VA-003 Multiple Select — 20 Questions

Question 1

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Accepted Answer

Reducing the default lease TTL. Option A is correct because reducing the default lease TTL shortens the lifetime of newly issued leases, so they expire and are revoked sooner, decreasing the count of active leases at any given time. Option B is correct because revoking a lease explicitly invalidates it, immediately removing it from the set of active leases tracked by Vault. Option C is incorrect because creating a new lease adds another active lease rather than reducing the count. Option D is incorrect because increasing the max lease TTL allows leases to live longer, which tends to keep more leases active. Option E is incorrect because renewing a lease extends its lifetime, keeping it active instead of reducing the number of active leases.

Answer

Creating a new lease

Answer

Increasing the max lease TTL

Answer

Renewing a lease

Question 2

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Accepted Answer

Barrier encryption key. Vault requires a storage backend (C) because all encrypted data — secrets, tokens, and configuration — must be persisted somewhere, and Vault itself never stores plaintext there. The barrier encryption key (B) is the root cryptographic material used by Vault's barrier to encrypt and decrypt everything written to that storage backend, so without it no data-at-rest encryption is possible. A seal mechanism (D) is also required because Vault starts in a sealed state and the seal/unseal process protects the barrier key (typically via Shamir secret sharing or an auto-unseal KMS), controlling access to the encryption key. An audit device (A) only logs requests and responses for compliance and is not needed to encrypt data at rest, and an authentication method (E) only verifies client identity to issue tokens, so neither is required for encryption at rest.

Answer

Audit device

Answer

Authentication method

Question 3

Which TWO of the following are features of the AWS secrets engine compared to the Azure secrets engine?

Accepted Answer

Can generate IAM users with custom policies. Option D is correct because the Vault AWS secrets engine can dynamically create IAM users and attach custom IAM policies to them, giving fine-grained, per-credential permissions that the Azure secrets engine (which issues service principals/roles) does not provide in the same IAM-user form. Option E is correct because the AWS secrets engine can issue STS temporary credentials via AssumeRole, including cross-account access through role ARNs, a capability specific to AWS's STS model and not offered by the Azure secrets engine. Option A is incorrect because SAML federation with Microsoft Entra ID is an Azure/identity-provider feature, not a capability of the AWS secrets engine. Option B is incorrect because native Azure Key Vault integration belongs to the Azure secrets engine, not the AWS one. Option C is incorrect because IAM instance profiles are used by EC2 instances to obtain credentials from the instance metadata service, not a connection method exposed as a feature of the Vault AWS secrets engine.

Answer

Supports federation via SAML with Azure AD

Answer

Provides native integration with Azure Key Vault for key management

Answer

Allows connection to AWS via IAM instance profiles

Question 4

A Vault operator wants to manage lease durations for secrets issued by a PKI secrets engine. Which two actions can they take to affect the lease duration of certificates?

Accepted Answer

Configure the 'ttl' parameter in the PKI role definition.. Option C is correct because the PKI role definition accepts a 'ttl' parameter that sets the default lease duration for certificates issued under that role, overriding the mount's default when specified. Option E is correct because setting 'default_lease_ttl' on the PKI secrets engine mount establishes the baseline lease duration for certificates issued by that mount when the role does not specify its own TTL. Options A and B are incorrect because 'default_lease_ttl' and 'max_lease_ttl' on an auth method govern the lifetime of the auth method's own tokens, not the leases of certificates issued by a PKI secrets engine. Option D is incorrect because 'lease_duration' is not a valid parameter in a PKI role definition; the correct parameter is 'ttl' (along with 'max_ttl').

Answer

Set the 'default_lease_ttl' on the auth method used to log in.

Answer

Set the 'max_lease_ttl' on the auth method used to log in.

Answer

Set the 'lease_duration' parameter in the PKI role definition.

Question 5

A user wants to view information about their current token, including its policies and TTL. Which TWO CLI commands can be used?

Accepted Answer

vault read auth/token/lookup-self. Option A, `vault read auth/token/lookup-self`, is correct because it reads the `auth/token/lookup-self` endpoint, which returns details about the token used to make the request, including its policies, TTL, and other metadata. Option E, `vault token lookup`, is correct because it queries the same token lookup functionality through the CLI and, when run without a token argument, displays information about the current token such as policies and TTL. Option B, `vault token list`, is incorrect because it lists accessor values of tokens rather than showing details of the current token. Option C, `vault write auth/token/lookup`, is incorrect because the lookup endpoint is read-oriented and requires a token parameter; writing to it without a token does not return current-token information. Option D, `vault token info`, is incorrect because it is not a valid Vault CLI command.

Answer

vault token list

Answer

vault write auth/token/lookup

Answer

vault token info

Question 6

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Option E is correct because Vault's transit secrets engine supports key rotation via the `rotate` endpoint (e.g., `vault write -f transit/keys//rotate`), which creates a new key version while retaining older versions for decrypting existing ciphertext. Option C is correct because after rotation, existing ciphertext still references older key versions, so `rewrap` (e.g., `vault write transit/rewrap/ ciphertext=<...>`) re-encrypts the data under the latest key version without exposing the plaintext, satisfying periodic rotation compliance. Option A is wrong because immediately setting `min_decryption_version` to the newest version would make ciphertext encrypted with older versions undecryptable, breaking access to existing data. Option B is wrong because exporting the key defeats the purpose of Vault transit (keys never leave Vault) and manual re-encryption is unnecessary since `rewrap` handles it. Option D is wrong because deleting old key versions would render existing ciphertext undecryptable and is not required for rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 7

Which TWO are benefits of using Vault's encryption as a service?

Accepted Answer

Allows applications to delegate encryption/decryption to Vault without handling keys. Option B is correct because Vault's Encryption as a Service (via the transit secrets engine) lets applications send plaintext to Vault's encrypt/decrypt endpoints and receive ciphertext or plaintext back, so the app never stores or manages the cryptographic keys itself. Option C is correct because the transit engine natively supports automatic key rotation and key versioning, allowing old ciphertext to remain decryptable while new data uses the latest key version. Option A is not a benefit specific to Encryption as a Service, since encrypting data at rest in cloud storage is typically handled by storage-level or disk encryption rather than Vault's transit engine. Option D is wrong because applications must have network connectivity to reach Vault's API for encryption and decryption operations. Option E is wrong because the transit engine supports both symmetric algorithms (such as AES-GCM) and asymmetric algorithms (such as RSA and ECDSA).

Answer

Enables encryption of data at rest in cloud storage

Answer

Eliminates the need for any network connectivity to Vault

Answer

Supports only symmetric key algorithms

Question 8

Which TWO of the following are valid use cases for the Transit secrets engine? (Select exactly 2.)

Accepted Answer

Signing and verifying data. Option A is correct because the Transit secrets engine provides cryptographic operations as a service, including signing and verifying data via endpoints such as /transit/sign/:name and /transit/verify/:name, so applications can perform signature operations without handling raw signing keys. Option B is correct because Transit supports encryption and decryption through endpoints like /transit/encrypt/:name and /transit/decrypt/:name, allowing data to be encrypted in transit while the encryption key never leaves Vault. Option C is not the intended use case because Transit does not serve as a general-purpose key store; key storage is handled by other engines such as KV or by Vault's key management features, and Transit keys are used for cryptographic operations rather than being retrieved. Option D is incorrect because Transit does not store encrypted data at rest; it only performs encryption/decryption operations, while data storage belongs to engines like KV. Option E is incorrect because X.509 certificate management is handled by the PKI secrets engine, not the Transit secrets engine.

Answer

Storing encryption keys

Answer

Storing encrypted data at rest

Answer

Managing X.509 certificates

Question 9

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data

Question 10

Which TWO of the following are components of Vault's architecture? (Choose two.)

Accepted Answer

Barrier. The Barrier (D) is a core Vault architectural component: it is the cryptographic layer that ensures data written to the storage backend is encrypted, and all requests must pass through the barrier before reaching the storage backend. The Seal (E) is also a core Vault component: it is the mechanism that protects the barrier's encryption key, and Vault starts in a sealed state where it cannot decrypt data until it is unsealed with the required unseal keys or auto-unseal mechanism. Consul Template (B) is an external HashiCorp tool that can render templates from Vault data, but it is not part of Vault's internal architecture. Vault Agent (C) is an optional client-side helper for authentication and caching, not a core architectural component of the Vault server. Senlin (A) is an OpenStack clustering service and has no relation to Vault's architecture.

Answer

Senlin

Answer

Consul Template

Answer

Vault Agent

Question 11

Which three statements about lease renewal are correct? (Choose three.)

Accepted Answer

Renewing a lease increments the lease number.. In Vault, each lease renewal increments the lease number (a monotonically increasing counter) to track the renewal history. This allows clients and Vault to detect replay attacks or stale renewals, as the lease ID remains the same but the lease number changes with each successful renew operation.

Answer

A lease can be renewed indefinitely.

Answer

Lease renewal requires 'sudo' capability.

Question 12

Which THREE steps are required to configure the database secrets engine for a MySQL database?

Accepted Answer

Enable the database secrets engine. Option A is correct because the database secrets engine must first be enabled at a mount path (e.g., `vault secrets enable database`) before any database configuration can occur. Option B is correct because a role defines the SQL statements Vault uses to create and revoke credentials, along with the associated connection and credential type, and is required for Vault to dynamically generate database credentials. Option E is correct because Vault needs a configured database connection specifying the MySQL plugin (e.g., `mysql-database-plugin`), connection URL, and credentials so it can communicate with the MySQL instance. Option C is not required because Vault's database secrets engine does not need a root certificate generated for the database; it authenticates using configured credentials. Option D is not required because TTLs can be set on the role itself, and tuning the mount's default TTL is optional rather than a mandatory configuration step.

Answer

Generate a root certificate for the database

Answer

Tune the mount to set default TTL for all roles

Question 13

Which THREE of the following are true about the KV v2 secrets engine? (Select exactly 3.)

Accepted Answer

It supports check-and-set operations for concurrent updates.. Option B is correct because the KV v2 secrets engine supports check-and-set (CAS) operations: when writing a secret you can supply the cas parameter with the expected current version, and the write fails if the version has changed, preventing lost updates during concurrent modifications. Option D is correct because KV v2 stores rich metadata for each secret version, including fields such as created_time, deletion_time, destroyed, and version, retrievable via the metadata endpoint (e.g., GET secret/metadata/<path>). Option E is correct because KV v2's defining feature is versioning: each write creates a new numbered version, allowing retrieval of specific versions and configuration of max_versions. Option A is wrong because KV v2 does support deletion, including soft deletion (delete) and permanent destruction (destroy) of specific versions. Option C is wrong because KV v2 supports undoing changes through versioning: you can read an earlier version and write it back, or use the undelete operation to restore a soft-deleted version.

Answer

It does not support deletion of secrets.

Answer

It does not support undoing changes.

Question 14

Which THREE of the following are true about using the Vault API with response wrapping? (Choose three.)

Accepted Answer

The wrapping token can only be used once to unwrap the response. Option B is correct because a response-wrapping token is single-use: the first call to the sys/wrapping/unwrap endpoint (or a lookup) consumes it, and any subsequent attempt fails. Option C is correct because clients enable wrapping by supplying the X-Vault-Wrap-TTL header on the request, which tells Vault to return a wrapping token instead of the actual response data. Option E is correct because Vault stores the wrapped response in the cubbyhole secret engine, which is scoped to the wrapping token and is where the data lives until it is unwrapped. Option A is wrong because the wrapping token has a TTL set by X-Vault-Wrap-TTL and expires like any other Vault token. Option D is wrong because unwrapping requires only the wrapping token itself, not the original token that created the wrapped response.

Answer

The wrapping token never expires

Answer

The original token used to make the wrapped request is required to unwrap the response

Question 15

Which TWO of the following are true about token accessors?

Accepted Answer

Accessors should be used in audit logs instead of token values. Token accessors are designed to be used in audit logs as a safe alternative to the actual token value. This prevents sensitive token data from being exposed in logs while still allowing correlation of events to a specific token. Option C is correct because an accessor is a unique identifier that references a token without revealing the token's secret value.

Answer

Accessors are the token value

Answer

Accessors can be used to renew the token

Question 16

An organization uses Vault's AWS secrets engine to generate temporary IAM credentials. The Vault administrator has set the default lease TTL on the AWS mount to 15 minutes. A developer creates a role with role TTL of 30 minutes and explicit max TTL of 1 hour. Which TWO statements are true regarding the lease behavior for credentials generated under this role?

Accepted Answer

The initial lease duration will be 30 minutes (the role TTL).. Option A is correct because when a role specifies its own TTL, that role TTL overrides the mount's default lease TTL, so the initial lease duration for credentials generated under this role is 30 minutes. Option B is correct because the role's explicit max TTL of 1 hour caps the total lifetime of the lease, meaning renewals can extend it only up to that 1-hour maximum. Option D is incorrect because the 15-minute default lease TTL applies only when the role does not define its own TTL. Option C is incorrect because an explicit max TTL prevents indefinite renewal and overrides the system max TTL. Option E is incorrect because Vault does not take the minimum of the default lease TTL and role TTL; the role TTL takes precedence for the initial lease duration.

Answer

The lease can be renewed indefinitely up to the system max TTL.

Answer

The initial lease duration will be 15 minutes (the default lease TTL).

Answer

The lease duration is the minimum of default lease and role TTL.

Question 17

Which THREE steps are required to configure the database secrets engine for generating dynamic credentials?

Accepted Answer

Create a role that maps to the database user and permissions. Option E is correct because the database secrets engine must first be enabled (e.g., `vault secrets enable database`) before any connections or roles can be created. Option C is correct because you must configure a database connection (`vault write database/config/`) with the plugin, connection URL, and privileged credentials Vault uses to create dynamic users. Option A is correct because a role (`vault write database/roles/`) defines the SQL statements and mappings that generate the dynamic credentials with the appropriate permissions. Option B is not required for generating credentials, since it only governs authorization to read them, and Option D is optional tuning rather than a required configuration step.

Answer

Configure a policy to allow users to read credentials from the role

Answer

Tune the engine's default TTL

Question 18

Which THREE are benefits of using Vault response wrapping?

Accepted Answer

Reduces the risk of secret exposure in transit. Option A is correct because Vault response wrapping returns a single-use wrapping token instead of the actual secret, so if the response is intercepted in transit the attacker only obtains a wrapping token that can be unwrapped once, reducing the risk of secret exposure. Option C is correct because a wrapping token is single-use: once it is unwrapped, the token is revoked and cannot be used again, which ensures the wrapped secret can be retrieved only once. Option E is correct because wrapping enables delegation of access without sharing the actual token — the wrapper can hand the wrapping token to another party (e.g., an app or trusted operator) who unwraps it to obtain a short-lived token with limited policy, without ever exposing the original token. Option B is not correct because wrapping tokens support only a single unwrap, not unlimited unwraps. Option D is not correct because response wrapping does not extend the TTL of the underlying secret; the wrapping token itself has a short TTL and the wrapped secret retains its own lease/TTL.

Answer

Supports unlimited unwraps

Answer

Increases the TTL of the secret

Question 19

Which THREE of the following are true statements about the AppRole authentication method? (Choose three.)

Accepted Answer

Vault can generate a wrapped Secret ID for secure delivery. Option B is correct because Vault's AppRole auth method supports response wrapping: the Secret ID can be returned as a wrapped response, and the single-use wrapping token is delivered to the target application so the Secret ID is never exposed in plaintext in transit. Option C is correct because a Secret ID can have CIDR bindings (secret_id_bound_cidrs) that restrict the source IP addresses allowed to use that Secret ID during login, adding a network-layer constraint. Option D is correct because the Role ID is a non-secret, stable identifier that the application presents at login, functioning much like a username, while the Secret ID acts as the corresponding secret credential. Option A is not correct because token policies are attached to the AppRole role/token, not embedded in the Secret ID itself; the Secret ID is just a credential value. Option E is not correct because a Secret ID is not inherently single-use — it can be used multiple times unless it is created with the single-use property (e.g., via secret_id_num_uses) or is a wrapped response token, which is single-use.

Answer

The Secret ID contains the token policies

Answer

The Secret ID can only be used once

Question 20

Which THREE are appropriate use cases for Vault's Transit secrets engine?

Accepted Answer

Providing cryptographic offloading for applications running in untrusted environments. Option A is correct because the Transit secrets engine performs encryption/decryption as a service, so applications in untrusted environments can offload cryptographic operations to Vault without ever handling or storing the encryption keys themselves. Option D is correct because Transit supports signing and verification operations, allowing Vault to hold the signing key while the application submits data to be signed or verified. Option E is correct because Transit's encrypt/decrypt endpoints let an application encrypt sensitive database fields while the key material remains inside Vault, so the application never sees the encryption key. Option B is not a Transit use case; generating and managing TLS certificates is handled by the PKI secrets engine. Option C is not a Transit use case; storing and retrieving static secrets such as API keys is the role of the KV (Key/Value) secrets engine.

Answer

Generating and managing TLS certificates for internal services

Answer

Storing and retrieving static secrets like API keys