VA-003 Practice Test 34 — 15 Questions

Question 1

Which TWO of the following are valid uses of the Vault API for managing leases? (Choose two.)

Accepted Answer

PUT /v1/sys/leases/revoke with body {"lease_id": "abc123"}. The Vault API uses a PUT request to `/v1/sys/leases/revoke` with a JSON body containing the `lease_id` to revoke a specific lease. This is the standard method for lease revocation as documented in the Vault API specification. Option D is correct because renewing a lease also requires a PUT request to `/v1/sys/leases/renew` with the `lease_id` in the request body, matching the expected API pattern for state-changing operations.

Answer

GET /v1/sys/leases/renew/abc123

Answer

POST /v1/sys/leases/renew/abc123

Answer

GET /v1/sys/leases/revoke/abc123

Question 2

A security analyst discovers that a token used by a legacy application is still active long after the application was decommissioned. Which Vault feature should have been used to automatically expire tokens when the application is no longer running?

Accepted Answer

Set a TTL on the token. Setting a Time-To-Live (TTL) on the token ensures it automatically expires after a specified duration, even if the application is decommissioned. This prevents orphaned tokens from remaining active indefinitely, which is a security risk. Vault's TTL mechanism is designed to enforce token lifetime limits without requiring manual intervention.

Answer

Enable token renewal to keep it alive

Answer

Use a periodic token and revoke it manually

Answer

Use a batch token to limit its lifetime

Question 3

An organization wants to encrypt data in transit and at rest using a centralized key management system. Which secrets engine is designed for encryption/decryption operations without storing data?

Accepted Answer

Transit secrets engine. The Transit secrets engine performs encryption/decryption operations on data in transit without storing the data itself. It is designed for centralized key management, allowing applications to send plaintext for encryption or ciphertext for decryption via API calls, while the keys remain securely managed within Vault. This makes it ideal for encrypting data in transit and at rest without persisting the data.

Answer

KV secrets engine

Answer

PKI secrets engine

Answer

Database secrets engine

Question 4

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Accepted Answer

24h. (24h) because when a certificate request is made, Vault applies the most restrictive TTL among the role's configured `ttl`, the mount's default lease TTL, and the requested TTL. Here, the role's `ttl` of 24h is the shortest, so it overrides both the requested 48h and the mount default of 72h, resulting in a certificate with a 24-hour validity.

Answer

The request will be rejected because the requested TTL exceeds the role's ttl.

Answer

48h

Answer

72h

Question 5

A company uses Vault Enterprise with Performance Replication across two data centers. The primary data center is in us-east-1 and the secondary is in eu-west-1. They have an application that writes secrets to the primary cluster, and those secrets are replicated to the secondary cluster for read access. Recently, they noticed that some secrets written to the primary are not appearing on the secondary even after several minutes. The latency between data centers is typically 50ms. The administrator checks the replication status and sees a 'merkle sync' in progress. What is the most likely reason for the delay?

Accepted Answer

The secondary cluster is experiencing write load that is causing replication to fall behind.. Performance Replication in Vault Enterprise uses asynchronous streaming of write-ahead log (WAL) entries to replicate data to secondary clusters. When a 'merkle sync' is in progress, it indicates that the secondary cluster has fallen behind and is performing a full tree comparison to reconcile differences. The most likely cause is that the secondary cluster is under write load, which can cause it to process replication WAL streams more slowly, leading to a backlog and triggering a merkle sync to catch up.

Answer

The replication token has expired.

Answer

The primary cluster is using a different seal type than the secondary.

Answer

Performance Replication only replicates data once per hour by default.

Question 6

An organization uses a PostgreSQL database. They configure a database secrets engine with a role that grants read-only access. However, after revoking the lease, the database user still exists. What is the most likely cause?

Accepted Answer

The revocation statement is not configured in the database connection. When a database secrets engine role is configured in Vault, the revocation statement (e.g., `ALTER USER "{{name}}" NOLOGIN;` or `DROP USER IF EXISTS "{{name}}";`) must be explicitly defined in the database connection's `rotation_statements` or `revocation_statements`. If no revocation statement is set, Vault will successfully create and manage the database user but will not execute any SQL to disable or drop that user when the lease is revoked, leaving the user active in PostgreSQL.

Answer

The database secrets engine does not support revocation

Answer

The role's default_ttl is set too high

Answer

The lease duration is too long

Question 7

A Vault cluster with three nodes using Integrated Storage (Raft) is healthy with one active and two standby nodes. A network partition isolates the active node. What will happen?

Accepted Answer

The two standby nodes elect a new leader and continue writing.. In a Vault cluster with Integrated Storage (Raft), a majority of nodes (quorum) is required to maintain leadership and process write operations. When the active node is isolated, the two remaining standby nodes still constitute a majority (2 out of 3). They will hold a new leader election using the Raft consensus algorithm, elect a new active node, and continue accepting write requests. The isolated node, upon reconnection, will be treated as a follower and replicate data from the new leader.

Answer

The two standby nodes will seal themselves.

Answer

The two standby nodes remain in standby state.

Answer

The cluster becomes read-only until the active node rejoins.

Question 8

An organization wants to use Vault to generate AWS IAM users with specific managed policies attached. They have configured the AWS secrets engine with the appropriate IAM credentials. What step is required to ensure each generated user gets the correct policies?

Accepted Answer

Configure a role in the AWS secrets engine that specifies the managed policies. The AWS secrets engine in Vault uses roles to define the exact permissions and policies for generated IAM users. By configuring a role that specifies the managed policies, Vault ensures that each dynamically generated IAM user is created with those policies attached, meeting the organization's requirement.

Answer

Enable the AWS secrets engine at a custom path

Answer

Set a high TTL on the AWS secrets engine mount

Answer

Use the transit secrets engine to encrypt the AWS credentials

Question 9

Match each Vault seal type to its description.

Accepted Answer

Shamir seal: Uses Shamir's secret sharing to split the master key into key shares distributed to operators. The correct matches are: Shamir seal uses secret sharing; AWS KMS seal uses AWS KMS; HSM seal uses a hardware module. Common confusions involve swapping cloud-based seals with Shamir or HSM.

Answer

Shamir seal: Uses AWS KMS to encrypt/decrypt the master key

Answer

AWS KMS seal: Uses Shamir's secret sharing to split the master key into shares

Question 10

Drag and drop the steps to create and use a periodic service token in Vault into the correct order.

Accepted Answer

Create role, generate token, use token, renew periodically. First create the role, then generate a token with a TTL, use it, and renew periodically.

Answer

Generate token, create role, use token, renew periodically

Answer

Create role, use token, renew periodically, generate token

Answer

Generate token, use token, renew periodically, create role

Question 11

Drag and drop the steps to set up Vault's Kubernetes auth method into the correct order.

Accepted Answer

Enable the Kubernetes auth method, then configure it with the Kubernetes host and CA cert, then create a role that binds a service account, then deploy a pod using that service account, then verify login using the Vault token.. The correct sequence for setting up Vault's Kubernetes auth method is: enable the auth method, configure it with the Kubernetes API server details, create a role that binds to a service account, deploy a pod using that service account, and finally verify login. This order ensures that each prerequisite is fulfilled before the subsequent step can function correctly.

Answer

Configure the Kubernetes auth method with host and CA cert, then enable it, then create a role, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then create a role, then configure the auth method, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then configure it, then deploy a pod, then create a role, then verify login.

Question 12

Refer to the exhibit. A developer tries to renew a token and receives this error. The token was created using 'vault token create -type=batch'. What is the most likely cause of this error?

Accepted Answer

The token is a batch token. Batch tokens are non-persistent and do not have associated lease IDs, so they cannot be renewed. The error occurs because the developer attempted to renew a batch token using 'vault token renew', which is only valid for service tokens that have a lease and can be extended. The exhibit shows a renewal failure, and since the token was created with 'vault token create -type=batch', the most likely cause is that batch tokens are inherently non-renewable.

Answer

The token is a service token and has expired

Answer

The token is a periodic token and its period has expired

Answer

The token is an orphan token

Question 13

An organization needs to automatically issue X.509 certificates for internal services. Which secrets engine should they use?

Accepted Answer

PKI secrets engine. The PKI secrets engine is specifically designed to generate X.509 certificates for internal services. It acts as a certificate authority (CA), handling certificate signing requests (CSRs), issuing certificates with configurable lifetimes, and managing revocation via CRLs or OCSP. This directly meets the requirement for automated certificate issuance.

Answer

SSH secrets engine

Answer

Cert secrets engine

Answer

Transit secrets engine

Question 14

Which authentication method in Vault uses a shared secret (Role ID) and a dynamic secret (Secret ID) to authenticate machines or applications?

Accepted Answer

AppRole. AppRole is the correct authentication method because it is specifically designed for machine-to-machine or application-to-application authentication in Vault. It uses a static Role ID (like a username) combined with a dynamically generated Secret ID (like a password) that can be created, revoked, or have a time-to-live, providing a secure and flexible way for non-human entities to obtain a Vault token.

Answer

LDAP

Answer

Username & password (userpass)

Answer

Okta

Question 15

Which THREE are benefits of using Vault response wrapping?

Accepted Answer

Reduces the risk of secret exposure in transit. Vault response wrapping is a feature that encapsulates a secret or token in a single-use, time-limited wrapping token. Option A is correct because the secret is never transmitted in plaintext over the wire; instead, the wrapping token is sent, and the actual secret is retrieved only by unwrapping it, which reduces the risk of secret exposure during transit. Option C is correct because the wrapping token is designed for a single unwrap operation—once unwrapped, the token is destroyed, ensuring the secret is used only once. Option E is correct because response wrapping allows a user to delegate access to a secret by sharing the wrapping token instead of the actual token, enabling secure delegation without exposing the underlying credential.

Answer

Supports unlimited unwraps

Answer

Increases the TTL of the secret