VA-003 Quick Quiz — 10 Questions

Question 1

Refer to the exhibit. A developer tries to renew a token and receives this error. The token was created using 'vault token create -type=batch'. What is the most likely cause of this error?

Accepted Answer

The token is a batch token. Batch tokens are non-persistent and do not have associated lease IDs, so they cannot be renewed. The error occurs because the developer attempted to renew a batch token using 'vault token renew', which is only valid for service tokens that have a lease and can be extended. The exhibit shows a renewal failure, and since the token was created with 'vault token create -type=batch', the most likely cause is that batch tokens are inherently non-renewable.

Answer

The token is a service token and has expired

Answer

The token is a periodic token and its period has expired

Answer

The token is an orphan token

Question 2

An organization wants to use Vault's dynamic database credentials to manage MySQL access. They have multiple application servers that need to connect to different databases. What is the best practice for configuring database roles to minimize the number of Vault mounts?

Accepted Answer

Create a single database mount and define multiple roles within it, each with different credential generation parameters.. Vault allows a single database mount (e.g., `database/`) to manage multiple database connections, and within that mount, you can define multiple roles. Each role can specify different credential generation parameters (e.g., username template, default TTL, max TTL, and allowed roles) for distinct databases or application servers. This minimizes the number of mounts while still providing fine-grained access control and isolation of credentials.

Answer

Use the same database mount but create a separate role per application server.

Answer

Create a separate database mount for each database to isolate credential generation.

Answer

Use a single role that generates credentials for all databases by using a wildcard in the username.

Question 3

What is the purpose of the `storage` stanza in a Vault server configuration file?

Accepted Answer

Defines where Vault stores encrypted data.. The `storage` stanza in a Vault server configuration file defines the backend where Vault stores all encrypted data, including secrets, tokens, and metadata. This backend can be a file system, Consul, Raft, or other supported storage backends, and it is the persistent layer that holds the encrypted data after it has been processed by the seal mechanism. Without a properly configured `storage` stanza, Vault cannot persist any data and will fail to start.

Answer

Defines the encryption algorithm for secrets.

Answer

Defines the seal mechanism.

Answer

Defines the listener address.

Question 4

Which Vault CLI command is used to authenticate a user with a username and password to the userpass auth method?

Accepted Answer

vault login -method=userpass username=alice password=secret. `vault login -method=userpass` is the standard Vault CLI command to authenticate against the userpass auth method, passing the username and password as parameters. This command triggers the login endpoint (`/v1/auth/userpass/login/:username`) and returns a client token upon successful authentication.

Answer

vault auth userpass username=alice password=secret

Answer

vault token create -policy=userpass

Answer

vault authenticate userpass username=alice password=secret

Question 5

A user with this policy wants to delete secrets under the 'team/' path. Which additional capability must be added?

Accepted Answer

delete. The user's policy grants 'create' and 'update' capabilities on 'team/*', but not 'delete'. In Vault's ACL policy system, each operation (create, read, update, delete, list, sudo) must be explicitly allowed. Since 'delete' is missing, the user cannot delete secrets under 'team/'. Adding the 'delete' capability to the policy is required.

Answer

sudo

Answer

list

Answer

patch

Question 6

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Accepted Answer

Enable AppRole authentication, create a role, retrieve the RoleID, generate a SecretID, then login.. First enable the auth method, then create the role, then retrieve the RoleID, generate a SecretID, and finally login.

Answer

Create a role, enable AppRole authentication, retrieve the RoleID, generate a SecretID, then login.

Answer

Enable AppRole authentication, create a role, generate a SecretID, retrieve the RoleID, then login.

Answer

Enable AppRole authentication, create a role, retrieve the RoleID, login, then generate a SecretID.

Question 7

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Accepted Answer

Reducing the default lease TTL. Option A is correct because reducing the default lease TTL shortens the lifetime of newly issued leases, so they expire and are revoked sooner, decreasing the count of active leases at any given time. Option B is correct because revoking a lease explicitly invalidates it, immediately removing it from the set of active leases tracked by Vault. Option C is incorrect because creating a new lease adds another active lease rather than reducing the count. Option D is incorrect because increasing the max lease TTL allows leases to live longer, which tends to keep more leases active. Option E is incorrect because renewing a lease extends its lifetime, keeping it active instead of reducing the number of active leases.

Answer

Creating a new lease

Answer

Increasing the max lease TTL

Answer

Renewing a lease

Question 8

A Vault cluster uses Consul for HA. After a brief network partition, a standby node loses contact with the active node. What does the standby node do after a timeout?

Accepted Answer

It seals itself.. In a Vault cluster using Consul for high availability, only the active node serves requests. When a standby node loses contact with the active node due to a network partition, it cannot verify the active node's health or its own leadership status. After a configurable timeout (default 10 seconds), the standby node seals itself to prevent serving stale or inconsistent data, ensuring data integrity and security.

Answer

It becomes the active node.

Answer

It continues to serve requests.

Answer

It replicates data from the storage backend.

Question 9

Refer to the exhibit. What seal mechanism is configured for this Vault instance?

Accepted Answer

AWS KMS auto-unseal. The exhibit shows a Vault instance configured with `seal "awskms"` and a `region` and `kms_key_id` specified. This indicates that AWS KMS is used as the auto-unseal mechanism, where Vault delegates the unsealing process to AWS Key Management Service, eliminating the need for manual Shamir key shares.

Answer

HSM seal via PKCS#11

Answer

Shamir seal with default shares

Answer

No seal; Vault is in insecure mode

Question 10

Drag and drop the steps to initialize and unseal a Vault server for the first time into the correct order.

Accepted Answer

Start the server, then initialize Vault, then distribute the unseal keys, then unseal the Vault, then verify the status.. The correct sequence for initializing and unsealing a Vault server for the first time is: start the server, initialize Vault (which generates unseal keys), distribute the unseal keys to key holders, unseal the Vault using a threshold of keys, then verify the Vault is unsealed. This ensures proper security and operational readiness.

Answer

Initialize Vault, then start the server, then distribute the unseal keys, then unseal the Vault, then verify the status.

Answer

Start the server, then initialize Vault, then unseal the Vault, then distribute the unseal keys, then verify the status.

Answer

Start the server, then distribute the unseal keys, then initialize Vault, then unseal the Vault, then verify the status.