VA-003 Compare and configure secrets engines — 10 Questions

Question 1

A SaaS startup uses Vault to manage secrets for their microservices architecture. They have enabled the KV v2 secrets engine at 'secret/' and the database secrets engine at 'database/'. Developers often need to read application configuration from 'secret/app/config' and database credentials from 'database/creds/app-role'. Recently, the security team mandated that all secrets must be encrypted at rest using Vault's seal mechanism. They configured Vault to use AWS KMS as the seal. After enabling the seal, they noticed that reading from 'secret/app/config' still works, but reading from 'database/creds/app-role' returns an error: 'Error making API request: Code: 500. Errors: * 1 error occurred: * failed to decrypt data'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AWS KMS key has been rotated and Vault cannot access the old key.. If the AWS KMS key used for the seal has been rotated, Vault may still be able to decrypt the master key (using the old key) and thus read static secrets like those in KV v2. However, the database secrets engine requires decrypting its stored configuration (e.g., database password) each time a new credential is generated. If that configuration was encrypted before the key rotation and the old key is no longer available (e.g., disabled or deleted), Vault will fail to decrypt it, resulting in the observed error. The KV v2 engine may succeed because its data was read after the rotation or was cached, or the key rotation did not affect the specific ciphertext.

Answer

The database engine requires a separate seal configuration.

Answer

The database engine configuration is stored in a different location that is not sealed.

Answer

The database engine uses a separate encryption key that was not re-wrapped after changing the seal configuration.

Question 2

A DevOps team is configuring the AWS secrets engine to generate IAM users with dynamic credentials. They want to ensure that each Vault-generated IAM user is automatically deleted when its lease expires. Which TWO configuration steps are required to achieve this? (Choose two.)

Accepted Answer

Set the role's 'ttl' parameter to a finite duration.. Setting the role's 'ttl' parameter to a finite duration ensures that the Vault-generated IAM user credentials expire after that time, triggering the lease expiration and automatic deletion. Option E is incorrect because including the 'delete' operation in 'policy_arns' or a custom inline policy grants permissions to the IAM user itself, not to Vault. Vault uses its own AWS credentials to perform the deletion, which must be configured separately in the AWS secrets engine's configuration.

Answer

Set the role's 'initial_lease_status' to 'expired' to trigger immediate deletion.

Answer

Set the role's 'rotate' parameter to 'true' to rotate credentials on lease renewal.

Answer

Set the mount's 'default_lease_ttl' to a finite duration.

Answer

Set the role's 'credential_type' to 'iam_user' and include the 'delete' operation in 'policy_arns' or use a custom inline policy allowing deletion.

Question 3

Refer to the exhibit. A Vault administrator ran the commands shown. What is the result?

Accepted Answer

The AWS secrets engine is enabled at path internal/aws and will generate IAM users with admin access. The command `vault secrets enable -path=internal/aws aws` enables the AWS secrets engine at the custom path `internal/aws`. The subsequent configuration sets up a role with `credential_type=iam_user` and `policy_arn=arn:aws:iam::aws:policy/AdministratorAccess`, which means the engine will generate IAM users with full admin access. The path is custom, and the engine is enabled successfully.

Answer

The AWS secrets engine is enabled at path aws/ and will generate IAM users with full admin access

Answer

The commands will fail because the AWS secrets engine cannot be enabled at a custom path

Answer

The AWS secrets engine is enabled at path internal/aws and will generate STS credentials

Question 4

A DevOps team uses Vault to store database credentials via the database secrets engine. They notice that after the default lease duration, applications receive errors when trying to connect. The team wants to ensure that applications automatically renew leases before expiration. What should they do?

Accepted Answer

Use Vault Agent to renew the secret.. Vault Agent is designed to automatically handle secret renewal and lifecycle management. It runs as a sidecar or daemon that periodically checks the lease duration and renews it before expiration, ensuring applications always have valid credentials without manual intervention or custom scripting.

Answer

Schedule a cron job to periodically read new credentials.

Answer

Set a longer default TTL on the role.

Answer

Set a longer max TTL on the mount.

Question 5

A security team wants to store static secrets like API keys in Vault. They need the secrets to be versioned and support rollback. Which secrets engine should they use?

Accepted Answer

KV v2. KV v2 is the correct choice because it is designed specifically for storing static secrets with built-in versioning and rollback capabilities. Unlike KV v1, which overwrites data without preserving history, KV v2 retains a configurable number of secret versions, allowing administrators to undelete or roll back to a previous version using the `vault kv rollback` command or API calls.

Answer

Cubbyhole

Answer

KV v1

Answer

Transit

Question 6

An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

Accepted Answer

AWS IAM is eventually consistent and the user may take a few seconds to propagate.. AWS IAM is an eventually consistent system. When Vault uses the AWS secrets engine to create an IAM user via the CreateUser API call, the user is not immediately available across all AWS services due to propagation delays. This eventual consistency means the generated IAM user may take a few seconds to be fully usable, which is a known behavior of AWS IAM.

Answer

The Vault write operation failed due to network latency.

Answer

The TTL on the role is too short.

Answer

Vault must wait for the AWS secret key to be rotated before returning the user.

Question 7

A company is using the PKI secrets engine to issue certificates for internal services. They want to ensure that certificates are automatically revoked if a service is decommissioned. What should they implement?

Accepted Answer

Use Vault's built-in lifecycle management and revocation capabilities.. Vault's PKI secrets engine includes built-in lifecycle management that can automatically revoke certificates when a lease expires or when a secret is deleted via the API. This allows you to tie certificate validity to the service's lifecycle in Vault, ensuring decommissioned services have their certificates revoked without manual intervention.

Answer

Implement certificate pinning in all services.

Answer

Set a very short TTL on certificates so they expire quickly.

Answer

Configure a Certificate Revocation List (CRL) that clients check.

Question 8

A developer wants to use Vault to encrypt sensitive data before storing it in a database. They need to perform encryption and decryption operations without ever exposing the encryption key. Which secrets engine should they use?

Accepted Answer

Transit. The Transit secrets engine is designed specifically for encryption-as-a-service workflows, allowing applications to encrypt and decrypt data using keys managed entirely within Vault. The encryption key never leaves Vault, satisfying the requirement to avoid exposing the key. In contrast, other engines like KV v2 store raw secrets but do not perform cryptographic operations without exposing the key material.

Answer

PKI

Answer

KV v2

Answer

Database

Question 9

A company has multiple Vault clusters in different regions. They want to use the replication feature to synchronise secrets across clusters. However, they want to exclude a specific secrets engine from replication for compliance reasons. What should they do?

Accepted Answer

Use performance replication and configure a mount filter.. Performance replication in Vault allows you to replicate secret data across clusters while using mount filters to include or exclude specific secrets engines. This is the correct approach because mount filters are designed precisely for this use case, enabling selective replication to meet compliance requirements without creating separate infrastructure.

Answer

Create a separate Vault cluster for that secrets engine.

Answer

Disable replication on that specific mount.

Answer

Use disaster recovery (DR) replication and exclude the mount.

Question 10

An administrator configured the database secrets engine with PostgreSQL. When an application requests credentials, Vault returns a username and password. However, the application reports that the credentials are not working. What is the most likely cause?

Accepted Answer

The database user used by Vault does not have sufficient privileges to create users.. The most likely cause is that the database user configured in Vault lacks the necessary privileges to create new database users. When Vault generates dynamic credentials, it uses its own database connection (the root or management user) to execute `CREATE USER` and `GRANT` statements. If that user does not have the `CREATEROLE` or `SUPERUSER` attribute (or equivalent `CREATE USER` privilege in PostgreSQL), the credential creation fails silently or produces unusable credentials, even though Vault returns a username and password.

Answer

The TTL on the role is set too low.

Answer

The connection string provided to Vault is incorrect.

Answer

The generated credentials were revoked by Vault before the application used them.