VA-003 Practice Test 31 — 15 Questions

Question 1

A developer wants to encrypt a string "hello" using Vault's transit engine. What must they send in the API request?

Accepted Answer

The plaintext "hello" as a base64 encoded string. E is correct because Vault's transit engine requires plaintext to be base64-encoded before encryption. The API endpoint expects the plaintext as a base64-encoded string in the `plaintext` field of the request body. This ensures binary-safe transmission and consistent encoding across different systems.

Answer

The ciphertext of "hello"

Answer

Both the key name and the ciphertext

Answer

A reference to the key

Answer

The plaintext "hello" in raw bytes

Question 2

An organization wants to encrypt sensitive fields in their database using Vault. They have multiple applications that need to encrypt different types of data. What approach should they take?

Accepted Answer

Create a separate transit key per application. Option C is correct because the Vault Transit Secrets Engine provides encryption-as-a-service, allowing each application to have its own named encryption key. This ensures cryptographic isolation: if one key is compromised, only the data encrypted with that specific key is at risk. Using separate keys per application also simplifies key rotation and access control, as each application can only use its designated key.

Answer

Use the PKI engine to issue certificates for each application

Answer

Use the KV engine to store encryption keys

Answer

Use a single key for all applications to simplify management

Answer

Encrypt data in the database using a static key stored in Vault

Question 3

An organization wants to ensure that even Vault administrators cannot see the plaintext of data encrypted with the transit engine, but they want to use Vault for key management. What feature should be enabled?

Accepted Answer

Client-side encryption with datakey. Option C is correct because client-side encryption with a datakey allows the application to encrypt data locally using a key obtained from Vault, ensuring that Vault administrators never see the plaintext. The datakey is generated by Vault and returned in both plaintext and ciphertext forms; the application encrypts data with the plaintext key and then discards it, storing only the ciphertext key alongside the encrypted data. This decouples key management from data encryption, meeting the requirement that even Vault administrators cannot access the plaintext.

Answer

Seal wrapping

Answer

Convergent encryption

Answer

Key deletion prevention

Answer

Key derivation

Question 4

A company is using Vault Transit to encrypt files before uploading them to an S3 bucket. They notice that for a given plaintext file, the ciphertext output is always identical, even when encrypting at different times. They are using the `encrypt` endpoint with the default AES-GCM algorithm. The team is concerned about security because the repeated ciphertext leaks information (e.g., file equality). What is the most likely cause of this behavior?

Accepted Answer

They are using convergent encryption. The correct answer is C because convergent encryption is a deterministic scheme where the encryption key is derived from the hash of the plaintext. When using Vault Transit with the default AES-GCM algorithm, the ciphertext will be identical for the same plaintext if the same key and nonce are used. This behavior matches the scenario described, as convergent encryption is designed to produce identical ciphertexts for identical plaintexts, which leaks file equality information.

Answer

They are using the wrong key

Answer

They are using a deterministic encryption scheme

Answer

They are not providing an encryption context

Question 5

A user receives an error 'invalid ciphertext' when trying to decrypt data. The ciphertext was created by another Vault instance. What is the most likely issue?

Accepted Answer

The ciphertext includes key version info that doesn't match. Option D is correct because Vault's transit secrets engine appends key version information to the ciphertext by default. When decrypting, Vault checks that the key version embedded in the ciphertext matches a version of the key that exists in the destination Vault instance. If the ciphertext was created by a different Vault instance with a different key version history, the version embedded in the ciphertext will not correspond to any known key version, causing the 'invalid ciphertext' error.

Answer

Different key names

Answer

The Vault instance is sealed

Answer

Different key types

Answer

The user lacks permissions to decrypt

Question 6

A DevOps engineer is configuring Vault to encrypt data in transit for a microservice. They create a key in the transit engine and want to encrypt a base64-encoded plaintext. Which API path and operation should they use?

Accepted Answer

POST /v1/transit/encrypt/{key_name} with plaintext in payload. Option C is correct because the Vault Transit Secrets Engine exposes a POST endpoint at `/v1/transit/encrypt/{key_name}` that accepts a JSON payload containing the `plaintext` field, which must be base64-encoded. This operation encrypts the provided plaintext using the named encryption key and returns the ciphertext. The POST method is required because the operation modifies state (encrypts data) and the plaintext is sent in the request body, not as a query parameter.

Answer

POST /v1/transit/encrypt/{key_name} with ciphertext in payload

Answer

GET /v1/transit/encrypt/{key_name} with query param

Answer

POST /v1/transit/sign/{key_name}

Answer

POST /v1/transit/hmac/{key_name}

Question 7

Which Vault API path is used to encrypt data with the transit engine?

Accepted Answer

/v1/transit/encrypt/{keyname}. Option C is correct because the Vault transit engine uses the exact path `/v1/transit/encrypt/{keyname}` to encrypt plaintext data. The `{keyname}` parameter specifies the named encryption key stored in the transit engine, and the API endpoint expects a POST request with the plaintext base64-encoded in the request body. This path aligns with Vault's RESTful design where the action (`encrypt`) is a sub-path under the transit mount, and the key name is a required path parameter.

Answer

/v1/transit/enc/

Answer

/v1/transit/encrypt/

Answer

/v1/transit/encryption/

Answer

/v1/transit/encryption/{keyname}

Question 8

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Option C is correct because Vault's `vault rewrap` command re-encrypts existing ciphertext with the latest key version without decrypting the underlying plaintext, preserving the data's confidentiality. This is essential after a key rotation to ensure all ciphertext uses the new key, meeting compliance requirements for periodic key rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 9

A team wants to store static secrets like database passwords and rotate them periodically. Which secrets engine should they enable?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is designed for static secrets like database passwords, offering versioning, configurable deletion, and periodic rotation via lease management or external automation. It stores secrets as key-value pairs with metadata, making it ideal for static credentials that need controlled lifecycle management.

Answer

AWS secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 10

An application needs to obtain short-lived, time-limited credentials to access an external database using username/password authentication. Which secrets engine should be used?

Accepted Answer

Database secrets engine. The Database secrets engine is designed specifically to generate short-lived, dynamic credentials for databases, including external databases accessed via username/password authentication. It creates unique, time-limited usernames and passwords on-the-fly, which are automatically revoked after a configurable TTL, meeting the requirement for temporary credentials.

Answer

KV v2 secrets engine

Answer

Consul secrets engine

Answer

Identity secrets engine

Question 11

An administrator wants to view all currently enabled secrets engines and their mount paths. Which command provides this information?

Accepted Answer

vault secrets list. The correct command is `vault secrets list` (or its alias `vault secrets list -detailed`), which displays all enabled secrets engines along with their mount paths, accessor, type, and configuration. This is the standard CLI command for enumerating secrets engines in Vault, equivalent to reading the `sys/mounts` endpoint but with a user-friendly output format.

Answer

vault list sys/mounts

Answer

vault secrets show

Question 12

Refer to the exhibit. A DevOps engineer runs `vault read -format=json transit/keys/mykey` and receives the output shown. A microservice attempts to decrypt data that was encrypted with version 1 of the key. Will the decryption succeed?

Accepted Answer

Yes, because min_decryption_version is 1, which allows decryption with version 1 and higher.. Option B is correct because the `min_decryption_version` parameter in Vault's transit secrets engine specifies the lowest key version that can be used for decryption. In the exhibit, `min_decryption_version` is set to 1, meaning any version from 1 upward is allowed. Since the data was encrypted with version 1, decryption will succeed. This parameter does not block decryption with version 1; it only prevents decryption with versions lower than the specified value.

Answer

Yes, because min_decryption_version does not affect decryption.

Answer

No, because min_decryption_version is 1, so only version 2 and higher can decrypt.

Answer

No, because the data was encrypted with version 1 and min_decryption_version is 1, so decryption is blocked.

Question 13

Refer to the exhibit. An application token has the above policy. Which operation will fail?

Accepted Answer

Listing keys in the transit engine. The policy shown in the exhibit grants 'create', 'update', 'delete', and 'deny' capabilities on the transit engine, but it does not include a 'list' capability. In Vault's transit secrets engine, listing keys requires the 'list' capability on the engine path. Without it, the operation will fail due to insufficient permissions, even though other key management operations are allowed.

Answer

Rotating the key mykey

Answer

Decrypting data using the key mykey

Answer

Encrypting data using the key mykey

Answer

Deleting the key mykey

Question 14

A data analytics company needs to encrypt streaming data (e.g., clickstream events) before sending to a cloud data lake. Each event is about 1KB. They use Vault Transit to encrypt each event individually. The encryption rate is too slow for the volume (100,000 events/second). The team considers options to improve performance. Which approach is most effective for reducing the number of API calls to Vault while maintaining security?

Accepted Answer

Generate a local data encryption key (DEK) and encrypt it with Vault's Transit engine (KEK). Encrypt each event locally with the DEK, storing the encrypted DEK alongside the data.. Option B is correct because it implements an envelope encryption pattern: a local Data Encryption Key (DEK) encrypts each event locally, avoiding an API call per event, while the DEK itself is encrypted by Vault's Transit engine (Key Encryption Key, KEK). This reduces the number of Vault API calls from 100,000 per second to a single call per DEK rotation, drastically improving throughput without exposing the DEK in plaintext.

Answer

Use a different secrets engine like Database or PKI.

Answer

Increase the number of Vault nodes and load balance requests.

Answer

Use Vault's batch encryption to send multiple events in one request.

Question 15

Refer to the exhibit. A developer receives this error when attempting to decrypt data. What is the most likely cause?

Accepted Answer

The ciphertext provided is not valid base64. The error indicates that the ciphertext provided is not valid base64. Vault's transit engine expects ciphertext to be base64-encoded; if the input is malformed or not properly encoded, the decryption operation fails with this specific error. This is the most direct cause given the error message.

Answer

The ciphertext is encrypted with a different key

Answer

The Vault server is not configured with the transit engine

Answer

The key mykey does not exist

Answer

The token used does not have permission to decrypt