VA-003 Practice Test 33 — 15 Questions

Question 1

An operator configures a PKI role with allow_any_name=true and max_ttl=72h. A user requests a certificate with common_name='admin.example.com' and ttl=48h. What is the resulting TTL?

Accepted Answer

48h. The `max_ttl` setting on the PKI role defines the upper bound for certificate validity, but the user-requested TTL (48h) is within that bound (72h). The `allow_any_name=true` parameter permits any common name without restriction, so the certificate is issued with the requested TTL of 48h. The resulting TTL is the lesser of the requested TTL and the role's `max_ttl`, which in this case is 48h.

Answer

24h

Answer

72h

Answer

48h if allowed_domains matches, else error

Question 2

A Vault administrator runs `vault auth list` and sees the output above. The administrator wants to disable the default token authentication method to improve security. Which command should they run?

Accepted Answer

vault auth disable token/. The `vault auth list` output shows that the default token authentication method is enabled at the `token/` path. To disable it, the administrator must run `vault auth disable token/`, which removes the token auth method entirely. This improves security by preventing unauthenticated users from using the default token login endpoint, forcing the use of other configured auth methods like LDAP or AppRole.

Answer

vault auth disable userpass/

Answer

vault auth disable ldap/

Answer

vault auth disable approle/

Question 3

A company is running Vault in production with a single active node and two standby nodes using Integrated Storage. The operations team notices that after a network partition, one of the standby nodes becomes unavailable for a few minutes. Upon recovery, the node rejoins the cluster. However, the active node's performance degrades temporarily. What is the most likely cause?

Accepted Answer

The standby node's recovery caused Raft snapshot installation, leading to temporary I/O load on the active node.. When a standby node reconnects after a network partition, the Raft consensus protocol may require the node to catch up on missed log entries. If the log gap is large, the active node initiates a snapshot installation, which involves reading and sending a compressed snapshot of the Raft state. This process causes significant I/O and CPU load on the active node, temporarily degrading its performance.

Answer

The standby node caused a leadership election upon reconnection.

Answer

The standby node was not using a seal wrapping key, causing re-encryption of all data.

Answer

The standby node forced a full data sync from the active node, consuming resources.

Question 4

Which THREE steps are required to configure the database secrets engine for generating dynamic credentials?

Accepted Answer

Create a role that maps to the database user and permissions. Creating a role is the step that maps a named role in Vault to a database user template and its associated permissions (e.g., SQL statements for creation and revocation). This role definition is what Vault uses to dynamically generate a unique username and password when credentials are requested, ensuring each lease gets a dedicated database account with the specified privileges.

Answer

Configure a policy to allow users to read credentials from the role

Answer

Tune the engine's default TTL

Question 5

Match each Vault auth method to its authentication mechanism.

Accepted Answer

Token: A single-use token generated at login. Token auth uses a single-use token; Userpass uses username/password; AppRole uses RoleID/SecretID. Common confusions involve swapping these definitions.

Answer

Token: Username and password authentication

Answer

Userpass: Role ID and Secret ID

Answer

AppRole: A single-use token generated at login

Question 6

An administrator wants to ensure that a token created by a user cannot be used after 24 hours, even if the user tries to renew it. What should the administrator do?

Accepted Answer

Set explicit max TTL on the token to 24h. Setting an explicit max TTL on the token to 24h ensures that the token's lifetime cannot be extended beyond 24 hours, even if the user attempts to renew it. In Vault, the `explicit_max_ttl` parameter overrides any renewal requests, enforcing a hard upper limit on the token's validity. This directly addresses the requirement that the token cannot be used after 24 hours, regardless of renewal attempts.

Answer

Use a periodic token with a period of 24h

Answer

Create an orphan token with a TTL of 24h

Answer

Use a batch token

Question 7

An organization needs to store secrets with versioning support, allowing rollback to previous secret values. Which KV secrets engine version should be enabled?

Accepted Answer

KV v2. KV v2 is the correct choice because it provides versioning support for secrets, allowing users to retrieve and rollback to previous secret values. KV v1 stores secrets without versioning, and the Transit secrets engine is designed for encryption/decryption operations, not secret storage with versioning.

Answer

KV v3

Answer

KV v1

Answer

Transit secrets engine

Question 8

A Vault administrator is designing a policy for a CI/CD pipeline that must be able to read dynamic database credentials from "database/creds/my-role" and also write to "secret/data/ci-cd" for storing build artifacts. The policy should follow the principle of least privilege. Which policy statements should be used?

Accepted Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["create", "update"] }. It grants the minimum required capabilities: 'read' for reading dynamic database credentials from 'database/creds/my-role', and 'create' and 'update' for writing to 'secret/data/ci-cd'. The principle of least privilege dictates that 'delete' is unnecessary for storing build artifacts, and the path must be exact without a wildcard to avoid granting unintended access to sub-paths.

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["create", "update", "delete"] }

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd/*" { capabilities = ["create", "update"] }

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["write"] }

Question 9

Which TWO of the following are differences between using Vault's token auth method and other auth methods? (Choose two.)

Accepted Answer

Token auth is always enabled and cannot be disabled. Token auth is always enabled and cannot be disabled because it is the core authentication mechanism that Vault uses internally to represent all authenticated sessions. Every other auth method ultimately produces a Vault token, making the token auth method the foundational layer that cannot be removed or turned off without breaking Vault's entire authentication model.

Answer

Token auth does not support policies

Answer

Token auth is the only method that can create periodic tokens

Answer

Token auth cannot be used to create a root token

Question 10

A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?

Accepted Answer

The renewable flag requires the role to be updated after existing leases are issued.. The `renewable=false` setting on a Vault role only affects newly issued leases; it does not retroactively apply to leases that were already issued before the role was updated. Since the security team configured the role after some users had already obtained credentials, those existing leases retain their original `renewable=true` property, allowing users to renew them despite the new role setting. Vault enforces the `renewable` flag at lease creation time, not dynamically during renewal requests.

Answer

The renewable flag is not respected when max_ttl equals default_ttl.

Answer

The renewable flag is only applicable to token auth methods, not secrets engines.

Answer

The lease's renewable property is controlled by the client token's renewable status.

Question 11

Refer to the exhibit. An application needs to encrypt data using the transit engine with key "app-key". It currently has this policy. Which statement is true?

Accepted Answer

The policy allows both encryption and decryption, which is correct for the transit engine.. The transit engine in Vault uses the `encrypt` and `decrypt` capabilities to allow encryption and decryption operations, respectively. The policy shown uses `create` and `update` capabilities, which are correct for the transit engine because `create` is used to encrypt data (creating ciphertext) and `update` is used to decrypt data (updating the ciphertext back to plaintext). Therefore, the policy allows both encryption and decryption, making option B correct.

Answer

The policy allows both encryption and decryption, but the capabilities should be "read" and "write" instead.

Answer

The policy allows encryption but not decryption, which is sufficient.

Answer

The policy incorrectly uses "create" and "update" for transit operations; it should use "read" and "write".

Question 12

Which Vault API path is used to encrypt data with the transit engine?

Accepted Answer

/v1/transit/encrypt/{keyname}. The Vault transit engine uses the exact path `/v1/transit/encrypt/{keyname}` to encrypt plaintext data. The `{keyname}` parameter specifies the named encryption key stored in the transit engine, and the API endpoint expects a POST request with the plaintext base64-encoded in the request body. This path aligns with Vault's RESTful design where the action (`encrypt`) is a sub-path under the transit mount, and the key name is a required path parameter.

Answer

/v1/transit/enc/

Answer

/v1/transit/encrypt/

Answer

/v1/transit/encryption/

Answer

/v1/transit/encryption/{keyname}

Question 13

An organization wants to encrypt sensitive fields in their database using Vault. They have multiple applications that need to encrypt different types of data. What approach should they take?

Accepted Answer

Create a separate transit key per application. The Vault Transit Secrets Engine provides encryption-as-a-service, allowing each application to have its own named encryption key. This ensures cryptographic isolation: if one key is compromised, only the data encrypted with that specific key is at risk. Using separate keys per application also simplifies key rotation and access control, as each application can only use its designated key.

Answer

Use the PKI engine to issue certificates for each application

Answer

Use the KV engine to store encryption keys

Answer

Use a single key for all applications to simplify management

Answer

Encrypt data in the database using a static key stored in Vault

Question 14

A DevOps team uses Vault to generate temporary database credentials. They notice that some applications are failing because their database credentials expire unexpectedly before the expected TTL. The Vault admin configured the database role with a default TTL of 1h and max TTL of 24h. What is the most likely cause?

Accepted Answer

The application is not renewing the lease, and the lease TTL is counted from the issue time.. Vault database credentials are issued as leases with a TTL that starts counting from the moment they are issued. If the application does not renew the lease, the credentials expire exactly after the default TTL (1 hour) has elapsed, regardless of the max TTL setting. The failure occurs because the application expects the credentials to last longer, but the lease TTL is not extended without renewal.

Answer

The database role's max TTL is being enforced, but the default TTL is shorter.

Answer

The Vault server's clock is skewed, causing early expiry.

Answer

The application is renewing the lease too frequently, causing Vault to reset the TTL.

Question 15

An administrator needs to securely provide a one-time use token to a remote service using Vault response wrapping. Which CLI flag or command should they use?

Accepted Answer

Use 'vault write -wrap-ttl=5m auth/token/create'. `vault write -wrap-ttl=5m auth/token/create` creates a one-time use token wrapped in a response-wrapping envelope with a specified TTL. The remote service can then unwrap the token using `vault unwrap` with the wrapping token, ensuring secure delivery without exposing the actual token in transit.

Answer

Use 'vault write -response-wrap auth/token/create'

Answer

Use 'vault unwrap' on the remote service

Answer

Use 'vault wrap auth/token/create'