VA-003 Practice Test 31 — 15 Questions

Question 1

Which THREE of the following token properties are immutable after token creation? (Select exactly 3 options.)

Accepted Answer

Period. In Vault, certain token properties are set at creation and cannot be changed later. The immutable properties are: Period (the renewal period), Policies (the list of policies attached to the token), and Max TTL (the maximum time-to-live). These are fixed in the token's metadata. In contrast, the Renewable flag, though set at creation, is not considered immutable because it can be effectively changed by renewing the token or by updating the token's role policies that affect renewal behavior. TTL is the current time-to-live and decreases over time, so it is mutable.

Answer

Renewable

Answer

TTL

Question 2

A Vault administrator wants to allow a CI/CD pipeline to create short-lived tokens for deployment jobs. The pipeline itself authenticates with a periodic token. Which token type should the pipeline use to create tokens for jobs, considering the jobs need to be independent and not affected by the pipeline token's lifecycle?

Accepted Answer

Orphan tokens. Orphan tokens are the correct choice because they allow the CI/CD pipeline to create child tokens that are not tied to the parent token's lifecycle. When a periodic token creates an orphan token, the child token remains valid even if the parent token is revoked or expires, ensuring deployment jobs are independent and not affected by the pipeline token's lifecycle.

Answer

Service tokens with explicit max TTL

Answer

Periodic tokens

Answer

Batch tokens

Question 3

Which of the following best describes a Vault lease?

Accepted Answer

A time-limited agreement that governs the lifecycle of a secret.. A Vault lease is a time-bound agreement that governs the lifecycle of a secret, including its validity period, renewal, and revocation. When a secret is read from Vault, it is returned with a lease ID and a lease duration (TTL), after which the secret is automatically revoked unless renewed. This ensures that secrets are not valid indefinitely, reducing the risk of exposure.

Answer

A permission to access a path.

Answer

A contract to use a secret for a certain duration.

Answer

The actual secret value.

Question 4

Match each Vault command to its function.

Accepted Answer

vault kv put: Stores a secret at a specified path in the KV secret engine.. The correct matches are: A (vault kv put) stores secrets in KV, D (vault kv delete) deletes secrets, and F (vault read) reads data from any path. Options B and C are incorrect because their descriptions are swapped: vault kv get retrieves a secret (not lists), and vault kv list lists keys (not retrieves). Option E is incorrect because vault write is a generic command that writes to any path, not specifically to the KV secret engine; the KV-specific command for storing secrets is vault kv put.

Answer

vault kv get: Lists all secrets at a given path.

Answer

vault kv list: Retrieves a secret from a specified path.

Answer

vault write: Stores a secret at a specified path in the KV secret engine.

Question 5

A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?

Accepted Answer

Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.. Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.

Answer

Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.

Answer

Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.

Answer

Use TLS cert auth, generate a certificate per microservice, and mount as a secret.

Question 6

A developer wants to ensure that their application automatically renews its secret leases before expiration. Which approach is recommended?

Accepted Answer

Use Vault agent with a template and renew capability.. Vault Agent's template and renew capability is the recommended approach because it automatically manages the lifecycle of dynamic secrets, including renewing leases before they expire. Vault Agent runs as a sidecar or daemon and uses its built-in renewer to periodically extend the lease TTL, ensuring the application always has a valid secret without manual intervention or external scheduling.

Answer

Set the lease TTL to infinite.

Answer

Use a cron job to call vault lease renew periodically.

Answer

Use periodic tokens with auto-renewal.

Question 7

A DevOps team is deploying Vault in a Kubernetes cluster. They want to ensure that when a pod starts, it can obtain a short-lived Vault token without human intervention. Which Vault architecture component should they use?

Accepted Answer

Vault Agent sidecar. The Vault Agent sidecar runs alongside the application container in the same pod, automatically authenticating to Vault and retrieving a short-lived token. This eliminates the need for human intervention by handling the authentication lifecycle (e.g., using Kubernetes auth method) and renewing or re-authenticating as needed, ensuring the application always has a valid token.

Answer

Audit Device

Answer

Storage Backend (Consul)

Answer

Vault CLI with token helper

Question 8

You are a Vault administrator for a large organization. Your team uses a centralized Vault cluster with multiple auth methods enabled, including userpass, LDAP, and approle. Recently, a developer reported that they are unable to authenticate using their userpass credentials, receiving the error 'permission denied'. The developer confirms the username and password are correct. Other developers using userpass can authenticate successfully. The Vault audit logs show that the authentication request for this developer is reaching Vault but failing with 'invalid password'. You have verified that the password is correct by resetting it via the Vault CLI. The developer's userpass entry exists and is not disabled. Which of the following is the most likely cause and correct course of action?

Accepted Answer

The developer's account is locked due to too many failed login attempts. The admin should unlock the account using 'vault write auth/userpass/users//unlock'.. Vault's userpass auth method supports account locking after a configurable number of failed login attempts (default is 0, meaning no lockout, but if set to a positive integer via `max_attempts`, the account becomes locked). The audit log shows 'invalid password' despite the password being verified as correct, and other users can authenticate, which points to a lockout rather than a password or user entry issue. The admin can unlock the account using `vault write auth/userpass/users//unlock` to restore access.

Answer

The developer's user entry is disabled. The admin should enable it using 'vault write auth/userpass/users/<username>/enable'.

Answer

The developer's password has expired. The admin should update the password with a new one.

Answer

The developer's password hash is corrupted. The admin should delete and recreate the user entry.

Question 9

A team wants to retrieve a dynamic database credential from Vault. Which CLI command should be used?

Accepted Answer

vault write database/creds/readonly. Vault uses the `vault write` command to generate dynamic credentials from a database secrets engine. The `database/creds/readonly` path triggers the generation of a new credential (username/password) for the configured role, and the response includes the lease ID, username, and password. Unlike static secrets, dynamic credentials are created on demand and require a write operation to the role path.

Answer

vault list database/creds/readonly

Answer

vault generate database/creds/readonly

Answer

vault read database/creds/readonly

Question 10

An admin needs to check the remaining lifespan of a lease. Which command should they use?

Accepted Answer

vault lease lookup <lease_id>. The `vault lease lookup` command is the correct way to inspect the remaining lifespan and metadata of a specific lease in Vault. It returns details such as the lease ID, issue time, expiration time, and TTL, allowing the admin to determine how much time remains before the lease expires.

Answer

vault read sys/leases/lookup/<lease_id>

Answer

vault lease list <lease_id>

Answer

vault lease renew -increment=0 <lease_id>

Question 11

An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?

Accepted Answer

Vault's tidy operation is not configured to clean up stale leases.. Vault's database secrets engine does not automatically clean up stale user accounts in the target database. The `tidy` operation must be explicitly configured and run to remove users whose leases have expired or been revoked. Without it, even if Vault correctly revokes the lease, the database user may remain, leading to an accumulation of stale accounts.

Answer

The lease revocation process is failing due to network issues.

Answer

The database rotation statement is incorrect, causing Vault to not properly revoke credentials.

Answer

The role's max_ttl is set too high, allowing leases to live longer.

Question 12

After a security incident, the Vault administrator needs to change the encryption key used to encrypt data at rest. They have already rekeyed the unseal keys. What additional step is required to ensure new secrets are encrypted with a new key?

Accepted Answer

Run 'vault operator rotate' to rotate the encryption key.. The `vault operator rotate` command rotates the encryption key used by Vault's keyring to encrypt data at rest. After rekeying the unseal keys, the administrator must rotate the encryption key so that new secrets written to the storage backend are encrypted with a fresh key, while existing data remains decryptable with the old key until it is rewritten.

Answer

Reinitialize Vault with new unseal keys.

Answer

Migrate all secrets to a new mount and delete the old one.

Answer

Run 'vault operator rekey' again with different parameters.

Question 13

An administrator creates a service token with a TTL of 1 hour and a max TTL of 24 hours. The token is renewed once after 55 minutes. What happens to the token after 24 hours from creation?

Accepted Answer

The token expires and cannot be renewed. The token's TTL was set to 1 hour with a max TTL of 24 hours. After the first renewal at 55 minutes, the token's TTL resets to 1 hour, but the max TTL remains 24 hours from creation. Once 24 hours have passed from creation, the token reaches its max TTL and expires permanently; it cannot be renewed because the max TTL is a hard upper limit enforced by Vault's token lifecycle logic.

Answer

The token is revoked by the system

Answer

The token's TTL is automatically extended by 1 hour

Answer

The token becomes an orphan token

Question 14

Match each Vault replication type to its behavior.

Accepted Answer

Performance Replication: Replicates mounts and policies but not secrets; used to scale read operations across clusters.. Performance Replication replicates mounts/policies (not secrets) for read scaling; DR Replication replicates everything for failover. Common confusions include swapping the two or inventing non-existent types like Snapshot or Local Replication.

Answer

Performance Replication: Replicates everything including secrets and tokens; used for failover.

Answer

Snapshot Replication: Replicates the entire state of Vault at a point in time for backup.

Answer

Disaster Recovery Replication: Replicates mounts and policies but not secrets; used to scale read operations.

Answer

Local Replication: Replicates data within a single cluster to ensure durability.

Question 15

A security team wants to ensure that secrets stored in Vault are encrypted in transit and at rest, and that even Vault administrators cannot read the plaintext secret values. Which configuration is required?

Accepted Answer

Enable the Transit secrets engine and encrypt secrets before writing them to KV. The Transit secrets engine allows clients to encrypt data (including secrets) using Vault-managed encryption keys before writing the ciphertext to a storage backend like KV. This ensures that even Vault administrators with access to the raw storage backend cannot read plaintext secret values, as the encryption key is never exposed to them. The Transit engine also supports encryption in transit via TLS and at rest via the encrypted ciphertext stored in the KV engine, meeting the full requirement.

Answer

Set a strong master key for the Vault cluster

Answer

Configure storage backend encryption using a KMS

Answer

Both A and B