VA-003 Practice Test 32 — 15 Questions

Question 1

A security policy requires that all tokens are revoked when a user leaves the organization. What is the most efficient way to revoke all tokens issued to that user?

Accepted Answer

Use the identity/entity endpoint to revoke all tokens associated with the user's entity. Vault associates all tokens issued to a user with their entity identity. Using the identity/entity endpoint to revoke the entity's tokens is the most efficient method, as it leverages Vault's identity system to revoke all tokens linked to that entity in a single API call, rather than requiring individual token lookups or path-based revocation.

Answer

Revoke each token individually using its accessor

Answer

Use the auth/token/revoke-prefix endpoint with the user's token path

Answer

Restart the Vault server

Question 2

Which TWO statements correctly describe Vault's storage backend and seal/unseal mechanism?

Accepted Answer

During unseal, the unseal key is used to decrypt the master key which then decrypts the storage backend.. Vault's unseal process uses a threshold of unseal keys to decrypt the master key stored in the keyring. The master key then decrypts the storage backend's encryption key, allowing Vault to access the encrypted data. This ensures that the storage backend remains encrypted at rest and is only readable after a successful unseal operation.

Answer

Shamir's secret sharing splits the master key into key shares.

Answer

The storage backend is responsible for sealing and unsealing Vault.

Answer

In a Vault cluster, when a new leader is elected, it automatically unseals itself.

Question 3

An organization uses AppRole with secret_id generation via the Vault API. Security policy requires that each secret_id can be used only once and must expire after 1 hour. The configuration must use Vault's standard duration format with hour suffix (e.g., 1h). Which configuration option should be set on the AppRole role to enforce this?

Accepted Answer

secret_id_num_uses=1, secret_id_ttl=1h. The security policy requires both single-use (secret_id_num_uses=1) and a 1-hour expiration (secret_id_ttl=1h). In Vault's AppRole authentication, secret_id_num_uses controls how many times a secret_id can be used, and secret_id_ttl sets the time-to-live. Option D is incorrect because it specifies the TTL in minutes (60m) instead of the required hours format. Therefore, only B satisfies the exact requirement.

Answer

secret_id_num_uses=1

Answer

secret_id_ttl=1h

Answer

secret_id_num_uses=1, secret_id_ttl=60m

Question 4

An administrator is reviewing Vault token policies and wants to ensure that tokens created by a specific application cannot be renewed and have a fixed lifetime. Which two token configurations should be applied?

Accepted Answer

Set renewable to false.. Setting `renewable` to `false` on the token role explicitly prevents the token from being renewed, ensuring it cannot have its lifetime extended. Option D is correct because `explicit_max_ttl` on the token overrides any system or role defaults, enforcing a fixed, non-extendable lifetime that matches the desired TTL. Together, these two configurations guarantee that the token has a fixed lifetime and cannot be renewed.

Answer

Set max_ttl on the role to a very large value.

Answer

Set ttl on the token to 0.

Answer

Set no_default_policy to true.

Question 5

A token with a policy granting 'write' on 'secret/team-alpha/*' is unable to write to 'secret/team-alpha/db-creds' in a KV v2 engine. What is the most likely cause?

Accepted Answer

The policy path should be 'secret/data/team-alpha/*' for KV v2. D is correct because in Vault's KV v2 engine, the actual data path is prefixed with 'data/' after the mount path. A policy granting 'write' on 'secret/team-alpha/*' targets the metadata path, not the data path. To write secrets, the policy must use 'secret/data/team-alpha/*' to match the correct API endpoint.

Answer

The token is not a root token

Answer

The token's TTL has expired

Answer

The token has a conflicting policy from a parent token

Question 6

A security administrator wants to create a policy that allows a service to renew its own token and list its own token capabilities, but not create new tokens. Which policy statements should be included?

Accepted Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["read"] }. It uses the correct endpoints and capabilities: update for renew-self and read for capabilities-self. Option B uses create for renew-self, which is incorrect (renew-self requires update). Option C uses update for capabilities-self, which is wrong (capabilities-self requires read). Option D uses non-self endpoints (renew and capabilities) which would allow renewing or checking capabilities of any token, granting broader privileges than intended.

Answer

path "auth/token/renew-self" { capabilities = ["create"] }; path "auth/token/lookup-self" { capabilities = ["read"] }

Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["update"] }

Answer

path "auth/token/renew" { capabilities = ["update"] }; path "auth/token/capabilities" { capabilities = ["read"] }

Question 7

A team is adopting Vault and wants to organize secrets by application and environment (e.g., production, staging). What is the best practice for secrets engine path naming?

Accepted Answer

Use hierarchical paths like 'app/env/secret'. Hierarchical paths like 'app/env/secret' are the best practice because they allow Vault's ACL policies to apply fine-grained access control at each level of the path. This structure maps directly to the organization's application and environment boundaries, enabling least-privilege access without complex policy rules. It also simplifies secret rotation and auditing by keeping related secrets logically grouped.

Answer

Use a single path like 'secrets/' for simplicity

Answer

Use the same path for all applications but separate with prefixes like 'app1-'

Answer

Use random UUIDs to avoid guessing

Question 8

An administrator wants to create a policy that grants the ability to list all authentication methods enabled on the Vault server. Which path and capability are required?

Accepted Answer

path "sys/auth" { capabilities = ["list"] }. Option A. To list all enabled authentication methods, the required path is 'sys/auth' with the 'list' capability. The 'list' action returns the names of all auth methods. Option B is incorrect because it includes 'read', which is unnecessary and not required for listing. Option C is also incorrect because it only has 'read', which would only retrieve a specific method if the name is known. Option D uses a wildcard 'auth/*', which would grant list capability on all sub-paths under 'auth/', but the standard path for listing auth methods is 'sys/auth'. Therefore, option A is the most precise and correct.

Answer

path "sys/auth" { capabilities = ["read", "list"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Answer

path "auth/*" { capabilities = ["list"] }

Question 9

An administrator wants to allow users to authenticate to Vault using their existing corporate GitHub accounts. Which authentication method should be enabled?

Accepted Answer

GitHub. The GitHub authentication method in Vault allows users to authenticate using their existing corporate GitHub accounts by mapping GitHub teams to Vault policies. This is the only option that directly integrates with GitHub's OAuth-based authentication flow, enabling single sign-on without requiring additional directory services or identity providers.

Answer

LDAP

Answer

Okta

Answer

Username & password (userpass)

Question 10

Which TWO of the following are valid methods to revoke a Vault token?

Accepted Answer

vault token revoke . `vault token revoke ` is the direct command to revoke a specific Vault token by its token value. This invalidates the token immediately, preventing any further use. Option D is correct because `vault token revoke -accessor ` revokes a token using its accessor, which is a non-sensitive identifier that can be used to manage tokens without exposing the token itself.

Answer

vault secrets disable <path>

Answer

vault auth disable <path>

Answer

vault policy delete <name>

Question 11

A Vault cluster uses Integrated Storage with 5 nodes. After a network split, the cluster loses quorum and becomes sealed. The network is restored, but the cluster does not automatically recover. What should the administrator do to recover the cluster?

Accepted Answer

Identify the node with the most recent data and use `vault operator raft recover` to create a new cluster from that node.. When a Vault cluster with Integrated Storage loses quorum due to a network split, the cluster seals itself to prevent split-brain. After the network is restored, the cluster does not automatically recover because the Raft consensus algorithm requires a majority of nodes to form a quorum. Option D is correct because `vault operator raft recover` allows an administrator to force a single node (typically the one with the most recent data) to form a new cluster, discarding the other nodes' data and re-establishing quorum.

Answer

Use `vault operator raft snapshot restore` on each node to restore from a backup.

Answer

Restart all nodes simultaneously to force a new leader election.

Answer

Manually unseal each node using the unseal keys.

Question 12

What command is used to view the remaining time on a lease?

Accepted Answer

vault lease lookup . The correct command to view the remaining time on a lease is `vault lease lookup `. This command retrieves the lease metadata, including the issue time, duration (TTL), and remaining time, directly from the Vault server. It is the standard method for inspecting lease details without extending or modifying the lease.

Answer

vault lease info <lease_id>

Answer

vault status <lease_id>

Answer

vault read <lease_id>

Question 13

A company wants to securely store database credentials for a dynamic application that spins up new instances frequently. They need to ensure each instance gets a unique, time-limited username/password pair with minimal operational overhead. Which approach should they use?

Accepted Answer

Enable the database secrets engine and configure role-based dynamic credential generation. The database secrets engine in HashiCorp Vault is designed specifically for dynamic credential generation, creating unique, time-limited username/password pairs on-demand for each instance. This approach minimizes operational overhead by automating credential lifecycle management, including automatic revocation after the TTL expires, which aligns perfectly with the requirement for frequently spinning up instances.

Answer

Use the transit secrets engine to encrypt the static credentials and distribute them

Answer

Use the PKI secrets engine to issue certificates for database authentication

Answer

Store the credentials in KV v2 and have each instance read them

Question 14

An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?

Accepted Answer

PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}. Creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.

Answer

POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}

Answer

POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}

Answer

PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}

Question 15

An organization uses the Transit secrets engine to encrypt sensitive files. They want to rotate the encryption key regularly without re-encrypting all existing files. Which feature allows this?

Accepted Answer

Key versioning. The Transit secrets engine in Vault supports key versioning, which allows you to rotate the encryption key by creating a new version while keeping older versions available for decryption of existing ciphertext. This means you can regularly rotate the key without needing to re-encrypt all previously encrypted files, as each ciphertext is tagged with the key version used to encrypt it.

Answer

Key derivation

Answer

Key ttl

Answer

Convergent encryption