VA-003 Practice Test 7 — 10 Questions

Question 1

A DevOps team is using Vault tokens for authentication in CI/CD pipelines. They notice that tokens are often expired before the pipeline completes, causing failures. Which Vault feature should they use to address this without manual intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use periodic tokens with a short period and allow renewal. Periodic tokens are designed for long-running processes like CI/CD pipelines. They have no maximum TTL and can be renewed indefinitely as long as the renewal occurs before the current token's TTL expires. By using a periodic token with a short period and enabling automatic renewal in the pipeline, the token stays valid without manual intervention, solving the expiration issue.

Answer

Use batch tokens for better performance

Answer

Create orphan tokens so they don't expire with the parent

Answer

Increase the default TTL on the token auth method

Question 2

A company uses Vault to issue tokens for short-lived tasks. They have configured a token role with 'period' set to 30 minutes and 'explicit_max_ttl' set to 24 hours. Tokens are created using the role and are expected to be renewed every 30 minutes by the tasks. However, after a few renewals, the Vault audit logs show that a token was renewed but then immediately expired. The task that was using the token failed. What is the most likely reason for this behavior?

Accepted Answer

The token reached its 'explicit_max_ttl' of 24 hours, and renewal is no longer possible.. The token role has an 'explicit_max_ttl' of 24 hours, which sets an absolute hard limit on the token's lifetime regardless of the shorter 'period' of 30 minutes. When the token is renewed, its total lifetime cannot exceed the explicit_max_ttl. Once that limit is reached, Vault rejects any further renewal, causing the token to expire immediately and the task to fail.

Answer

The token was created by a root token and root tokens are not subject to periodic renewal.

Answer

The token was a batch token and batch tokens cannot be renewed at all.

Answer

The token was an orphan token and cannot be renewed more than a few times.

Question 3

Refer to the exhibit. A DevOps engineer runs `vault read -format=json transit/keys/mykey` and receives the output shown. A microservice attempts to decrypt data that was encrypted with version 1 of the key. Will the decryption succeed?

Accepted Answer

Yes, because min_decryption_version is 1, which allows decryption with version 1 and higher.. The `min_decryption_version` parameter in Vault's transit secrets engine specifies the lowest key version that can be used for decryption. In the exhibit, `min_decryption_version` is set to 1, meaning any version from 1 upward is allowed. Since the data was encrypted with version 1, decryption will succeed. This parameter does not block decryption with version 1; it only prevents decryption with versions lower than the specified value.

Answer

Yes, because min_decryption_version does not affect decryption.

Answer

No, because min_decryption_version is 1, so only version 2 and higher can decrypt.

Answer

No, because the data was encrypted with version 1 and min_decryption_version is 1, so decryption is blocked.

Question 4

Match each Vault term to its definition.

Accepted Answer

Secret: A piece of sensitive data stored in Vault. Correct matches: Secret is sensitive data; Token is an authentication credential. Common confusions: Policy vs. Auth Method — policies control access, auth methods authenticate users.

Answer

Policy: A method used to authenticate a user or machine to Vault

Answer

Auth Method: A set of rules defining access permissions in Vault

Question 5

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Accepted Answer

The binddn or bindpass configured in Vault is incorrect. The error 'LDAP bind failed: invalid credentials' specifically indicates that the authentication attempt to the LDAP server using the configured binddn and bindpass failed. Since the LDAP server is reachable, the most direct cause is that the bind credentials stored in Vault's LDAP configuration do not match what the LDAP server expects. This is a configuration mismatch, not a connectivity or TLS issue.

Answer

Vault is not configured to use SSL/TLS for LDAP

Answer

The LDAP server does not allow anonymous binds

Answer

The LDAP server certificate is not trusted by Vault

Question 6

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data

Question 7

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 8

Drag and drop the steps to configure Vault's PKI secrets engine to issue certificates into the correct order.

Accepted Answer

Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate. The correct sequence to configure Vault's PKI secrets engine for issuing certificates is: first enable the PKI secrets engine, then generate a root certificate (self-signed CA), then create a role that defines certificate parameters, and finally issue a certificate using that role. Enabling the engine mounts it at a path, generating the root CA establishes the trust anchor, the role configures certificate properties, and the issuance step produces the actual certificate. Common mistakes include attempting to generate the root or create a role before enabling the engine, or creating the role before generating the root CA, which leads to errors or missing configurations.

Answer

Generate a root certificate, then enable PKI secrets engine, then create a role, then issue a certificate

Answer

Create a role, then enable PKI secrets engine, then generate a root certificate, then issue a certificate

Answer

Enable PKI secrets engine, then create a role, then generate a root certificate, then issue a certificate

Question 9

An operator wants to enable the database secrets engine at a custom path 'db-creds'. Which command should be used?

Accepted Answer

vault secrets enable -path=db-creds database. The `vault secrets enable` command with the `-path` flag allows you to mount the database secrets engine at a custom path. The syntax `vault secrets enable -path=db-creds database` correctly specifies the custom path and the engine type, enabling the database secrets engine at the desired location.

Answer

vault secrets enable database

Answer

vault write sys/mounts/db-creds type=database

Answer

vault secrets tune -path=db-creds database

Question 10

A security engineer needs to choose an authentication method for a set of microservices running in a Kubernetes cluster that require short-lived secrets. The method should leverage the pod's identity. Which method is best?

Accepted Answer

Kubernetes auth. Kubernetes auth is the best choice because it allows a pod to authenticate to Vault using its own service account token, which is automatically mounted and short-lived. This method directly leverages the pod's identity without requiring manual secret distribution, making it ideal for microservices in a Kubernetes cluster that need ephemeral credentials.

Answer

AppRole auth

Answer

Token auth

Answer

LDAP auth