VA-003 Practice Test 6 — 10 Questions

Question 1

A DevOps team uses Vault's transit engine to encrypt secrets in CI/CD pipelines. They report that encryption operations are failing with 'permission denied' errors. The team has a policy granting 'create' and 'update' capabilities on the transit key path. What is the most likely missing capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'encrypt' capability is missing.. The Vault transit engine uses distinct capabilities for key management versus data operations. 'Create' and 'update' allow managing the key itself (e.g., creating or rotating the key), but encryption of data requires the 'encrypt' capability on the transit key path. Without 'encrypt', the API call to encrypt data fails with a 'permission denied' error, even if the key exists and is properly configured.

Answer

The 'read' capability is missing.

Answer

The 'delete' capability is missing.

Answer

The 'list' capability is missing.

Question 2

A security team must automate periodic credential rotation for a database. The rotation script should run on a server that cannot have the Vault binary installed but can make HTTP requests. Which approach should they use?

Accepted Answer

Use the Vault API with proper authentication.. The server can make HTTP requests, allowing it to interact with Vault's RESTful API directly without installing the Vault binary. The Vault API supports token-based authentication (e.g., using X-Vault-Token header) and can be used to programmatically rotate database credentials by calling the appropriate endpoint (e.g., POST /v1/database/rotate-root/:name). This approach satisfies the constraint of no binary installation while enabling secure, automated credential rotation.

Answer

Use the Vault CLI with curl to wrap commands.

Answer

Install Vault binary on the server and use CLI.

Answer

Use Vault Agent to handle rotation.

Question 3

A company deploys Vault in a production environment with three nodes using Integrated Storage (Raft). They have configured Performance Replication to a secondary datacenter. The primary datacenter experiences a complete outage. After restoring the primary, they promote the secondary to primary. However, they notice that some secrets written to the primary just before the outage are missing in the secondary. The replication status shows no errors. What is the most likely cause and correct action?

Accepted Answer

Accept the data loss and continue with the secondary as primary. Performance Replication in Vault is asynchronous, meaning there is no guarantee that all writes to the primary are replicated to the secondary before a failure. When the primary experiences a complete outage, any secrets written just before the outage that had not yet been acknowledged by the secondary are permanently lost. Since the replication status shows no errors, the system is consistent up to the last replicated point, and the only correct action is to accept the data loss and continue with the promoted secondary as the new primary.

Answer

Restore the primary from backup to recover missing secrets

Answer

Failback to the original primary after restoring it

Answer

Re-promote the original primary and use it as the new primary

Question 4

A company uses both userpass and AppRole authentication methods. They notice that tokens issued via AppRole are not properly revoked when the corresponding secret_id is deleted. Which concept explains this behavior?

Accepted Answer

Tokens are independent of secret_id after login; deleting secret_id does not revoke the token.. When a token is issued via AppRole, the token is created after a successful login using a secret_id. The token itself is independent of the secret_id; deleting the secret_id does not affect the token's lifecycle. Token revocation must be performed explicitly on the token, not by removing the secret_id.

Answer

The secret_id TTL was not set, causing the token to outlive the secret_id.

Answer

AppRole does not support entity aliases, so revoking the secret_id does not affect the token.

Answer

The token was created with a periodic token and cannot be revoked.

Question 5

Which THREE are valid operations in the Vault transit secrets engine? (Choose three.)

Accepted Answer

rewrap. The Vault transit secrets engine provides encryption as a service, and its core operations are encrypt, decrypt, rewrap, and datakey generation. Rewrap is valid because it decrypts ciphertext and re-encrypts it with the latest key version without exposing the plaintext to the caller, maintaining security during key rotation.

Answer

issue

Answer

revoke

Question 6

A Vault cluster configured with auto-unseal using AWS KMS is deployed across two availability zones. After a network partition, the standby node remains sealed while the active node is unsealed and serving requests. What is the most likely reason the standby cannot unseal?

Accepted Answer

The standby node cannot communicate with AWS KMS due to the network partition.. In a Vault cluster with auto-unseal via AWS KMS, each node must independently communicate with AWS KMS to unseal itself. A network partition that isolates the standby node from AWS KMS prevents it from reaching the KMS endpoint, so it cannot decrypt its unseal key and remains sealed. The active node is unaffected because it is already unsealed and serving requests from the other side of the partition.

Answer

The standby node is using the wrong AWS region configuration.

Answer

The active node consumed all available KMS API quota for the region.

Answer

The cluster address on the standby is misconfigured.

Question 7

A Vault administrator wants to allow users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it enables Vault to authenticate users against an external corporate Active Directory (AD) server. Vault's LDAP auth method binds to the AD directory using a service account, then validates user credentials via a simple bind operation, allowing seamless integration with existing corporate identity infrastructure.

Answer

Okta

Answer

AppRole

Answer

Userpass

Question 8

A user wants to log in using the userpass auth method with username 'jdoe' and password 'p@ssw0rd'. What is the correct API endpoint and request?

Accepted Answer

POST /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}. The userpass auth method in Vault requires a POST request to the login endpoint with the password provided in the JSON body. Option D correctly uses POST /v1/auth/userpass/login/jdoe with {"password":"p@ssw0rd"}, which matches the Vault API specification for authenticating against a userpass backend.

Answer

GET /v1/auth/userpass/login/jdoe with header "password: p@ssw0rd"

Answer

PUT /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}

Answer

POST /v1/auth/userpass/login/jdoe?password=p@ssw0rd

Question 9

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Accepted Answer

Reducing the default lease TTL. Reducing the default lease TTL (time-to-live) shortens the maximum duration for which a lease can be issued without renewal. When existing leases expire sooner, the system automatically removes them from the active lease count, thereby reducing the number of active leases. This directly affects the lease lifecycle by forcing earlier expiration.

Answer

Creating a new lease

Answer

Increasing the max lease TTL

Answer

Renewing a lease

Question 10

Refer to the exhibit. What does min_decryption_version = 1 indicate?

Accepted Answer

Version 1 is the minimum version that can be used for decryption.. In Vault Enterprise, the `min_decryption_version` parameter on a transit key specifies the lowest key version that is allowed to decrypt existing ciphertext. Setting `min_decryption_version = 1` means that any key version from 1 up to the current version can be used for decryption; version 1 is the minimum allowed. This ensures backward compatibility while allowing newer versions to be used for encryption.

Answer

Data encrypted with version 1 can only be decrypted with version 1.

Answer

Only data encrypted with version 1 or higher can be decrypted.

Answer

All ciphertext must be rewrapped to version 1.

Answer

Version 1 keys are not allowed for decryption.