They want to use Integrated Storage for simplicity. They plan to run Vault on three small instances. During initial setup, they start the first node and initialize Vault, obtaining the unseal keys and root token. Then they start the second node and run `vault operator raft join http://<first_node>:8200`. The second node joins successfully. They then start the third node and attempt to join, but the join command fails with an error saying 'no leader'. What is the most likely cause?

Accepted Answer

The first node was not unsealed before attempting to join the third node.. In a Vault Integrated Storage (Raft) cluster, a newly joined node must be able to contact an unsealed leader to complete the join process. If the first node (the initial leader) is still sealed after initialization, it cannot participate in Raft consensus or respond to join requests. The third node's join fails with 'no leader' because the sealed first node cannot act as a leader, and the second node, while joined, has not been unsealed and thus cannot become leader either. Unsealing the first node would restore its leadership and allow the third node to join.

Answer

The third node is trying to join using the wrong IP address.

Answer

The Raft cluster requires a quorum of 2 nodes to elect a leader, but the first node may have been sealed.

Answer

The second node was not unsealed.

Question 12

A Vault administrator wants to minimize the impact of a single node failure in a three-node Raft cluster. Which TWO actions will help? (Choose two.)

Accepted Answer

Configure monitoring to detect and replace failed nodes quickly.. Monitoring and rapid node replacement directly reduce the window of vulnerability during a single node failure. In a three-node Raft cluster, a single node failure still allows the cluster to maintain quorum (2 out of 3 nodes), but if a second failure occurs before the first is replaced, the cluster becomes unavailable. Quick detection and replacement minimize this risk.

Answer

Set `disable_clustering` to true.

Answer

Use a load balancer to distribute client requests.

Answer

Enable `performance_standby` on all nodes.

Question 13

Which TWO of the following are valid methods to enable a secrets engine at a non-default path in Vault?

Accepted Answer

vault write sys/mounts/my-aws type=aws. Options B and C are both valid methods to enable a secrets engine at a non-default path in Vault. Option B uses the raw API endpoint via 'vault write sys/mounts/my-aws type=aws', which is a valid low-level approach. Option C uses the higher-level 'vault secrets enable -path=my-aws aws' command, which is the standard CLI method. Option E ('vault secrets enable my-aws aws') is invalid because it incorrectly places the path before the engine type; the correct syntax for a default path is 'vault secrets enable aws', but for a non-default path the '-path' flag is required.

Answer

vault secrets enable -custom-path=my-aws aws

Answer

vault secrets enable -mount-path=my-aws aws

Answer

vault secrets enable my-aws aws

Question 14

A security engineer needs to choose an authentication method for a set of microservices running in a Kubernetes cluster that require short-lived secrets. The method should leverage the pod's identity. Which method is best?

Accepted Answer

Kubernetes auth. Kubernetes auth is the best choice because it allows a pod to authenticate to Vault using its own service account token, which is automatically mounted and short-lived. This method directly leverages the pod's identity without requiring manual secret distribution, making it ideal for microservices in a Kubernetes cluster that need ephemeral credentials.

Answer

AppRole auth

Answer

Token auth

Answer

LDAP auth

Question 15

A Vault administrator is configuring AppRole authentication via the configuration file shown. After running `vault server -config=config.json`, they try to enable AppRole at a different path. What will happen?

Accepted Answer

The admin can enable AppRole at another path without issues.. AppRole authentication can be enabled at any mount path, regardless of whether it is pre-configured in the Vault configuration file. The configuration file only defines the initial backend settings; it does not prevent the admin from enabling the same auth method at a different path using the `vault auth enable` command. Vault allows multiple mounts of the same auth method type at different paths, each with its own configuration.

Answer

The backend will be disabled when Vault starts.

Answer

The admin must modify the config file to change the path.

Answer

Vault will fail to start because the path is already used.