VA-003 Practice Test 4 — 10 Questions

Question 1

An administrator creates a token role with 'allowed_policies' and tries to create a child token. What does this error indicate?

Accepted Answer

The token role's token_count_limit has been reached. The error 'token count per user (3) exceeded' indicates that the number of tokens issued for that entity (user or role) has exceeded the maximum allowed, which is controlled by the 'token_count_limit' parameter in the token role. Option D correctly identifies this limit as the cause. Option A is irrelevant because revocation count is not involved. Option B is incorrect because the error is about token count, not TTL. Option C is incorrect because the error is about quantity, not policy permissions.

Answer

The token has been revoked too many times

Answer

The token's TTL is too short

Answer

The token's policy is not allowed by the role

Question 2

A development team needs tokens that can be renewed automatically as long as they are still in use, up to a maximum lifetime of 72 hours. Which token type and configuration should be used?

Accepted Answer

Service token with a TTL of 1h and max TTL of 72h. A service token with a TTL of 1 hour and a max TTL of 72 hours allows automatic renewal as long as the token is still in use, up to the maximum lifetime of 72 hours. This configuration ensures that the token's TTL is extended on each use, preventing expiration during active sessions while enforcing an absolute upper limit.

Answer

Periodic token with a TTL of 72h

Answer

Orphan token with a TTL of 1h

Answer

Batch token with a TTL of 72h

Question 3

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Accepted Answer

vault write shared/data/db_password value=s3cret. In Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Answer

vault write shared/db_password value=s3cret

Answer

vault write shared/metadata/db_password value=s3cret

Answer

vault write shared/config/db_password value=s3cret

Question 4

A Vault administrator notices that the audit log file on the Vault server is filling up the disk. What is the best course of action to prevent disk full issues?

Accepted Answer

Configure the file audit device with log rotation.. Configuring log rotation on the file audit device allows the Vault server to automatically archive or delete old audit logs based on size or time thresholds, preventing the disk from filling up while retaining necessary audit data. This is the recommended approach in Vault for managing disk space without disabling security auditing or relying on external infrastructure changes.

Answer

Disable audit logging to reduce disk usage.

Answer

Switch to a syslog audit device.

Answer

Increase the disk size of the Vault server.

Question 5

A team wants to store static secrets like database passwords and rotate them periodically. Which secrets engine should they enable?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is designed for static secrets like database passwords, offering versioning, configurable deletion, and periodic rotation via lease management or external automation. It stores secrets as key-value pairs with metadata, making it ideal for static credentials that need controlled lifecycle management.

Answer

AWS secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 6

A company uses HashiCorp Vault in production to manage secrets for its microservices. One microservice, 'order-svc', authenticates via AppRole and receives a service token with a TTL of 24 hours and a max TTL of 48 hours. Over the past few days, operations teams report that 'order-svc' fails to renew its token after approximately 23 hours, causing authentication failures. The token lookup shows the token is still alive with about 1 hour of TTL remaining, but renewal attempts return a 'permission denied' error. The Vault audit logs show the renewal request is reaching Vault and being denied. The token's policies include 'path "auth/token/renew-self" { capabilities = ["update"] }'. The token was created with the default options. What is the most likely cause of this failure?

Accepted Answer

The token has already been renewed up to its max TTL, so further renewal would exceed the max. The token's max TTL of 48 hours has been reached after repeated renewals. Each renewal extends the token's TTL up to the max TTL, and once that limit is hit, further renewal attempts are denied with a 'permission denied' error, even if the current TTL still shows remaining time. The token lookup showing 1 hour of TTL left indicates the token is still valid, but the renewal is blocked because it would exceed the configured max TTL.

Answer

The token's parent token has been revoked, making it an orphan

Answer

The token is a batch token and cannot be renewed

Answer

The token's num_uses has reached zero

Question 7

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Vault's `vault rewrap` command re-encrypts existing ciphertext with the latest key version without decrypting the underlying plaintext, preserving the data's confidentiality. This is essential after a key rotation to ensure all ciphertext uses the new key, meeting compliance requirements for periodic key rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 8

A DevOps team uses Vault to manage secrets for a microservices application. The application authenticates to Vault using AppRole, and each service obtains a periodic token with a TTL of 24 hours and a period of 1 hour. The tokens are used to read secrets from a path. Recently, the team noticed that some services are unable to read secrets after a few hours, with error messages indicating that the token is not authorized or has expired. Upon investigation, the team finds that the tokens are being renewed properly but still fail after some time. What is the most likely cause of this issue?

Accepted Answer

The tokens have a shorter max TTL than the period, causing them to expire before they can be renewed.. The tokens have a period of 1 hour and a TTL of 24 hours, but the max TTL (maximum allowed lifetime) for the token or the role is likely set to a value shorter than the period. In Vault, the period controls how often the token must be renewed, while the max TTL is the absolute upper limit on the token's lifetime. If the max TTL is less than the period (e.g., 30 minutes), the token will expire before the next renewal attempt, even if renewal logic is correct.

Answer

The Vault server's maximum number of tokens per client has been exceeded.

Answer

The tokens are not being renewed correctly due to a bug in the renewal logic.

Answer

The AppRole secret ID is being revoked, causing tokens to become invalid.

Question 9

A Vault administrator wants to ensure that all secrets are encrypted at rest and in transit. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable TLS on all Vault listener configurations.. Enabling TLS on all Vault listener configurations ensures that data is encrypted in transit between clients and the Vault server, protecting against eavesdropping and man-in-the-middle attacks. Option C is correct because using a seal that provides envelope encryption (e.g., Auto Unseal with a cloud KMS) encrypts the master key and storage backend data, ensuring secrets are encrypted at rest. Together, these two configurations satisfy the requirement for encryption both in transit (TLS) and at rest (seal envelope encryption).

Answer

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Answer

Set the `encrypt` parameter on the audit device configuration.

Answer

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Question 10

A user receives an error 'invalid ciphertext' when trying to decrypt data. The ciphertext was created by another Vault instance. What is the most likely issue?

Accepted Answer

The ciphertext includes key version info that doesn't match. Vault's transit secrets engine appends key version information to the ciphertext by default. When decrypting, Vault checks that the key version embedded in the ciphertext matches a version of the key that exists in the destination Vault instance. If the ciphertext was created by a different Vault instance with a different key version history, the version embedded in the ciphertext will not correspond to any known key version, causing the 'invalid ciphertext' error.

Answer

Different key names

Answer

The Vault instance is sealed

Answer

Different key types

Answer

The user lacks permissions to decrypt