VA-003 Practice Test 3 — 30 Questions

Question 1

A DevOps team is using Vault tokens for authentication in CI/CD pipelines. They notice that tokens are often expired before the pipeline completes, causing failures. Which Vault feature should they use to address this without manual intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use periodic tokens with a short period and allow renewal. Periodic tokens are designed for long-running processes like CI/CD pipelines. They have no maximum TTL and can be renewed indefinitely as long as the renewal occurs before the current token's TTL expires. By using a periodic token with a short period and enabling automatic renewal in the pipeline, the token stays valid without manual intervention, solving the expiration issue.

Answer

Use batch tokens for better performance

Answer

Create orphan tokens so they don't expire with the parent

Answer

Increase the default TTL on the token auth method

Question 2

A company uses Vault to issue tokens for short-lived tasks. They have configured a token role with 'period' set to 30 minutes and 'explicit_max_ttl' set to 24 hours. Tokens are created using the role and are expected to be renewed every 30 minutes by the tasks. However, after a few renewals, the Vault audit logs show that a token was renewed but then immediately expired. The task that was using the token failed. What is the most likely reason for this behavior?

Accepted Answer

The token reached its 'explicit_max_ttl' of 24 hours, and renewal is no longer possible.. The token role has an 'explicit_max_ttl' of 24 hours, which sets an absolute hard limit on the token's lifetime regardless of the shorter 'period' of 30 minutes. When the token is renewed, its total lifetime cannot exceed the explicit_max_ttl. Once that limit is reached, Vault rejects any further renewal, causing the token to expire immediately and the task to fail.

Answer

The token was created by a root token and root tokens are not subject to periodic renewal.

Answer

The token was a batch token and batch tokens cannot be renewed at all.

Answer

The token was an orphan token and cannot be renewed more than a few times.

Question 3

Refer to the exhibit. A DevOps engineer runs `vault read -format=json transit/keys/mykey` and receives the output shown. A microservice attempts to decrypt data that was encrypted with version 1 of the key. Will the decryption succeed?

Accepted Answer

Yes, because min_decryption_version is 1, which allows decryption with version 1 and higher.. The `min_decryption_version` parameter in Vault's transit secrets engine specifies the lowest key version that can be used for decryption. In the exhibit, `min_decryption_version` is set to 1, meaning any version from 1 upward is allowed. Since the data was encrypted with version 1, decryption will succeed. This parameter does not block decryption with version 1; it only prevents decryption with versions lower than the specified value.

Answer

Yes, because min_decryption_version does not affect decryption.

Answer

No, because min_decryption_version is 1, so only version 2 and higher can decrypt.

Answer

No, because the data was encrypted with version 1 and min_decryption_version is 1, so decryption is blocked.

Question 4

Match each Vault term to its definition.

Accepted Answer

Secret: A piece of sensitive data stored in Vault. Correct matches: Secret is sensitive data; Token is an authentication credential. Common confusions: Policy vs. Auth Method — policies control access, auth methods authenticate users.

Answer

Policy: A method used to authenticate a user or machine to Vault

Answer

Auth Method: A set of rules defining access permissions in Vault

Question 5

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Accepted Answer

The binddn or bindpass configured in Vault is incorrect. The error 'LDAP bind failed: invalid credentials' specifically indicates that the authentication attempt to the LDAP server using the configured binddn and bindpass failed. Since the LDAP server is reachable, the most direct cause is that the bind credentials stored in Vault's LDAP configuration do not match what the LDAP server expects. This is a configuration mismatch, not a connectivity or TLS issue.

Answer

Vault is not configured to use SSL/TLS for LDAP

Answer

The LDAP server does not allow anonymous binds

Answer

The LDAP server certificate is not trusted by Vault

Question 6

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data

Question 7

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 8

Drag and drop the steps to configure Vault's PKI secrets engine to issue certificates into the correct order.

Accepted Answer

Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate. The correct sequence to configure Vault's PKI secrets engine for issuing certificates is: first enable the PKI secrets engine, then generate a root certificate (self-signed CA), then create a role that defines certificate parameters, and finally issue a certificate using that role. Enabling the engine mounts it at a path, generating the root CA establishes the trust anchor, the role configures certificate properties, and the issuance step produces the actual certificate. Common mistakes include attempting to generate the root or create a role before enabling the engine, or creating the role before generating the root CA, which leads to errors or missing configurations.

Answer

Generate a root certificate, then enable PKI secrets engine, then create a role, then issue a certificate

Answer

Create a role, then enable PKI secrets engine, then generate a root certificate, then issue a certificate

Answer

Enable PKI secrets engine, then create a role, then generate a root certificate, then issue a certificate

Question 9

An operator wants to enable the database secrets engine at a custom path 'db-creds'. Which command should be used?

Accepted Answer

vault secrets enable -path=db-creds database. The `vault secrets enable` command with the `-path` flag allows you to mount the database secrets engine at a custom path. The syntax `vault secrets enable -path=db-creds database` correctly specifies the custom path and the engine type, enabling the database secrets engine at the desired location.

Answer

vault secrets enable database

Answer

vault write sys/mounts/db-creds type=database

Answer

vault secrets tune -path=db-creds database

Question 10

A security engineer needs to choose an authentication method for a set of microservices running in a Kubernetes cluster that require short-lived secrets. The method should leverage the pod's identity. Which method is best?

Accepted Answer

Kubernetes auth. Kubernetes auth is the best choice because it allows a pod to authenticate to Vault using its own service account token, which is automatically mounted and short-lived. This method directly leverages the pod's identity without requiring manual secret distribution, making it ideal for microservices in a Kubernetes cluster that need ephemeral credentials.

Answer

AppRole auth

Answer

Token auth

Answer

LDAP auth

Question 11

An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?

Accepted Answer

PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}. Creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.

Answer

POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}

Answer

POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}

Answer

PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}

Question 12

A company uses Vault to manage secrets for multiple applications. A new security policy requires that all human users authenticate using LDAP and that all machine-to-machine authentication uses AppRole. An administrator has configured an LDAP auth method at 'ldap/' and an AppRole at 'approle/'. The administrator creates a role 'web-app' with a secret ID TTL of 30 days and a token TTL of 1 hour. After deploying the web application, the application successfully logs in using the AppRole role ID and secret ID, retrieves a token, and reads secrets. However, after 1 hour, the application begins receiving 'permission denied' errors when trying to read secrets. The application logs show that it is using the same token obtained during initial login. Which action should the administrator take to resolve this issue?

Accepted Answer

Configure the application to renew the token before it expires by calling the 'auth/token/renew' endpoint.. The application's token has a TTL of 1 hour, and once it expires, Vault will reject any further requests using that token. The application must renew the token before it expires by calling the 'auth/token/renew' endpoint, which extends the token's lifetime (up to the maximum TTL configured on the role). This is the standard pattern for long-running applications using short-lived tokens.

Answer

Increase the secret ID TTL to 60 days so the application can re-authenticate less frequently.

Answer

Set the token TTL to 0 (unlimited) so the token never expires.

Answer

Have the application re-authenticate with the AppRole using the same secret ID after the token expires.

Question 13

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Accepted Answer

24h. (24h) because when a certificate request is made, Vault applies the most restrictive TTL among the role's configured `ttl`, the mount's default lease TTL, and the requested TTL. Here, the role's `ttl` of 24h is the shortest, so it overrides both the requested 48h and the mount default of 72h, resulting in a certificate with a 24-hour validity.

Answer

The request will be rejected because the requested TTL exceeds the role's ttl.

Answer

48h

Answer

72h

Question 14

An operator inspects a Vault policy and finds a rule granting read on database/creds/reporting. Applications using tokens bound to this policy can fetch credentials but receive permission denied when they attempt to extend them. Which capability must be added to the policy to allow lease renewal?

Accepted Answer

update on sys/leases/renew. Renewing a lease is an update to the sys/leases/renew endpoint, so the policy must grant update there. Reading lease metadata, using sudo on the generation path, or granting create instead of update all leave the renewal call unauthorized, which is exactly the failure the applications are hitting.

Answer

create on sys/leases/renew

Answer

sudo on database/creds/reporting

Answer

read on sys/leases/lookup

Question 15

A Vault user wants to check the capabilities of their token on a specific path. Which command should they use?

Accepted Answer

vault token capabilities <path>. The `vault token capabilities` command is specifically designed to check what operations (e.g., read, create, update, delete, list) a given token is allowed to perform on a particular path. It evaluates the token's attached policies against the path and returns the effective capabilities, making it the correct tool for this task.

Answer

vault token list

Answer

vault policy capabilities

Answer

vault token lookup <token>

Question 16

Which TWO of the following are components of Vault's architecture? (Choose two.)

Accepted Answer

Barrier. The Barrier (D) is a core Vault architectural component: it is the cryptographic layer that ensures data written to the storage backend is encrypted, and all requests must pass through the barrier before reaching the storage backend. The Seal (E) is also a core Vault component: it is the mechanism that protects the barrier's encryption key, and Vault starts in a sealed state where it cannot decrypt data until it is unsealed with the required unseal keys or auto-unseal mechanism. Consul Template (B) is an external HashiCorp tool that can render templates from Vault data, but it is not part of Vault's internal architecture. Vault Agent (C) is an optional client-side helper for authentication and caching, not a core architectural component of the Vault server. Senlin (A) is an OpenStack clustering service and has no relation to Vault's architecture.

Answer

Senlin

Answer

Consul Template

Answer

Vault Agent

Question 17

A developer wants to use Vault to encrypt sensitive data before storing it in a database. They need to perform encryption and decryption operations without ever exposing the encryption key. Which secrets engine should they use?

Accepted Answer

Transit. The Transit secrets engine is designed specifically for encryption-as-a-service workflows, allowing applications to encrypt and decrypt data using keys managed entirely within Vault. The encryption key never leaves Vault, satisfying the requirement to avoid exposing the key. In contrast, other engines like KV v2 store raw secrets but do not perform cryptographic operations without exposing the key material.

Answer

PKI

Answer

KV v2

Answer

Database

Question 18

What command is used to view the remaining time on a lease?

Accepted Answer

vault lease lookup . The correct command to view the remaining time on a lease is `vault lease lookup `. This command retrieves the lease metadata, including the issue time, duration (TTL), and remaining time, directly from the Vault server. It is the standard method for inspecting lease details without extending or modifying the lease.

Answer

vault lease info <lease_id>

Answer

vault status <lease_id>

Answer

vault read <lease_id>

Question 19

A Vault cluster has a token with the following policy: path "secret/data/dev/*" { capabilities = ["read", "list"] }. The token is used to read a secret at "secret/data/dev/password". The read succeeds. Later, the token tries to read "secret/data/prod/password". What happens?

Accepted Answer

Fails because the token needs an explicit policy for "secret/data/prod/".. Vault policies are path-based and deny by default. The token's policy only grants 'read' and 'list' capabilities on paths matching 'secret/data/dev/*', so any attempt to access 'secret/data/prod/password' is not covered by that policy. Without an explicit policy allowing access to the 'prod' path, the request is denied by Vault's default deny behavior.

Answer

Fails with a system error.

Answer

Succeeds because token has read capability on all secrets.

Answer

Succeeds because the token can list and read any path.

Question 20

After a Vault migration, some leases are no longer valid and cause errors. What is the best way to force a cleanup of all leases under a specific mount without affecting other mounts?

Accepted Answer

Use vault lease revoke -prefix . The `vault lease revoke -prefix ` command is specifically designed to revoke all leases associated with a given mount path without affecting other mounts. This command iterates through all leases under that prefix and forces their revocation, cleaning up invalid leases efficiently. It is the targeted, non-disruptive approach for lease cleanup in Vault.

Answer

Restart Vault servers

Answer

Disable and re-enable the secret engine

Answer

Reduce the mount's max_lease_ttl to 0