VA-003 Matching — 10 Questions

Question 1

Match each Vault response wrapping feature to its description.

Accepted Answer

Response Wrapping Token: A single-use token that encapsulates a response, used to securely transfer secrets.. In Vault, response wrapping uses a single-use token with a cubbyhole to store secrets, and the TTL determines its validity. Common confusions include thinking the token can be reused or that cubbyhole is a replicated storage engine.

Answer

Response Wrapping Token: A token that never expires and can be used multiple times.

Answer

Cubbyhole: A secret storage engine that replicates to all nodes in a cluster.

Answer

TTL: The number of times a wrapped response can be unwrapped before it expires.

Question 2

Match each Vault term to its definition.

Accepted Answer

Secret: A piece of sensitive data stored in Vault. Correct matches: Secret is sensitive data; Token is an authentication credential. Common confusions: Policy vs. Auth Method — policies control access, auth methods authenticate users.

Answer

Policy: A method used to authenticate a user or machine to Vault

Answer

Auth Method: A set of rules defining access permissions in Vault

Question 3

Match each Vault secret engine to its primary purpose.

Accepted Answer

KV: Stores arbitrary secrets as key-value pairs.. Correct matches: KV -> static secrets, AWS -> dynamic AWS credentials, PKI -> certificates. Common confusions involve swapping purposes between engines.

Answer

KV: Generates dynamic database credentials.

Answer

AWS: Issues X.509 certificates.

Answer

Transit: Manages SSH keys.

Question 4

Match each Vault audit device to its output destination.

Accepted Answer

File: Writes audit logs to a local file. The correct matches are: File writes to a local file, Syslog sends to syslog, Socket sends to a TCP/UDP endpoint. Common confusions mix the output destinations.

Answer

File: Sends audit logs to syslog

Answer

Syslog: Writes audit logs to a file

Answer

Socket: Writes audit logs to a file

Question 5

Match each Vault policy capability to its permission.

Accepted Answer

create: Allows creating data at the path.. The correct matches are: create allows creating data, read allows reading data, update allows updating data, and delete allows deleting data. Common confusions involve swapping create and read capabilities.

Answer

create: Allows reading data at the path.

Answer

read: Allows creating data at the path.

Question 6

Match each Vault storage backend to its description.

Accepted Answer

Consul: Stores data in a highly available key-value store, commonly used for Vault's backend.. Vault supports multiple storage backends. Consul and Integrated Raft are both highly available, while File is for single-node setups. Common confusions include mixing Consul's distributed KV nature with file-based storage or incorrectly attributing external dependencies to Raft.

Answer

Consul: Stores data in encrypted files on disk with manual replication.

Answer

Integrated Raft: Stores data in an external key-value store like etcd.

Question 7

Match each Vault command to its function.

Accepted Answer

vault kv put: Stores a secret at a specified path in the KV secret engine.. The correct matches are: A (vault kv put) stores secrets in KV, D (vault kv delete) deletes secrets, and F (vault read) reads data from any path. Options B and C are incorrect because their descriptions are swapped: vault kv get retrieves a secret (not lists), and vault kv list lists keys (not retrieves). Option E is incorrect because vault write is a generic command that writes to any path, not specifically to the KV secret engine; the KV-specific command for storing secrets is vault kv put.

Answer

vault kv get: Lists all secrets at a given path.

Answer

vault kv list: Retrieves a secret from a specified path.

Answer

vault write: Stores a secret at a specified path in the KV secret engine.

Question 8

Match each Vault replication type to its behavior.

Accepted Answer

Performance Replication: Replicates mounts and policies but not secrets; used to scale read operations across clusters.. Performance Replication replicates mounts/policies (not secrets) for read scaling; DR Replication replicates everything for failover. Common confusions include swapping the two or inventing non-existent types like Snapshot or Local Replication.

Answer

Performance Replication: Replicates everything including secrets and tokens; used for failover.

Answer

Snapshot Replication: Replicates the entire state of Vault at a point in time for backup.

Answer

Disaster Recovery Replication: Replicates mounts and policies but not secrets; used to scale read operations.

Answer

Local Replication: Replicates data within a single cluster to ensure durability.

Question 9

Match each Vault auth method to its authentication mechanism.

Accepted Answer

Token: A single-use token generated at login. Token auth uses a single-use token; Userpass uses username/password; AppRole uses RoleID/SecretID. Common confusions involve swapping these definitions.

Answer

Token: Username and password authentication

Answer

Userpass: Role ID and Secret ID

Answer

AppRole: A single-use token generated at login

Question 10

Match each Vault seal type to its description.

Accepted Answer

Shamir seal: Uses Shamir's secret sharing to split the master key into key shares distributed to operators. The correct matches are: Shamir seal uses secret sharing; AWS KMS seal uses AWS KMS; HSM seal uses a hardware module. Common confusions involve swapping cloud-based seals with Shamir or HSM.

Answer

Shamir seal: Uses AWS KMS to encrypt/decrypt the master key

Answer

AWS KMS seal: Uses Shamir's secret sharing to split the master key into shares