VA-003 Practice Questions 2 — 50 Questions

Question 1

A developer requests a credential from this role. Which statement about the resulting lease is true?

Accepted Answer

The lease will have a TTL of 1 hour and cannot be renewed.. The role has default_ttl=1h and renewable=false, so the lease will have an initial TTL of 1 hour and cannot be renewed. The max_ttl of 24h is irrelevant because renewal is disabled. Option C is correct.

Answer

The lease will have a TTL of 24 hours and can be renewed.

Answer

The lease will have a TTL of 1 hour and can be renewed.

Answer

The lease will have a TTL of 24 hours and cannot be renewed.

Question 2

A Vault user wants to check the capabilities of their token on a specific path. Which command should they use?

Accepted Answer

vault token capabilities <path>. The `vault token capabilities` command is specifically designed to check what operations (e.g., read, create, update, delete, list) a given token is allowed to perform on a particular path. It evaluates the token's attached policies against the path and returns the effective capabilities, making it the correct tool for this task.

Answer

vault token list

Answer

vault policy capabilities

Answer

vault token lookup <token>

Question 3

Which TWO of the following are valid token states?

Accepted Answer

Revoked. Option D is correct because 'Revoked' is a standard token state defined in the OAuth 2.0 framework (RFC 7009) and implemented in Vault's token lifecycle. When a token is explicitly revoked via the `/sys/leases/revoke` endpoint or through a lease revocation, it transitions to the revoked state and can no longer be used for authentication or authorization.

Answer

Expired

Answer

Orphan

Answer

Suspended

Question 4

A security analyst discovers that a token used by a legacy application is still active long after the application was decommissioned. Which Vault feature should have been used to automatically expire tokens when the application is no longer running?

Accepted Answer

Set a TTL on the token. Option C is correct because setting a Time-To-Live (TTL) on the token ensures it automatically expires after a specified duration, even if the application is decommissioned. This prevents orphaned tokens from remaining active indefinitely, which is a security risk. Vault's TTL mechanism is designed to enforce token lifetime limits without requiring manual intervention.

Answer

Enable token renewal to keep it alive

Answer

Use a periodic token and revoke it manually

Answer

Use a batch token to limit its lifetime

Question 5

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Accepted Answer

24h. The correct answer is C (24h) because when a certificate request is made, Vault applies the most restrictive TTL among the role's configured `ttl`, the mount's default lease TTL, and the requested TTL. Here, the role's `ttl` of 24h is the shortest, so it overrides both the requested 48h and the mount default of 72h, resulting in a certificate with a 24-hour validity.

Answer

The request will be rejected because the requested TTL exceeds the role's ttl.

Answer

48h

Answer

72h

Question 6

A developer created a token and wants to ensure that the token can only be used to read secrets from the 'secret/data/production' path. Which policy attachment approach should be used?

Accepted Answer

Create a policy with read capability on 'secret/data/production' and attach it to the token. Option C is correct because Vault uses policies to define fine-grained access control, and the only way to restrict a token to read secrets from a specific path is to create a policy with the appropriate capabilities (e.g., 'read' on 'secret/data/production') and attach that policy to the token at creation time. Tokens themselves do not inherently carry path restrictions; they inherit permissions solely from attached policies.

Answer

Set the token's metadata to restrict access

Answer

Use a root token and restrict its use via a policy

Answer

Set the token type to service and it will automatically restrict access

Question 7

Which TWO of the following are valid methods to revoke a Vault token?

Accepted Answer

vault token revoke . Option A is correct because `vault token revoke ` is the direct command to revoke a specific Vault token by its token value. This invalidates the token immediately, preventing any further use. Option D is correct because `vault token revoke -accessor ` revokes a token using its accessor, which is a non-sensitive identifier that can be used to manage tokens without exposing the token itself.

Answer

vault secrets disable <path>

Answer

vault auth disable <path>

Answer

vault policy delete <name>

Question 8

A DevOps team needs to create a Vault policy that allows reading secrets from path "secret/data/app" but only for the key "db_password". They want to enforce this using Vault's policy syntax. Which policy statement achieves this?

Accepted Answer

path "secret/data/app" { capabilities = ["read"]; allowed_parameters = {"db_password"=[]} }. Option C is correct because it uses allowed_parameters to restrict to the key "db_password". Option A allows reading all keys. Option B uses an incorrect path for key-level restriction. Option D requires the parameter but does not restrict to only that key.

Answer

path "secret/data/app" { capabilities = ["read"] }

Answer

path "secret/data/app/db_password" { capabilities = ["read"] }

Answer

path "secret/data/app" { capabilities = ["read"]; required_parameters = ["db_password"] }

Question 9

An administrator wants to create a policy that grants the ability to list all authentication methods enabled on the Vault server. Which path and capability are required?

Accepted Answer

path "sys/auth" { capabilities = ["list"] }. Option B is correct. The path 'sys/auth' with 'list' capability lists all auth methods. Option A with 'read' would give details but not list. Option C includes both, which is overkill. Option D uses a wildcard that may also list unrelated items.

Answer

path "sys/auth" { capabilities = ["read", "list"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Answer

path "auth/*" { capabilities = ["list"] }

Question 10

A security administrator wants to create a policy that allows a service to renew its own token and list its own token capabilities, but not create new tokens. Which policy statements should be included?

Accepted Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["read"] }. Option B is correct because it uses the correct endpoints and capabilities: update for renew-self and read for capabilities-self. Option A uses update for capabilities-self, which is wrong. Option C uses create for renew-self, which is incorrect. Option D uses non-self endpoints giving broader privileges.

Answer

path "auth/token/renew-self" { capabilities = ["create"] }; path "auth/token/lookup-self" { capabilities = ["read"] }

Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["update"] }

Answer

path "auth/token/renew" { capabilities = ["update"] }; path "auth/token/capabilities" { capabilities = ["read"] }

Question 11

A Vault policy includes the following statement: path "secret/data/+/app" { capabilities = ["read"] }. Which paths would match this policy? (Assume KV v2)

Accepted Answer

secret/data/team-a/app. Option A is correct. The '+' glob matches exactly one path segment. So 'secret/data/team-a/app' has one segment between 'data/' and '/app', matching. Option B has two segments, so no match. Option C has no segment. Option D has an additional segment after app, so no match.

Answer

secret/data/team-a/app/db

Answer

secret/data/team-a/team-b/app

Answer

secret/data/app

Question 12

A Vault administrator is designing a policy for a CI/CD pipeline that must be able to read dynamic database credentials from "database/creds/my-role" and also write to "secret/data/ci-cd" for storing build artifacts. The policy should follow the principle of least privilege. Which policy statements should be used?

Accepted Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["create", "update"] }. Option A is correct. For database creds, read is sufficient. For KV v2, to write data, you need both create and update capabilities. Option B uses 'write' which is not a standard capability. Option C uses a glob that may be too broad. Option D adds delete which is not needed.

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["create", "update", "delete"] }

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd/*" { capabilities = ["create", "update"] }

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["write"] }

Question 13

A policy must allow a user to revoke their own token. Which endpoint and capability are required?

Accepted Answer

path "auth/token/revoke-self" { capabilities = ["update"] }. Option A is correct. The endpoint 'auth/token/revoke-self' with 'update' capability allows a user to revoke their own token. 'write' is not a standard capability. The other options either use wrong endpoints or capabilities.

Answer

path "auth/token/revoke" { capabilities = ["update"] }

Answer

path "auth/token/revoke-self" { capabilities = ["write"] }

Answer

path "sys/leases/revoke" { capabilities = ["update"] }

Question 14

A Vault operator is crafting a policy for a new application. Which two of the following are valid capabilities in a Vault policy path statement? (Select two.)

Accepted Answer

sudo. The valid capabilities are sudo and list. Modify, patch, and encrypt are not standard Vault policy capabilities.

Answer

modify

Answer

patch

Answer

encrypt

Question 15

A Vault policy has the following: path "identity/entity/id/*" { capabilities = ["read", "list"] }. What does this policy allow?

Accepted Answer

Listing all identity entities and reading their details.. Option D is correct. The path matches entity IDs. 'list' allows listing all entity IDs, and 'read' allows reading the details of each entity. Option A is too broad (might include aliases). Option B is partially correct but D is more precise. Option C includes update which is not allowed.

Answer

Reading and updating all identity entities.

Answer

Reading and listing all identity entities.

Answer

Reading and listing all identity entity IDs.

Question 16

Which three of the following are valid capabilities in a Vault policy path statement? (Select three.)

Accepted Answer

list. The valid capabilities are sudo, list, and deny. Patch and encrypt are not standard Vault policy capabilities.

Answer

encrypt

Answer

patch

Question 17

A Vault cluster has several policies. One policy, "app-policy", contains: path "secret/data/app/*" { capabilities = ["create", "update"] }. Another policy, "admin-policy", includes: path "secret/data/app/db" { capabilities = ["deny"] }. A token is attached with both policies. Can the token write to "secret/data/app/db"?

Accepted Answer

No, because deny takes precedence over allow.. Option B is correct. In Vault, deny statements override any other capabilities regardless of policy ordering. Therefore, the explicit deny on the specific path prevents the write, even though the first policy allows create/update.

Answer

No, because the paths conflict.

Answer

Yes, because policies are additive.

Answer

Yes, because the first policy allows create/update.

Question 18

A Vault policy must allow a service to read secrets from "secret/data/app" and also be able to renew its own token. Which two policy statements are necessary and sufficient for this requirement? (Select two.)

Accepted Answer

path "secret/data/app" { capabilities = ["read"] }. The necessary statements are path "secret/data/app" with read capability and path "auth/token/renew-self" with update capability. The other options either provide too much or are not relevant.

Answer

path "auth/token/renew" { capabilities = ["update"] }

Answer

path "secret/data/app/*" { capabilities = ["read"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Question 19

Refer to the exhibit. A user with this policy attempts to read the secret at path "secret/data/team-a/admin". What will happen?

Accepted Answer

The read is denied because the deny policy takes precedence.. Option B is correct. In Vault, a deny statement takes precedence over any other capabilities. Even though the wildcard grants read, the explicit deny on the specific path blocks access.

Answer

The read fails because the path does not exist.

Answer

The read succeeds because the first path grants read.

Answer

The read succeeds because deny only applies to write operations.

Question 20

An organization is implementing Vault policies for the first time. They want to ensure that policies are easy to manage and follow the principle of least privilege. Which approach should they take when creating policies?

Accepted Answer

Create separate policies for each application and use group aliases to attach them.. Option D is correct because creating separate policies per application and using group aliases to attach them allows granular control and follows least privilege. Option A is monolithic and insecure. Option B gives too much power. Option C is backwards; tokens inherit policies, not the other way.

Answer

Create policies with broad paths and then restrict via ACL tokens.

Answer

Create a single policy with a wildcard path '*' and full capabilities for all administrators.

Answer

Create a single policy with all paths and capabilities for all users.

VA-003 Practice Questions 2 — 50 Questions

Exhibit

VA-003 Practice Questions 2 — 50 Questions

Exhibit