VA-003 Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Accepted Answer

vault write shared/data/db_password value=s3cret. In Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Answer

vault write shared/db_password value=s3cret

Answer

vault write shared/metadata/db_password value=s3cret

Answer

vault write shared/config/db_password value=s3cret

Question 2

An administrator receives an access denied error when trying to use the token accessor to revoke a token. The administrator's token has the following policy capabilities: path "auth/token/revoke-accessor" { capabilities = ["create", "update"] }. What is the issue?

Accepted Answer

The administrator lacks the 'sudo' capability on that path. The `auth/token/revoke-accessor` endpoint requires the `sudo` capability in addition to `create` or `update`. In Vault, certain sensitive token management operations, such as revoking a token by its accessor, are protected by the `sudo` privilege to prevent unauthorized revocation. Without `sudo`, the administrator receives an access denied error even though they have `create` and `update` capabilities on the path.

Answer

The administrator's token does not have any capabilities on the path

Answer

The path requires 'create' and 'update' but not 'sudo'

Answer

The accessor path is incorrect; it should be auth/token/accessors/revoke

Question 3

A company is migrating from a file storage backend to Consul. Which Vault command should be used to move the data?

Accepted Answer

vault operator migrate. The `vault operator migrate` command is specifically designed to move Vault data from one storage backend to another, such as from a file storage backend to Consul. It handles the safe transfer of all encrypted data, including secrets, policies, and tokens, while ensuring consistency and minimal downtime during the migration process.

Answer

vault operator rekey

Answer

vault operator unseal

Answer

vault operator init

Question 4

A token with the above policy attempts to look up its own token by calling the accessor endpoint. What will happen?

Accepted Answer

The operation fails with a permission denied error. Vault's token accessor endpoint requires the 'read' capability on the token's accessor path (auth/token/accessor or the token's own accessor path). A token cannot use its own accessor to read itself unless it explicitly has that capability; by default, tokens lack the capability to read their own accessor, so the request is denied. The policy shown does not grant accessor read rights, resulting in a permission denied error.

Answer

The operation succeeds because the token can read its own token

Answer

The operation succeeds because sudo allows all accessor operations

Answer

The operation fails because the token lacks any capabilities

Question 5

Refer to the exhibit. A user attempts to renew the token after 20 hours. What will happen?

Accepted Answer

The token will be renewed for another 4h, after which it will expire.. The token was created with a TTL of 12h and an explicit max TTL of 24h. After 20 hours, only 4 hours remain before the max lifetime is reached, so Vault renews the token for the remaining 4h and then it expires. Vault caps any renewal at the explicit max TTL, so the token cannot be extended beyond 24h total.

Answer

The renewal will fail because the token has exceeded its explicit max TTL.

Answer

The token will be renewed for another 12h and can be renewed indefinitely.

Answer

The token will be renewed for 12h, but the total lifetime cannot exceed 24h.

Question 6

A company with strict security requirements uses Vault's Transit secrets engine to encrypt data in a microservices architecture. They have multiple applications that each require a unique encryption key. The security team wants to enforce key rotation every 30 days for all keys, and also require that keys be destroyed after they are no longer used. The application team is concerned that key rotation might cause downtime because applications need to re-encrypt data. The Vault architect needs to design a key management solution. What is the best approach?

Accepted Answer

Use the Transit engine's key rotation capability with versioning and configure applications to use the latest key version for encryption, while keeping old versions for decryption.. Vault's Transit secrets engine supports key rotation with versioning, where each rotation creates a new key version while retaining older versions for decryption. This allows applications to always encrypt using the latest version (via the `encrypt` endpoint) and decrypt using any previous version (via the `decrypt` endpoint), ensuring zero downtime during rotation. The security team's requirement for key destruction after disuse can be met by trimming or deleting old key versions once all data encrypted with them is re-encrypted.

Answer

Manually rotate keys every 30 days and update applications with new key IDs.

Answer

Set the key TTL to 30 days and configure Vault to automatically re-encrypt data when keys are rotated.

Answer

Use a single key for all applications and rotate it by creating a new key and deleting the old one.

Question 7

A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?

Accepted Answer

AWS IAM auth. AWS IAM auth is the most appropriate and secure method because it allows Jenkins jobs running on EC2 instances to authenticate to Vault using the instance's AWS IAM role without storing any long-lived credentials. The EC2 instance obtains temporary AWS credentials via the instance metadata service (IMDS), and Vault validates these against AWS STS to issue a short-lived Vault token. This eliminates the need to manage static secrets or tokens in Jenkins job configurations.

Answer

GitHub personal access token

Answer

AppRole

Answer

Username & password (userpass)

Question 8

A developer wants to ensure that their application automatically renews its secret leases before expiration. Which approach is recommended?

Accepted Answer

Use Vault agent with a template and renew capability.. Vault Agent's template and renew capability is the recommended approach because it automatically manages the lifecycle of dynamic secrets, including renewing leases before they expire. Vault Agent runs as a sidecar or daemon and uses its built-in renewer to periodically extend the lease TTL, ensuring the application always has a valid secret without manual intervention or external scheduling.

Answer

Set the lease TTL to infinite.

Answer

Use a cron job to call vault lease renew periodically.

Answer

Use periodic tokens with auto-renewal.

Question 9

A Vault cluster uses DR replication. The primary cluster fails, and the DR secondary is promoted to primary. After promotion, some secret data written to the primary shortly before the failure is missing on the new primary. What is the most likely reason?

Accepted Answer

The data had not yet been replicated to the DR secondary before the primary failed.. In Vault DR replication, data is asynchronously replicated from the primary to the secondary cluster. If the primary fails before the replication stream has transmitted the most recent writes, those writes are lost. When the DR secondary is promoted to primary, it only contains data that was successfully replicated up to the point of failure. This is the most likely reason the secret data is missing.

Answer

The seal wrapping key was rotated on the primary after the last replication.

Answer

The secret engine was not enabled on the DR secondary.

Answer

The DR secondary was promoted with the 'force' option, which skips replication of the last writes.

Question 10

A company deploys Vault in a production environment with three nodes using Integrated Storage (Raft). They have configured Performance Replication to a secondary datacenter. The primary datacenter experiences a complete outage. After restoring the primary, they promote the secondary to primary. However, they notice that some secrets written to the primary just before the outage are missing in the secondary. The replication status shows no errors. What is the most likely cause and correct action?

Accepted Answer

Accept the data loss and continue with the secondary as primary. Performance Replication in Vault is asynchronous, meaning there is no guarantee that all writes to the primary are replicated to the secondary before a failure. When the primary experiences a complete outage, any secrets written just before the outage that had not yet been acknowledged by the secondary are permanently lost. Since the replication status shows no errors, the system is consistent up to the last replicated point, and the only correct action is to accept the data loss and continue with the promoted secondary as the new primary.

Answer

Restore the primary from backup to recover missing secrets

Answer

Failback to the original primary after restoring it

Answer

Re-promote the original primary and use it as the new primary