VA-003 Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A developer reports that a token they created using `vault token create -policy=my-policy -ttl=2h` is no longer working after 1 hour. The token lookup output shows the token details. What is the most likely cause?

Accepted Answer

The token's max_ttl was set to 1h when created, and the token reached its max_ttl.. The token was created with a `-ttl=2h` but the token lookup output shows `max_ttl=1h`. The `max_ttl` is an upper limit enforced by the token's configuration or the system's maximum TTL setting. Even though the requested TTL was 2 hours, the token's effective lifetime is capped by the lower of the two values, so it expired after 1 hour.

Answer

The token has num_uses set to 0, meaning it can only be used once.

Answer

The token is a service token and cannot be renewed.

Answer

The token is an orphan token and requires the parent token to be valid.

Question 2

An administrator runs the commands shown in the exhibit. Later, they run 'vault kv delete kv-v2/secret' and then 'vault kv undelete -versions=1 kv-v2/secret' to recover the secret. Which command must the administrator run to verify that the secret is now readable?

Accepted Answer

vault kv get kv-v2/secret. Option C is correct because 'vault kv get' is the standard command to read and display the latest version of a secret from a KV v2 secrets engine. After running 'vault kv undelete -versions=1', version 1 is restored from a deleted state, and 'vault kv get kv-v2/secret' will retrieve and show that version's data, confirming it is readable.

Answer

vault kv list kv-v2/secret

Answer

vault read kv-v2/data/secret

Answer

vault kv metadata get kv-v2/secret

Question 3

Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?

Accepted Answer

AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.. Option A is correct because AppRole authentication indeed requires a RoleID and SecretID to be presented by the client to obtain a Vault token, whereas Kubernetes authentication requires a service account token (a JWT) that is signed by the Kubernetes API server. This is a fundamental difference in the credential material each method uses to prove identity.

Answer

Kubernetes auth requires the secret_id to be specified in a configuration file.

Answer

Both AppRole and Kubernetes support response wrapping for initial credentials.

Answer

AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.

Question 4

An organization uses the transit engine with key rotation. They want to ensure that data encrypted with an older key version can be decrypted by Vault, but only if the key has not been deleted. Which of the following must be true?

Accepted Answer

The key must not have been archived. In Vault's transit engine, key rotation creates new key versions while preserving older ones. The ability to decrypt data encrypted with an older key version depends on whether that version is still available in the key's version history. Archiving a key removes all versions from the active key ring, making decryption of data encrypted with any version of that key impossible. Therefore, the key must not have been archived to allow decryption of data encrypted with an older key version, provided the key itself has not been deleted.

Answer

The key's `min_decryption_version` must be set to 1

Answer

The key must have the `allow_plaintext_backup` setting enabled

Answer

The key must have a `deletion_allowed` set to false

Answer

The key's `latest_version` must be greater than 0

Question 5

Which TWO best practices should be followed when tuning secrets engine mounts?

Accepted Answer

Configure 'max_lease_ttl' to limit the maximum duration secrets can be valid. Setting a low default lease TTL and enforcing maximum TTL per mount helps control secret lifetimes and reduce risk. Disabling using default policy is not a mount tuning best practice, and audit logging is a system-wide setting.

Answer

Enable audit logging on the mount to track secret access

Answer

Set a high default lease TTL to reduce renewals

Answer

Disable the 'default' policy for the mount to restrict access

Question 6

Which THREE steps are required to configure the database secrets engine for generating dynamic credentials?

Accepted Answer

Create a role that maps to the database user and permissions. Option A is correct because creating a role is the step that maps a named role in Vault to a database user template and its associated permissions (e.g., SQL statements for creation and revocation). This role definition is what Vault uses to dynamically generate a unique username and password when credentials are requested, ensuring each lease gets a dedicated database account with the specified privileges.

Answer

Configure a policy to allow users to read credentials from the role

Answer

Tune the engine's default TTL

Question 7

A Vault instance was upgraded from version 1.9 to 1.13. After the upgrade, a secrets engine mounted at 'transit/' is unresponsive and returns an error. The engine type is transit. What is the most likely cause?

Accepted Answer

The plugin version is incompatible with the new Vault version. Secrets engines may require plugin binary updates. After a major Vault upgrade, the plugin version may become incompatible. Option B is correct because plugin version incompatibility is a common issue.

Answer

The engine was accidentally disabled during the upgrade

Answer

The namespace was changed during the upgrade

Answer

The transit engine can only be mounted at the default path 'transit/'

Question 8

An organization uses a PostgreSQL database. They configure a database secrets engine with a role that grants read-only access. However, after revoking the lease, the database user still exists. What is the most likely cause?

Accepted Answer

The revocation statement is not configured in the database connection. Option D is correct because when a database secrets engine role is configured in Vault, the revocation statement (e.g., `ALTER USER "{{name}}" NOLOGIN;` or `DROP USER IF EXISTS "{{name}}";`) must be explicitly defined in the database connection's `rotation_statements` or `revocation_statements`. If no revocation statement is set, Vault will successfully create and manage the database user but will not execute any SQL to disable or drop that user when the lease is revoked, leaving the user active in PostgreSQL.

Answer

The database secrets engine does not support revocation

Answer

The role's default_ttl is set too high

Answer

The lease duration is too long

Question 9

Which THREE of the following are true regarding Vault's high availability (HA) and replication? (Choose three.)

Accepted Answer

In an HA cluster with Integrated Storage, only the active node can serve write requests. In an HA cluster with Integrated Storage (Raft), only the active node can serve write requests because Raft ensures strong consistency by requiring all writes to go through the elected leader. The leader replicates the write to a quorum of follower nodes before acknowledging the client, preventing split-brain scenarios. This is a fundamental property of the Raft consensus protocol used by Vault Integrated Storage.

Answer

With Integrated Storage, all nodes can handle write requests

Answer

Disaster Recovery Replication replicates everything including policies and audit logs

Question 10

A Vault cluster configured with auto-unseal using AWS KMS is deployed across two availability zones. After a network partition, the standby node remains sealed while the active node is unsealed and serving requests. What is the most likely reason the standby cannot unseal?

Accepted Answer

The standby node cannot communicate with AWS KMS due to the network partition.. In a Vault cluster with auto-unseal via AWS KMS, each node must independently communicate with AWS KMS to unseal itself. A network partition that isolates the standby node from AWS KMS prevents it from reaching the KMS endpoint, so it cannot decrypt its unseal key and remains sealed. The active node is unaffected because it is already unsealed and serving requests from the other side of the partition.

Answer

The standby node is using the wrong AWS region configuration.

Answer

The active node consumed all available KMS API quota for the region.

Answer

The cluster address on the standby is misconfigured.

Question 11

Given the output from 'vault operator raft list-peers', which node(s) will become unavailable if node1 (leader) experiences a network partition away from all other nodes?

Accepted Answer

Only node1 becomes unavailable; the cluster remains operational with a new leader from node2 or node3. Option A is correct because only node1 is unavailable; the remaining nodes (node2, node3, node4, node5) can still communicate and form quorum (3 voters out of 4, but node4 and node5 are non-voters; only voters count for quorum). Node2 and node3 are voters (2), less than majority of 5 voters? Wait initial voters: node1, node2, node3 are voters (3). If node1 is partitioned, node2 and node3 remain (2 voters out of 3, < majority? Actually quorum requires >50% of voters. With 3 voters, quorum is 2. So node2 and node3 can still form quorum (2 is majority of 3) and elect a new leader. So only node1 becomes unavailable. Option B is wrong because node2 and node3 can still agree. Option C is wrong because non-voters don't affect quorum. Option D is wrong.

Answer

All nodes become unavailable because node1 is the leader

Answer

No nodes become unavailable; node1 remains leader but cannot serve writes

Answer

Node1, node4, and node5 become unavailable

Question 12

A Vault administrator wants to minimize the impact of a single node failure in a three-node Raft cluster. Which TWO actions will help? (Choose two.)

Accepted Answer

Configure monitoring to detect and replace failed nodes quickly.. Configuring `retry_join` allows nodes to automatically rejoin the cluster after failure, and monitoring helps detect and replace failed nodes quickly. Load balancer and performance standby do not address node failure directly.

Answer

Set `disable_clustering` to true.

Answer

Use a load balancer to distribute client requests.

Answer

Enable `performance_standby` on all nodes.

Question 13

An administrator needs to securely provide a one-time use token to a remote service using Vault response wrapping. Which CLI flag or command should they use?

Accepted Answer

Use 'vault write -wrap-ttl=5m auth/token/create'. Option C is correct because `vault write -wrap-ttl=5m auth/token/create` creates a one-time use token wrapped in a response-wrapping envelope with a specified TTL. The remote service can then unwrap the token using `vault unwrap` with the wrapping token, ensuring secure delivery without exposing the actual token in transit.

Answer

Use 'vault write -response-wrap auth/token/create'

Answer

Use 'vault unwrap' on the remote service

Answer

Use 'vault wrap auth/token/create'

Question 14

A security team needs to automate the rotation of a database password stored in Vault. The password is currently written as a static secret at 'database/creds/prod'. They want to use the Vault API to read and rewrite the secret, ensuring that the previous version is preserved for audit. The script must handle the case where the secret path may not exist. Which approach should they use?

Accepted Answer

Use POST to write a new version at the secret path, which automatically preserves previous versions. Option C is correct because using the POST method on the KV v2 secret path returns the data and version metadata, allowing the script to preserve history. Option A is wrong because PUT would overwrite without preserving previous version if not used with CAS. Option B is wrong because DELETE would remove the secret. Option D is wrong because the secret engine is KV v2, not v1.

Answer

Use GET on the secret path, then PUT with the new data including the old version's data

Answer

Use DELETE to remove the old secret, then POST to create a new one

Answer

Use PUT to write the new password directly, then use GET to verify

Question 15

Which THREE of the following are true about using the Vault API with response wrapping? (Choose three.)

Accepted Answer

The wrapping token can only be used once to unwrap the response. Option B is correct because the Vault API's response wrapping feature is designed for one-time use: the wrapping token can be used only once to unwrap the response. After the client successfully calls the sys/wrapping/unwrap endpoint with the wrapping token, the token is immediately revoked, and the wrapped secret is deleted from the cubbyhole. This ensures that the secret is delivered securely and cannot be retrieved again with the same token.

Answer

The wrapping token never expires

Answer

The original token used to make the wrapped request is required to unwrap the response

Question 16

A Vault cluster is sealed. An operator attempts to renew a lease but gets an error. What is the most likely error?

Accepted Answer

Vault is sealed. When Vault is sealed, it cannot process any operations, including lease renewal. The error would indicate the sealed state.

Answer

Upstream error

Answer

Permission denied

Answer

Lease not found

Question 17

Refer to the exhibit. An operator wants the credential to be valid for exactly 2 hours. What should they do?

Accepted Answer

Increase the role's max_ttl to 2h.. To allow a 2-hour total lifetime, the role's max_ttl must be at least 2h. The current lease TTL is 30m but can be renewed up to the role's max_ttl. Simply renewing with 2h TTL will fail if max_ttl is lower. Increasing mount's max_lease_ttl does not change the role's maximum. Requesting a new credential does not have a direct TTL parameter.

Answer

Increase the mount's max_lease_ttl to 2h.

Answer

Renew the lease with a TTL of 2h.

Answer

Request a new credential with a TTL of 2h.

Question 18

A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?

Accepted Answer

The renewable flag requires the role to be updated after existing leases are issued.. When a role's configuration is changed, existing leases are not updated. Users who obtained leases before the renewable flag was set to false would still have leases with renewable=true. Option C correctly identifies that the role was likely updated after some leases were issued. Option A is incorrect because the renewable flag is respected. Option B is incorrect; the lease's renewable property is independent of the token's. Option D is false; renewable applies to secret engine leases as well.

Answer

The renewable flag is not respected when max_ttl equals default_ttl.

Answer

The renewable flag is only applicable to token auth methods, not secrets engines.

Answer

The lease's renewable property is controlled by the client token's renewable status.

Question 19

After a Vault migration, some leases are no longer valid and cause errors. What is the best way to force a cleanup of all leases under a specific mount without affecting other mounts?

Accepted Answer

Use vault lease revoke -prefix . Using 'vault lease revoke -prefix ' revokes all leases under that prefix, effectively cleaning them up without disabling the engine.

Answer

Restart Vault servers

Answer

Disable and re-enable the secret engine

Answer

Reduce the mount's max_lease_ttl to 0

Question 20

An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?

Accepted Answer

Vault's tidy operation is not configured to clean up stale leases.. Vault does not automatically revoke the actual database user when a lease expires; it relies on the tidy operation to clean up stale leases and revoke the underlying credentials. If tidy is not run or configured, expired leases can leave behind database users. Option B is correct. Option A: high max_ttl would lengthen lifespan but still eventually expire. Option C: rotation statement affects password changes, not revocation. Option D: network issues could cause revocation failures, but tidy would still help clean up.

Answer

The lease revocation process is failing due to network issues.

Answer

The database rotation statement is incorrect, causing Vault to not properly revoke credentials.

Answer

The role's max_ttl is set too high, allowing leases to live longer.

VA-003 Hard Questions — 25 Difficult Questions

Exhibit

VA-003 Hard Questions — 25 Difficult Questions

Exhibit