VA-003 Practice Test 35 — 15 Questions

Question 1

A DevOps engineer is designing a Vault architecture for a multi-cloud environment spanning AWS, GCP, and on-premises data centers. The requirement is to have low-latency read access to secrets across all regions, and the ability to handle a full regional outage without manual intervention. Which architecture best meets these requirements?

Accepted Answer

Single Vault cluster spread across all regions using Integrated Storage with voter and non-voter nodes.. Option D is correct because a single Vault cluster using Integrated Storage with voter and non-voter nodes can span multiple regions and clouds, providing low-latency reads via local non-voter nodes while maintaining a single Raft consensus group. This architecture handles a full regional outage without manual intervention because the Raft protocol automatically maintains quorum across voter nodes, and non-voter nodes can be promoted if needed, ensuring continuous read availability and automatic failover.

Answer

Single Vault cluster with performance standby nodes in each region.

Answer

Multiple Vault clusters with disaster recovery replication using Performance Replication.

Answer

Multiple Vault clusters with Disaster Recovery (DR) replication and an automated failover script that promotes a DR cluster to primary.

Question 2

Refer to the exhibit. Based on the output from 'vault status', which statement is true?

Accepted Answer

The unseal configuration uses 5 key shares with a threshold of 3.. The 'vault status' output shows 'Sealed: false', 'Key Shares: 5', and 'Key Threshold: 3'. This indicates that Vault is unsealed and uses a Shamir seal configuration with 5 key shares, requiring any 3 of them to unseal. Option B correctly states this unseal configuration.

Answer

The storage backend is a file backend.

Answer

Auto-unseal is enabled using Consul as the seal provider.

Answer

Vault is not configured for high availability.

Question 3

A Vault cluster with three nodes using Integrated Storage (Raft) is healthy with one active and two standby nodes. A network partition isolates the active node. What will happen?

Accepted Answer

The two standby nodes elect a new leader and continue writing.. In a Vault cluster with Integrated Storage (Raft), a majority of nodes (quorum) is required to maintain leadership and process write operations. When the active node is isolated, the two remaining standby nodes still constitute a majority (2 out of 3). They will hold a new leader election using the Raft consensus algorithm, elect a new active node, and continue accepting write requests. The isolated node, upon reconnection, will be treated as a follower and replicate data from the new leader.

Answer

The two standby nodes will seal themselves.

Answer

The two standby nodes remain in standby state.

Answer

The cluster becomes read-only until the active node rejoins.

Question 4

A Vault cluster uses Integrated Storage with 5 nodes. After a network split, the cluster loses quorum and becomes sealed. The network is restored, but the cluster does not automatically recover. What should the administrator do to recover the cluster?

Accepted Answer

Identify the node with the most recent data and use `vault operator raft recover` to create a new cluster from that node.. When a Vault cluster with Integrated Storage loses quorum due to a network split, the cluster seals itself to prevent split-brain. After the network is restored, the cluster does not automatically recover because the Raft consensus algorithm requires a majority of nodes to form a quorum. Option D is correct because `vault operator raft recover` allows an administrator to force a single node (typically the one with the most recent data) to form a new cluster, discarding the other nodes' data and re-establishing quorum.

Answer

Use `vault operator raft snapshot restore` on each node to restore from a backup.

Answer

Restart all nodes simultaneously to force a new leader election.

Answer

Manually unseal each node using the unseal keys.

Question 5

Refer to the exhibit. What operation was performed on the secret "mysecret"?

Accepted Answer

Read. The exhibit shows a Vault CLI command that retrieves the value of a secret at the path 'secret/mysecret'. The 'vault read' command is used to read data from Vault's key-value store, returning the stored value. Since the command 'vault read secret/mysecret' is executed, the operation performed is a Read, making option B correct.

Answer

Write

Answer

Delete

Answer

List

Question 6

After a failover event in a Vault HA cluster with Integrated Storage, the new active node reports a 'sealed' status incorrectly in monitoring metrics, but the cluster is still functioning correctly. What is the most likely cause?

Accepted Answer

Inconsistent seal configuration across nodes.. When a Vault HA cluster with Integrated Storage experiences a failover, the new active node must have a seal configuration that matches the cluster's unseal mechanism. If the seal configuration (e.g., Shamir threshold, auto-unseal KMS key, or transit engine path) is inconsistent across nodes, the new active node may report as 'sealed' in monitoring metrics even though the cluster is functional. This happens because the monitoring endpoint reads the node's local seal status, which can differ from the actual cluster state if the node cannot properly verify its own unseal state due to misconfiguration.

Answer

The new active node is actually a standby.

Answer

The Vault token used for monitoring has expired.

Answer

The storage backend is corrupted.

Question 7

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. Option A is correct because `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 8

An administrator wants to retrieve the value of a secret stored at the path 'kv/secret/mykey' using the Vault CLI. Which command should they use?

Accepted Answer

vault read kv/secret/mykey. The correct command to retrieve a secret from Vault's KV secrets engine is `vault read`. This command is used to read data and metadata from a specified path. Option D is correct because `vault read kv/secret/mykey` will retrieve the value stored at that path, assuming the KV engine is mounted at `kv/`.

Answer

vault get kv/secret/mykey

Answer

vault retrieve kv/secret/mykey

Answer

vault show kv/secret/mykey

Question 9

An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?

Accepted Answer

PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}. Option C is correct because creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.

Answer

POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}

Answer

POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}

Answer

PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}

Question 10

An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?

Accepted Answer

POST /v1/auth/token/renew. Option B is correct because the `POST /v1/auth/token/renew` endpoint is the standard Vault API call to extend the Time-To-Live (TTL) of an existing token, which is a core token lifecycle operation. This endpoint accepts the token to renew in the request body and returns a new lease duration, adhering to Vault's token management design.

Answer

PUT /v1/auth/token/roles

Answer

DELETE /v1/auth/token/revoke

Question 11

A team wants to retrieve a dynamic database credential from Vault. Which CLI command should be used?

Accepted Answer

vault write database/creds/readonly. Option C is correct because Vault uses the `vault write` command to generate dynamic credentials from a database secrets engine. The `database/creds/readonly` path triggers the generation of a new credential (username/password) for the configured role, and the response includes the lease ID, username, and password. Unlike static secrets, dynamic credentials are created on demand and require a write operation to the role path.

Answer

vault list database/creds/readonly

Answer

vault generate database/creds/readonly

Answer

vault read database/creds/readonly

Question 12

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Accepted Answer

vault write shared/data/db_password value=s3cret. Option B is correct because in Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Answer

vault write shared/db_password value=s3cret

Answer

vault write shared/metadata/db_password value=s3cret

Answer

vault write shared/config/db_password value=s3cret

Question 13

A DevOps engineer runs `vault token lookup s.abc123` and receives a permission denied error. The engineer has a valid token with the default policy attached. What is the most likely cause?

Accepted Answer

The default policy does not grant permission to look up other tokens. The default policy in Vault is intentionally restrictive and does not include the `token/lookup` capability for tokens other than the caller's own token. Since the engineer is attempting to look up a specific token ID (`s.abc123`) rather than their own token, the default policy denies this action. The permission denied error is expected because the default policy only allows basic operations like reading system capabilities and managing the caller's own token, not inspecting other tokens.

Answer

The token does not have an attached policy that allows 'token/lookup'

Answer

The token is expired or revoked

Answer

The engineer used the token accessor instead of the token ID

Question 14

An engineer wants to list all secrets under the path 'myapp/' in a KV v2 secrets engine mounted at 'secret/'. Which API call should they make?

Accepted Answer

GET /v1/secret/metadata/myapp/. Option C is correct because in Vault KV v2, the LIST operation for secrets under a path is performed using a GET request to the `/v1/secret/metadata/myapp/` endpoint. This endpoint returns the list of secrets (keys) at that path, as the metadata path is used for listing and managing secret metadata, including subkeys. The trailing slash is required to indicate a directory listing.

Answer

LIST /v1/secret/data/myapp/

Answer

POST /v1/secret/metadata/myapp/

Answer

GET /v1/secret/myapp/

Question 15

A user attempts to read a secret at path 'secret/data/app' and receives a 403 Forbidden error. What is the most likely cause?

Accepted Answer

The token's policy does not grant read capability on that path. A 403 Forbidden error in Vault indicates that the token used for the request is valid and the path exists, but the token's attached policy does not grant the required 'read' capability on that specific path. This is a policy enforcement action by Vault's ACL system, which explicitly denies access when the policy lacks a matching 'read' rule for the path.

Answer

The secret engine is not mounted at 'secret/'

Answer

The secret key does not exist

Answer

The token has expired