VA-003 Practice Test 8 — 10 Questions

Question 1

Refer to the exhibit. An application needs to encrypt data using the transit engine with key "app-key". It currently has this policy. Which statement is true?

Accepted Answer

The policy allows both encryption and decryption, which is correct for the transit engine.. Option C is correct. In Vault Transit, encryption and decryption operations require 'create' or 'update' capabilities on the respective endpoints. The policy provides both, allowing the application to encrypt and decrypt as needed.

Answer

The policy allows both encryption and decryption, but the capabilities should be "read" and "write" instead.

Answer

The policy allows encryption but not decryption, which is sufficient.

Answer

The policy incorrectly uses "create" and "update" for transit operations; it should use "read" and "write".

Question 2

A Vault administrator needs to create a policy that grants users read access only to the secrets that belong to their own team. The team membership is stored in an external identity provider and mapped to Vault entity aliases. The administrator wants to use a templated policy that references the entity's metadata. Which policy syntax accomplishes this goal?

Accepted Answer

path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }. Option C is correct because Vault's policy templating uses the format {{identity.entity.metadata.<key>}} to reference entity metadata. Option A misses the 'identity.' prefix. Option B uses 'entity' without 'identity'. Option D uses an invalid template syntax.

Answer

path "secret/data/{{entity.metadata.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{identity.entity.aliases.team}}/*" { capabilities = ["read", "list"] }

Question 3

Refer to the exhibit. A user with this policy tries to write a new secret to "secret/data/production/db". What will happen?

Accepted Answer

The write fails because the policy only allows read on production.. Option B is correct. The policy for production only allows read, so write operations (create/update) are denied. The path does match the production glob, but capabilities do not permit write.

Answer

The write succeeds if the secret already exists.

Answer

The write succeeds because the path matches.

Answer

The write fails because the user does not have list capability.

Question 4

A developer has a policy that grants 'create' capability on path 'secret/data/team/*'. They successfully create a new secret using 'vault kv put secret/data/team/db', but when they try to update the same secret with new data, they get a permission denied error. What is the most likely cause?

Accepted Answer

The policy does not include the 'update' capability, which is required for modifying existing secrets.. Option B is correct because in KV v2, creating a new secret requires the 'create' capability, while updating an existing secret requires the 'update' capability. The policy only grants 'create', so updates fail. Option A is incorrect because the developer already created a secret. Option C is incorrect; 'list' is not needed for updates. Option D is incorrect; 'sudo' is not required.

Answer

The developer does not have the 'create' capability on the parent path.

Answer

The policy needs the 'list' capability on the path.

Answer

The developer's token lacks the 'sudo' capability for updates.

Question 5

A company uses Vault's KV v2 secrets engine. A policy is needed to allow a service to only update existing secrets at path "secret/data/service/config", but not create new ones. Which capabilities should be included?

Accepted Answer

["update"]. Option C is correct. The 'update' capability alone allows modifying existing secrets without creating new ones. 'create' would allow new secrets, and 'read' would add unnecessary read access. 'write' is not a valid capability.

Answer

["read", "update"]

Answer

["write"]

Answer

["create", "update"]

Question 6

An organization is creating Vault policies to manage access to secrets across multiple application teams. According to HashiCorp best practices, which two approaches should be taken when designing policies? (Choose two.)

Accepted Answer

Use path templating to incorporate entity metadata.. Options B and D are correct. Path templating with entity metadata reduces policy duplication, and naming policies by application or team improves manageability. Option A is monolithic and insecure. Option C violates least privilege. Option E is not a recommended practice; deny can be useful for exceptions.

Answer

Avoid using negative capabilities (deny) when possible.

Answer

Grant maximum permissions initially and then restrict as needed.

Answer

Use a single all-encompassing policy for each environment.

Question 7

A DevOps team has configured a Vault policy to allow reading secrets from the 'secret/data/engineering' path. The policy contains:

path "secret/data/engineering/*" {
  capabilities = ["read", "list"]
}

However, when a user attempts to read a secret at 'secret/data/engineering/db/password', they receive a permission denied error. What is the most likely cause?

Accepted Answer

The policy uses a single asterisk, which does not match nested paths; it should use double asterisk or specify the exact path.. Option A is correct because Vault's path glob treats a single asterisk (*) as matching any sequence of characters except '/'. Therefore, it does not match nested paths. To match nested paths, use double asterisk (**). Option B is incorrect because 'deny' is not a valid capability. Option C is possible but less likely given the policy pattern. Option D is incorrect; the mount path is correct for KV v2.

Answer

The policy lacks the 'deny' capability to override the default deny.

Answer

The secret engine's mount path is different; it is mounted at 'secret/' but the policy expects 'secret/data/'.

Answer

The user's token does not have the correct identity policies attached.

Question 8

An organization uses Vault with AWS IAM auth. After rotating the AWS IAM role credentials, users are unable to authenticate with Vault. The Vault audit logs show 'permission denied' for the AWS auth method. What is the most likely cause?

Accepted Answer

The IAM role trust policy was not updated after credential rotation. When AWS IAM role credentials are rotated, the trust policy attached to the IAM role must be updated to reflect the new credentials (access key and secret key) that Vault uses to call the AWS STS API. If the trust policy still references the old credentials, Vault's AWS auth method cannot validate the login request, resulting in a 'permission denied' error in the audit logs. This is the most likely cause because the rotation directly breaks the trust relationship between Vault and AWS.

Answer

The Vault token TTL expired

Answer

The client token used for AWS auth is revoked

Answer

The AWS secret engine is disabled

Question 9

A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?

Accepted Answer

The role's max_ttl is set to 1h.. Option D is correct because the role's max_ttl overrides the lease duration when it is shorter than the requested TTL. Even if the lease is renewed, the effective TTL cannot exceed the role's max_ttl, which is set to 1 hour. This is a common Vault behavior where the role's maximum TTL acts as a hard cap on lease lifetimes.

Answer

The lease is not renewable.

Answer

The mount's max_lease_ttl is set to 1h.

Answer

The developer does not have permission to renew the lease.

Question 10

A company is using the PKI secrets engine to issue certificates for internal services. They want to ensure that certificates are automatically revoked if a service is decommissioned. What should they implement?

Accepted Answer

Use Vault's built-in lifecycle management and revocation capabilities.. Option B is correct because Vault's PKI secrets engine includes built-in lifecycle management that can automatically revoke certificates when a lease expires or when a secret is deleted via the API. This allows you to tie certificate validity to the service's lifecycle in Vault, ensuring decommissioned services have their certificates revoked without manual intervention.

Answer

Implement certificate pinning in all services.

Answer

Set a very short TTL on certificates so they expire quickly.

Answer

Configure a Certificate Revocation List (CRL) that clients check.

VA-003 Practice Test 8 — 10 Questions

Exhibit

VA-003 Practice Test 8 — 10 Questions

Exhibit