VA-003 Multiple Select — 40 Questions

Question 1

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Accepted Answer

Barrier encryption key. The barrier encryption key is the master key used to encrypt and decrypt the Vault data encryption key (DEK), which in turn encrypts all data written to the storage backend. Without this key, Vault cannot protect data at rest because the DEK would be stored in plaintext. It is a fundamental component of Vault's security architecture, ensuring that even if the storage backend is compromised, the data remains encrypted.

Answer

Audit device

Answer

Authentication method

Question 2

An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?

Accepted Answer

POST /v1/auth/token/renew. The `POST /v1/auth/token/renew` endpoint is the standard Vault API call to extend the Time-To-Live (TTL) of an existing token, which is a core token lifecycle operation. This endpoint accepts the token to renew in the request body and returns a new lease duration, adhering to Vault's token management design.

Answer

PUT /v1/auth/token/roles

Answer

DELETE /v1/auth/token/revoke

Question 3

Which TWO of the following are valid uses of a token accessor? (Select exactly 2 options.)

Accepted Answer

Lookup token properties. A token accessor is a non-sensitive reference to a Vault token that allows certain operations without exposing the token ID itself. The `lookup` and `revoke` operations are valid uses of a token accessor because they can be performed using the accessor via the Vault API or CLI (e.g., `vault token lookup -accessor ` and `vault token revoke -accessor `). These operations do not require the actual token value, preserving security while enabling token management.

Answer

Wrap the token

Answer

Create a child token

Answer

Renew the token

Question 4

Which TWO of the following are features of the AWS secrets engine compared to the Azure secrets engine?

Accepted Answer

Can generate IAM users with custom policies. The AWS secrets engine can dynamically generate IAM users with custom policies attached, allowing fine-grained access control for applications. Option E is correct because the engine can generate STS temporary credentials for cross-account access, enabling secure, time-limited access to AWS resources in different accounts.

Answer

Supports federation via SAML with Azure AD

Answer

Provides native integration with Azure Key Vault for key management

Answer

Allows connection to AWS via IAM instance profiles

Question 5

An administrator needs to issue tokens that are automatically renewable by the client (so they can stay alive as long as renewed) but must expire no later than 30 days. Which TWO token parameters should be configured on the token role?

Accepted Answer

max_ttl. (max_ttl) is correct because it enforces the absolute maximum lifetime of the token, ensuring it expires no later than 30 days regardless of renewals. Option D (period) is correct because setting a period makes the token automatically renewable by the client, allowing it to stay alive as long as it is renewed before the period expires. Together, period enables automatic renewal behavior and max_ttl caps the total lifespan at 30 days.

Answer

renewable

Answer

ttl

Answer

num_uses

Question 6

Which TWO of the following are valid capabilities that can be specified in a Vault policy?

Accepted Answer

create. In Vault policies, capabilities define the allowed actions on paths. The `create` capability permits creating new data at a path without needing to read existing data, which is distinct from `update` that allows modifying existing data. Both `create` and `update` are valid, separate capabilities in Vault's policy system.

Answer

write

Answer

sudo

Answer

rename

Question 7

Which TWO statements about batch tokens are true?

Accepted Answer

They are lightweight and support a high creation rate.. Batch tokens are designed to be lightweight and support a high creation rate, ideal for ephemeral workloads. Option B is correct because batch tokens cannot be used with a use-limit; use-limits are only supported by service tokens. Options C, D, and E are incorrect: batch tokens do not support explicit max TTL (C), they do not have a TTL as they derive their lifetime from the parent token (D), and they are not renewable (E).

Answer

They support explicit max TTL.

Answer

They have a TTL.

Answer

They are renewable.

Question 8

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Vault's `vault rewrap` command re-encrypts existing ciphertext with the latest key version without decrypting the underlying plaintext, preserving the data's confidentiality. This is essential after a key rotation to ensure all ciphertext uses the new key, meeting compliance requirements for periodic key rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 9

A Vault administrator wants to ensure that all secrets are encrypted at rest and in transit. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable TLS on all Vault listener configurations.. Enabling TLS on all Vault listener configurations ensures that data is encrypted in transit between clients and the Vault server, protecting against eavesdropping and man-in-the-middle attacks. Option C is correct because using a seal that provides envelope encryption (e.g., Auto Unseal with a cloud KMS) encrypts the master key and storage backend data, ensuring secrets are encrypted at rest. Together, these two configurations satisfy the requirement for encryption both in transit (TLS) and at rest (seal envelope encryption).

Answer

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Answer

Set the `encrypt` parameter on the audit device configuration.

Answer

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Question 10

Which TWO statements are true about the AWS secrets engine? (Choose two.)

Accepted Answer

It can generate AWS session tokens. The AWS secrets engine can generate temporary AWS session tokens via the AWS Security Token Service (STS). These tokens provide short-term, limited-privilege credentials for accessing AWS resources, which is a core feature of the engine for dynamic credential management.

Answer

It can manage EC2 key pairs

Answer

It supports STS federation

Answer

It only supports static IAM users

Question 11

Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?

Accepted Answer

Kubernetes auth authenticates using a service account JWT token, whereas AppRole uses a RoleID and SecretID.. Kubernetes authentication works by having Vault validate a Kubernetes service account JWT token against the Kubernetes TokenReview API, while AppRole authentication requires a RoleID (which identifies the role) and a SecretID (which acts as a credential). The SecretID can be a generated value or a wrapped response, but the JWT token in Kubernetes auth is the sole credential presented to Vault.

Answer

AppRole requires a secret ID, while Kubernetes auth does not require any secret.

Answer

Kubernetes auth can only be used within the same cluster as Vault, while AppRole can be used remotely.

Answer

Both support response wrapping for secure delivery of credentials.

Question 12

Which THREE are valid operations in the Vault transit secrets engine? (Choose three.)

Accepted Answer

rewrap. The Vault transit secrets engine provides encryption as a service, and its core operations are encrypt, decrypt, rewrap, and datakey generation. Rewrap is valid because it decrypts ciphertext and re-encrypts it with the latest key version without exposing the plaintext to the caller, maintaining security during key rotation.

Answer

issue

Answer

revoke

Question 13

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Accepted Answer

Reducing the default lease TTL. Reducing the default lease TTL (time-to-live) shortens the maximum duration for which a lease can be issued without renewal. When existing leases expire sooner, the system automatically removes them from the active lease count, thereby reducing the number of active leases. This directly affects the lease lifecycle by forcing earlier expiration.

Answer

Creating a new lease

Answer

Increasing the max lease TTL

Answer

Renewing a lease

Question 14

Which THREE API endpoints are valid for managing policies in Vault?

Accepted Answer

GET /v1/sys/policy/{name}. The GET, DELETE, and POST endpoints are valid for managing policies in Vault. GET retrieves a policy, DELETE removes it, and POST creates or updates a policy. These correspond to the standard CRUD operations supported by Vault's sys/policy API.

Answer

PUT /v1/sys/policy/{name}

Answer

PATCH /v1/sys/policy/{name}

Question 15

Which three characteristics are true about Vault's storage backend and seal mechanisms? (Choose three.)

Accepted Answer

The Shamir seal requires multiple unseal keys to be entered before Vault can operate.. The Shamir seal splits the master key into multiple key shares, requiring a threshold number of these shares to be entered during the unseal process before Vault can decrypt its data encryption key and become operational. This ensures that no single individual can unseal Vault, providing a distributed trust model.

Answer

Auto-unseal using a cloud KMS eliminates the need for unseal keys entirely.

Answer

Consul as a storage backend requires Consul's own gossip protocol for leader election.

Question 16

Which TWO authentication methods support multi-factor authentication (MFA) natively within Vault Enterprise?

Accepted Answer

Userpass authentication. Userpass authentication in Vault Enterprise supports MFA natively because it can be configured with a second factor such as TOTP, Duo, or Okta directly within the auth method's configuration. This allows the userpass method to enforce both a password and an additional authentication factor without requiring an external identity provider or custom wrapper.

Answer

AWS IAM authentication

Answer

Token authentication

Answer

Kubernetes authentication

Question 17

A team is evaluating which secrets engines to use for different use cases. Which TWO statements about secrets engines are true?

Accepted Answer

The KV v2 secrets engine supports versioning and can store metadata like TTL. The KV v2 secrets engine stores multiple versions of a secret, supports metadata such as TTL and deletion time, and allows check-and-set operations for conflict detection. This makes it suitable for use cases requiring secret rotation and audit trails.

Answer

The AWS secrets engine can only generate static access keys

Answer

The Database secrets engine requires a root database user for all configurations

Answer

The Transit secrets engine can generate dynamic database credentials

Question 18

Which TWO statements are true when troubleshooting a failed Vault CLI command?

Accepted Answer

Run 'vault token lookup' to verify the token is valid and has the expected policies.. `vault token lookup` is the standard diagnostic command to inspect the current token's metadata, including its validity, creation time, TTL, and associated policies. If the token is expired, revoked, or lacks the necessary policies for the failed command, this command will reveal the issue directly without side effects.

Answer

Run 'vault write' to test if the token can write to a path.

Answer

Run 'vault status' to check if the server is reachable.

Answer

Run 'vault read' to test if any secret is accessible.

Question 19

A company is deploying Vault in a Kubernetes environment. Which three components are essential for a production-ready Vault on Kubernetes? (Choose three.)

Accepted Answer

A persistent volume claim for each Vault pod for storage.. Vault requires durable storage for its encrypted data (the storage backend). In Kubernetes, a PersistentVolumeClaim (PVC) provides this durable block or file storage that survives pod restarts. Without a PVC, Vault would lose its data when the pod is rescheduled, making it unsuitable for production.

Answer

A ConfigMap to store Vault configuration including unseal keys.

Answer

An Ingress controller to expose Vault externally.

Question 20

Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?

Accepted Answer

AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.. AppRole authentication indeed requires a RoleID and SecretID to be presented by the client to obtain a Vault token, whereas Kubernetes authentication requires a service account token (a JWT) that is signed by the Kubernetes API server. This is a fundamental difference in the credential material each method uses to prove identity.

Answer

Kubernetes auth requires the secret_id to be specified in a configuration file.

Answer

Both AppRole and Kubernetes support response wrapping for initial credentials.

Answer

AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.