VA-003 Practice Test 6 — 10 Questions

Question 1

Which authentication method in Vault uses a shared secret (Role ID) and a dynamic secret (Secret ID) to authenticate machines or applications?

Accepted Answer

AppRole. AppRole is the correct authentication method because it is specifically designed for machine-to-machine or application-to-application authentication in Vault. It uses a static Role ID (like a username) combined with a dynamically generated Secret ID (like a password) that can be created, revoked, or have a time-to-live, providing a secure and flexible way for non-human entities to obtain a Vault token.

Answer

LDAP

Answer

Username & password (userpass)

Answer

Okta

Question 2

A large enterprise runs Vault in a high-availability cluster with integrated storage (Raft). They notice that read requests are not being evenly distributed across nodes, causing some nodes to have high load. They want to offload read operations to standby nodes. What feature should they enable to achieve this?

Accepted Answer

Enable performance standby nodes. Performance standby nodes are a Vault Enterprise feature designed to handle read requests without participating in the Raft consensus write quorum. By enabling this, read operations are offloaded to standby nodes, distributing the load evenly and reducing the burden on the active cluster nodes. This directly addresses the uneven read distribution and high load on specific nodes.

Answer

Configure a load balancer with a round-robin algorithm

Answer

Enable read replicas on standby nodes

Answer

Increase the number of Raft nodes to distribute reads

Question 3

A DevOps team needs to provide temporary database credentials to applications without storing long-lived passwords. Which secrets engine should they use?

Accepted Answer

Database secrets engine. The Database secrets engine is designed to generate dynamic, short-lived database credentials on demand, allowing applications to access databases without storing long-lived passwords. It creates unique credentials for each request and automatically revokes them after a configurable TTL, meeting the requirement for temporary access without persistent secrets.

Answer

KV v2 secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 4

A security engineer is enabling the Transit secrets engine at the path 'transit/'. They need to encrypt data without ever exposing the plaintext key material to the application, and they want the ciphertext to be safely stored in an external database. They also require the ability to rotate the encryption key periodically without re-encrypting existing data. Which command correctly configures a new encryption key named 'orders' for this purpose?

Accepted Answer

vault write -f transit/keys/orders. The Transit secrets engine centralizes encryption as a service, allowing applications to encrypt data without managing keys. To create a new named encryption key, the correct command is 'vault write -f transit/keys/orders', which generates a key of the default type (aes256-gcm96) and enables encryption, decryption, and rotation. This satisfies the requirement of not exposing key material and supporting future rotation.

Answer

vault write transit/encrypt/orders plaintext=$(base64 <<< "my secret")

Answer

vault write transit/keys/orders type=rsa-2048

Answer

vault secrets enable -path=orders transit

Question 5

A startup wants to use Vault to manage MySQL database credentials for their development environment. They have a single MySQL database and require that each application gets unique, short-lived credentials that are automatically rotated. The operations team enabled the database secrets engine, configured the MySQL connection, and created a role with a TTL of 1 hour. However, when an application requests credentials using the role, Vault returns an error: 'No more available leases on this role'. The team checks the role's configuration and sees that the 'max_ttl' is set to 1 hour and 'default_ttl' is also 1 hour. What is the most likely cause of this error?

Accepted Answer

The role has a 'max_leases' parameter set to a low value (e.g., 5) that has been exceeded. Increase the 'max_leases' on the role.. The error 'No more available leases on this role' indicates that the role has a finite number of leases it can issue, controlled by the 'max_leases' parameter. When this limit is reached, Vault refuses to issue new credentials until existing leases expire or are revoked. The role's TTL and max_ttl being both 1 hour does not cause this error; rather, the exhaustion of the lease count does.

Answer

The database secrets engine is not enabled at the expected path; the role is pointing to a different engine.

Answer

The application is not using a valid token to authenticate to Vault, so the request is rejected.

Answer

The TTL values are too short; applications are requesting new credentials too frequently and exhausting a hidden limit. Increase the TTL.

Question 6

An organization wants to use Vault to generate AWS IAM users with specific managed policies attached. They have configured the AWS secrets engine with the appropriate IAM credentials. What step is required to ensure each generated user gets the correct policies?

Accepted Answer

Configure a role in the AWS secrets engine that specifies the managed policies. The AWS secrets engine in Vault uses roles to define the exact permissions and policies for generated IAM users. By configuring a role that specifies the managed policies, Vault ensures that each dynamically generated IAM user is created with those policies attached, meeting the organization's requirement.

Answer

Enable the AWS secrets engine at a custom path

Answer

Set a high TTL on the AWS secrets engine mount

Answer

Use the transit secrets engine to encrypt the AWS credentials

Question 7

A DevOps team wants to authenticate a CI/CD pipeline running on a Jenkins server outside Kubernetes. The pipeline needs to obtain short-lived tokens to read secrets. Which authentication method should be used?

Accepted Answer

AppRole auth. AppRole auth is designed for machine-to-machine authentication, allowing Jenkins (outside Kubernetes) to obtain short-lived tokens by providing a RoleID and SecretID. This method supports automated workflows without human intervention, making it ideal for CI/CD pipelines that need to read secrets from Vault.

Answer

LDAP auth

Answer

Kubernetes auth

Answer

GitHub auth

Question 8

Which TWO are benefits of using Vault's encryption as a service?

Accepted Answer

Allows applications to delegate encryption/decryption to Vault without handling keys. Option B is correct because Vault's Encryption as a Service (via the transit secrets engine) lets applications send plaintext to Vault's encrypt/decrypt endpoints and receive ciphertext or plaintext back, so the app never stores or manages the cryptographic keys itself. Option C is correct because the transit engine natively supports automatic key rotation and key versioning, allowing old ciphertext to remain decryptable while new data uses the latest key version. Option A is not a benefit specific to Encryption as a Service, since encrypting data at rest in cloud storage is typically handled by storage-level or disk encryption rather than Vault's transit engine. Option D is wrong because applications must have network connectivity to reach Vault's API for encryption and decryption operations. Option E is wrong because the transit engine supports both symmetric algorithms (such as AES-GCM) and asymmetric algorithms (such as RSA and ECDSA).

Answer

Enables encryption of data at rest in cloud storage

Answer

Eliminates the need for any network connectivity to Vault

Answer

Supports only symmetric key algorithms

Question 9

Refer to the exhibit. A user with this policy attempts to read 'secret/data/team/admin'. What will happen?

Accepted Answer

Read fails because deny overrides the broader path.. Vault's policy evaluation uses a deny-by-default model where explicit deny rules override any allow rules. The policy first allows read on 'secret/data/team/*' but then explicitly denies read on 'secret/data/team/admin'. Since the deny rule is more specific and matches the exact path, it takes precedence, causing the read operation to fail.

Answer

Read succeeds because the first path allows read.

Answer

Read fails because the path does not exist.

Answer

Read succeeds if the user also has sudo capability.

Question 10

Which TWO of the following are valid use cases for the Transit secrets engine? (Select exactly 2.)

Accepted Answer

Signing and verifying data. Option A is correct because the Transit secrets engine provides cryptographic operations as a service, including signing and verifying data via endpoints such as /transit/sign/:name and /transit/verify/:name, so applications can perform signature operations without handling raw signing keys. Option B is correct because Transit supports encryption and decryption through endpoints like /transit/encrypt/:name and /transit/decrypt/:name, allowing data to be encrypted in transit while the encryption key never leaves Vault. Option C is not the intended use case because Transit does not serve as a general-purpose key store; key storage is handled by other engines such as KV or by Vault's key management features, and Transit keys are used for cryptographic operations rather than being retrieved. Option D is incorrect because Transit does not store encrypted data at rest; it only performs encryption/decryption operations, while data storage belongs to engines like KV. Option E is incorrect because X.509 certificate management is handled by the PKI secrets engine, not the Transit secrets engine.

Answer

Storing encryption keys

Answer

Storing encrypted data at rest

Answer

Managing X.509 certificates