VA-003 Practice Test 36 — 15 Questions

Question 1

Which TWO of the following are valid authentication methods in HashiCorp Vault? (Choose two.)

Accepted Answer

GitHub. GitHub is a valid authentication method in HashiCorp Vault. It allows users to authenticate using their GitHub personal access tokens, which are mapped to Vault policies based on the user's team membership in a specified GitHub organization. This method is commonly used for integrating Vault with existing GitHub workflows.

Answer

SAML

Answer

RADIUS

Answer

SSH

Question 2

During a security assessment, a penetration tester discovers that Vault's seal configuration uses a single master key stored in a file on the server. The attacker gains root access to the server and retrieves the unseal key. What is the best mitigation to prevent this scenario?

Accepted Answer

Use a cloud auto-unseal mechanism such as AWS KMS. Cloud auto-unseal mechanisms like AWS KMS decouple the unseal key from the Vault server itself. Instead of storing the master key on the local filesystem, Vault uses a cloud-based key management service (KMS) to wrap and unwrap the master key. Even if an attacker gains root access to the server, they cannot retrieve the unseal key because it is never stored locally; Vault must call the KMS API (with appropriate IAM credentials) to unseal, and those credentials can be further protected with instance profiles or roles.

Answer

Restrict network access to the Vault server with a firewall

Answer

Use Shamir's secret sharing to split the key across multiple files

Answer

Encrypt the unseal key file with a strong password

Question 3

A company uses Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. Clients in eu-west-1 report that they receive stale data when reading from the local secondary cluster's active node. What is the most likely cause?

Accepted Answer

The replication filter is excluding certain paths.. In Vault Enterprise Performance Replication, replication filters can be configured to exclude specific paths (e.g., secret engines or policies) from being replicated to secondary clusters. If a filter excludes certain paths, the secondary cluster will not receive updates for those paths, causing clients reading from the local secondary to see stale or missing data. This matches the symptom of stale reads on the secondary's active node.

Answer

The secondary cluster has not enabled performance standby.

Answer

The cluster is in 'primary_failover' mode.

Answer

The secondary cluster is in primary state instead of secondary.

Question 4

A developer needs to generate a new certificate for an internal web service using the PKI secrets engine. A role named 'webserver' has been created. What is the correct command to issue the certificate?

Accepted Answer

vault write pki/issue/webserver common_name=web.example.com. The PKI secrets engine uses the path `pki/issue/<role_name>` to issue certificates. The `vault write` command sends a POST request to this endpoint with the required `common_name` parameter, which generates a new certificate signed by the CA associated with the 'webserver' role.

Answer

vault write pki/webserver/issue

Answer

vault write pki/webserver/cert common_name=web.example.com

Answer

vault read pki/cert/webserver

Question 5

A developer wants to encrypt a password before storing it in a database. The encryption must be deterministic so that the same plaintext always produces the same ciphertext. Which encryption mode should be used in the transit secrets engine?

Accepted Answer

convergent-encryption. The transit secrets engine in Vault supports convergent encryption, which is a deterministic encryption mode where the same plaintext and context always produce the same ciphertext. This is achieved by using the plaintext itself as part of the encryption key derivation, ensuring repeatable output. The question specifically requires deterministic encryption, making convergent encryption the correct choice.

Answer

chacha20-poly1305

Answer

aes128-gcm96

Answer

aes-gcm

Answer

padding

Question 6

Which TWO statements about Vault replication are correct?

Accepted Answer

DR replication replicates all data including tokens and leases.. Vault DR replication is designed to replicate all data, including tokens, leases, and secrets, to a secondary cluster for disaster recovery purposes. This ensures that the secondary cluster can take over with a complete state if the primary fails, as it mirrors the entire Vault data store.

Answer

A DR secondary can be promoted to primary only if the primary is offline.

Answer

Performance replication replicates all secrets and auth methods.

Answer

Both performance and DR replication require a shared storage backend.

Question 7

A fintech company uses Vault Transit to encrypt credit card numbers (PANs) for PCI-DSS compliance. The security team enforces key rotation every 30 days, and Vault keeps previous key versions to allow decryption of old data. One day, a developer accidentally runs a command that deletes the latest key version before the rotation is complete. The company has Vault configured with key version soft-delete enabled. The incident response team needs to recover the ability to decrypt ciphertexts that were encrypted with the deleted key version. Which action should they take first?

Accepted Answer

Use the `vault write transit/keys/credit-cards/undelete` API to recover the soft-deleted key version. Vault's Transit secrets engine supports soft-delete for key versions, which allows recovery of a deleted key version using the `undelete` API before the deletion grace period expires. Since the company has soft-delete enabled, the key version is not permanently purged and can be restored without data loss, enabling decryption of ciphertexts encrypted with that version.

Answer

Restore the entire Vault cluster from the latest backup snapshot

Answer

Use the `rewrap` endpoint to re-encrypt all ciphertexts with the current key version

Answer

Restore the deleted key version from a secondary Vault cluster using replication

Question 8

A DevOps team is troubleshooting token access in Vault. They need to determine which of the following token operations require sudo capability. Which TWO operations require sudo capability?

Accepted Answer

Revoke a token. Revoking a token (Option D) requires sudo capability because it is a privileged operation that can disrupt access for users or services. By default, Vault's token revocation endpoints are protected by sudo policies to prevent accidental or unauthorized revocation of tokens, which could lead to denial of service.

Answer

Create a token

Answer

Renew a token

Answer

Read token accessor information

Question 9

Which THREE of the following are true about batch tokens?

Accepted Answer

They have a TTL that must be set at creation. Batch tokens in Vault are designed to be lightweight, non-renewable tokens that must have a Time-To-Live (TTL) set at creation. They are not renewable, meaning once they expire, they cannot be renewed or extended. This makes them ideal for short-lived, high-volume workloads where token lifecycle management is automated.

Answer

They can be created as orphan tokens

Answer

They are always root tokens

Question 10

A DevOps team is using Vault tokens with short TTLs for CI/CD jobs. They notice that some jobs fail intermittently with 'permission denied' errors even though the token policy grants the required capabilities. The token is created with a TTL of 10 minutes and renewed automatically by the client library. What is the most likely cause of the failures?

Accepted Answer

The token's max_ttl has been exceeded, causing renewal to fail.. Vault tokens have both a TTL (time-to-live) and a max_ttl (maximum time-to-live). When a token is renewed, its TTL is reset to the original TTL (10 minutes) but only if the cumulative lifetime has not exceeded the max_ttl. If the max_ttl is reached, renewal fails, the token expires, and subsequent operations using that token return 'permission denied' errors, even though the policy itself grants the required capabilities.

Answer

The token's parent token has been revoked.

Answer

The token's max_ttl is being reset each time the token is renewed.

Answer

The token's TTL is too short and the client library is not renewing in time.

Question 11

A company uses Vault to store application configuration secrets for multiple teams. The Vault cluster is running in production and has the KV secrets engine enabled at the path 'secret/' using version 2. A DevOps engineer, using a Vault token with full admin access, creates a new secret at 'secret/data/team-a/app-config' using the CLI command 'vault kv put secret/team-a/app-config key=value'. The secret is intended for the CI/CD pipeline, which uses a token with a policy that grants 'read' capability on 'secret/data/*'. The pipeline is configured to read the secret by calling the Vault API at the path 'v1/secret/team-a/app-config'. The pipeline reports a 404 Not Found error. The pipeline engineer verifies that the token is valid and has the correct policy attached. All other secrets in the same path can be read successfully by the pipeline. What is the most likely cause of the 404 error?

Accepted Answer

The pipeline is using the wrong API path: for KV v2, the path must include '/data/' before the secret path.. The KV secrets engine version 2 (v2) requires the '/data/' segment in the API path for reading secret data. The pipeline is calling 'v1/secret/team-a/app-config', which omits the mandatory '/data/' prefix, causing a 404 Not Found error. The CLI command 'vault kv put' automatically handles this path translation, but the direct API call does not.

Answer

The secret engine at 'secret/' is not enabled.

Answer

The secret was written to a different path than expected.

Answer

The token's policy does not cover the path 'secret/team-a/app-config'.

Question 12

A CI/CD pipeline runs in a Kubernetes cluster and needs to authenticate to Vault to fetch secrets. The pipeline should not have to manage any long-lived credentials. Which authentication method is most suitable?

Accepted Answer

Kubernetes authentication. The Kubernetes authentication method allows the CI/CD pipeline to authenticate to Vault using its Kubernetes service account token, which is automatically mounted into the pod. This eliminates the need for managing long-lived credentials because Vault verifies the token against the Kubernetes API server and issues a short-lived Vault token in return.

Answer

Token authentication

Answer

LDAP authentication

Answer

AWS IAM authentication

Question 13

A SaaS company uses AppRole authentication for their CI/CD pipeline. The pipeline runs on a Jenkins server. The pipeline generates a secret ID using the AppRole 'ci-role' and then logs in to Vault to read a database credential. Recently, the pipeline started failing intermittently with errors like 'secret ID is expired' or 'secret ID is used'. The pipeline generates a new secret ID every run. The team verified that the AppRole's secret_id_ttl is set to 0 (unlimited) and the secret_id_num_uses is set to 1. The pipeline runs multiple jobs concurrently, sometimes using the same AppRole. What is the most likely cause and solution?

Accepted Answer

Use response wrapping for the secret ID delivery to ensure each job gets a unique wrapped token.. The intermittent failures ('secret ID is expired' or 'secret ID is used') occur when multiple concurrent pipeline jobs generate a new secret ID for the same AppRole 'ci-role' with secret_id_num_uses=1. Since each secret ID can only be used once, concurrent jobs may attempt to reuse an already-consumed secret ID or generate overlapping IDs. Response wrapping delivers a unique wrapped token to each job, ensuring that each job receives a fresh, single-use secret ID without race conditions, as the wrapping token is unwrapped only once per job.

Answer

Set secret_id_num_uses to 0 to allow unlimited uses.

Answer

Create separate AppRoles for each pipeline job.

Answer

Increase secret_id_ttl to a high value like 24h.

Question 14

Which THREE are best practices when selecting authentication methods for different use cases?

Accepted Answer

Use AppRole for automated CI/CD pipelines.. AppRole is designed for machine-to-machine authentication, making it ideal for automated CI/CD pipelines. It provides a secure way for applications to obtain a Vault token using a RoleID and SecretID, without requiring a human user. This avoids the security risks of long-lived tokens and allows for dynamic, short-lived credentials.

Answer

Use token auth as the sole method for all users and machines.

Answer

Use Kubernetes auth for pods in any environment.

Question 15

A DevOps engineer is tasked with automating the rotation of a static secret stored in Vault's KV secrets engine (version 2). The secret is currently stored at path 'secret/data/app/config' with keys 'username' and 'password'. The engineer wants to update the 'password' key using the Vault CLI from a CI/CD pipeline. The pipeline uses a token with a policy that grants 'create', 'update', and 'read' capabilities on 'secret/data/app/*'. Which CLI command should the engineer use to update only the 'password' key, leaving other keys unchanged?

Accepted Answer

vault kv patch secret/data/app/config password=newpass. `vault kv patch` is specifically designed for KV v2 secrets engines to update individual keys without overwriting other keys. It performs a read-modify-write operation under the hood, sending a PATCH request to the API, which only modifies the specified fields. The policy grants 'create', 'update', and 'read' on 'secret/data/app/*', which aligns with the required capabilities for patching.

Answer

vault kv put secret/data/app/config password=newpass

Answer

vault update secret/data/app/config password=newpass

Answer

vault write secret/data/app/config password=newpass