VA-003 Compare and configure secrets engines Practice Test 2 — 15 Questions

Question 1

An administrator runs the commands shown in the exhibit. Later, they run 'vault kv delete kv-v2/secret' and then 'vault kv undelete -versions=1 kv-v2/secret' to recover the secret. Which command must the administrator run to verify that the secret is now readable?

Accepted Answer

vault kv get kv-v2/secret. Option C is correct because 'vault kv get' is the standard command to read and display the latest version of a secret from a KV v2 secrets engine. After running 'vault kv undelete -versions=1', version 1 is restored from a deleted state, and 'vault kv get kv-v2/secret' will retrieve and show that version's data, confirming it is readable.

Answer

vault kv list kv-v2/secret

Answer

vault read kv-v2/data/secret

Answer

vault kv metadata get kv-v2/secret

Question 2

A financial services company runs a microservices application on Kubernetes. Each service needs to authenticate to Vault using Kubernetes auth and then read secrets from a shared KV v2 engine mounted at 'shared-kv'. The security team requires that Service-A can only read secrets under 'shared-kv/team-alpha/*' and Service-B can only read secrets under 'shared-kv/team-beta/*'. The Vault administrator has already configured the Kubernetes auth method and created roles for each service with bound service account names. However, both services are currently able to read all paths under 'shared-kv/'. The administrator wants to enforce the least privilege access. Which course of action should the administrator take?

Accepted Answer

Review and update the policy attached to the Kubernetes auth roles to restrict capabilities to the specific paths, e.g., 'path "shared-kv/data/team-alpha/*" { capabilities = ["read"] }'.. Option D is correct because the issue is that the policy attached to the Kubernetes auth roles grants read access to the entire 'shared-kv/*' path. By updating the policy to restrict capabilities to specific paths like 'shared-kv/data/team-alpha/*' and 'shared-kv/data/team-beta/*', the administrator enforces least privilege. The 'data' prefix is required for KV v2 engines to access secret data, and the wildcard ensures only the respective team's secrets are readable.

Answer

Configure the Kubernetes auth role to use 'token_policies' with a restrictive policy and ensure the bound service account names are correct.

Answer

Create a new secrets engine for each team and mount them at 'team-alpha' and 'team-beta', then assign each service to its respective engine.

Answer

Add a 'path_deny' capability in the policy for the disallowed paths.

Question 3

A company wants to securely store database credentials for a dynamic application that spins up new instances frequently. They need to ensure each instance gets a unique, time-limited username/password pair with minimal operational overhead. Which approach should they use?

Accepted Answer

Enable the database secrets engine and configure role-based dynamic credential generation. The database secrets engine in HashiCorp Vault is designed specifically for dynamic credential generation, creating unique, time-limited username/password pairs on-demand for each instance. This approach minimizes operational overhead by automating credential lifecycle management, including automatic revocation after the TTL expires, which aligns perfectly with the requirement for frequently spinning up instances.

Answer

Use the transit secrets engine to encrypt the static credentials and distribute them

Answer

Use the PKI secrets engine to issue certificates for database authentication

Answer

Store the credentials in KV v2 and have each instance read them

Question 4

Which TWO of the following are valid methods to enable a secrets engine at a non-default path in Vault?

Accepted Answer

vault secrets enable -path=my-aws aws. Option C is correct because the `vault secrets enable` command uses the `-path` flag to specify a custom mount path for a secrets engine, overriding the default path that matches the engine type. This is the standard CLI syntax for enabling a secrets engine at a non-default location, as documented by HashiCorp.

Answer

vault secrets enable -custom-path=my-aws aws

Answer

vault write sys/mounts/my-aws type=aws

Answer

vault secrets enable -mount-path=my-aws aws

Question 5

A DevOps engineer creates the configuration above. After testing, they notice that the generated database credentials are not being revoked after the TTL expires. What is the most likely cause?

Accepted Answer

The database configuration uses a connection_url with template variables but provides static admin credentials, not root rotation. Option C is correct because the database secrets engine requires root credential rotation to enable automatic revocation of generated credentials. When the `connection_url` uses template variables like `{{username}}` and `{{password}}` but the admin credentials are static (not rotated via `rotate_root`), Vault cannot track the actual root password. Without root rotation, Vault lacks the ability to execute `REVOKE` commands after TTL expiry because it cannot authenticate to the database with the current root credentials to perform cleanup.

Answer

The creation_statements do not include the REVOKE command

Answer

The role definition has a syntax error in the creation_statements

Answer

The secrets engine is enabled at a path other than 'database/'

Question 6

Drag and drop the steps to configure Vault's database secrets engine with PostgreSQL into the correct order.

Question 7

Match each Vault storage backend to its description.

Question 8

A team wants to store static secrets like database passwords and rotate them periodically. Which secrets engine should they enable?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is designed for static secrets like database passwords, offering versioning, configurable deletion, and periodic rotation via lease management or external automation. It stores secrets as key-value pairs with metadata, making it ideal for static credentials that need controlled lifecycle management.

Answer

AWS secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 9

An application needs to obtain short-lived, time-limited credentials to access an external database using username/password authentication. Which secrets engine should be used?

Accepted Answer

Database secrets engine. The Database secrets engine is designed specifically to generate short-lived, dynamic credentials for databases, including external databases accessed via username/password authentication. It creates unique, time-limited usernames and passwords on-the-fly, which are automatically revoked after a configurable TTL, meeting the requirement for temporary credentials.

Answer

KV v2 secrets engine

Answer

Consul secrets engine

Answer

Identity secrets engine

Question 10

A security team wants to ensure that secrets stored in Vault are encrypted in transit and at rest, and that even Vault administrators cannot read the plaintext secret values. Which configuration is required?

Accepted Answer

Enable the Transit secrets engine and encrypt secrets before writing them to KV. Option C is correct because the Transit secrets engine allows clients to encrypt data (including secrets) using Vault-managed encryption keys before writing the ciphertext to a storage backend like KV. This ensures that even Vault administrators with access to the raw storage backend cannot read plaintext secret values, as the encryption key is never exposed to them. The Transit engine also supports encryption in transit via TLS and at rest via the encrypted ciphertext stored in the KV engine, meeting the full requirement.

Answer

Set a strong master key for the Vault cluster

Answer

Configure storage backend encryption using a KMS

Answer

Both A and B

Question 11

An organization needs to automatically issue X.509 certificates for internal services. Which secrets engine should they use?

Accepted Answer

PKI secrets engine. The PKI secrets engine is specifically designed to generate X.509 certificates for internal services. It acts as a certificate authority (CA), handling certificate signing requests (CSRs), issuing certificates with configurable lifetimes, and managing revocation via CRLs or OCSP. This directly meets the requirement for automated certificate issuance.

Answer

SSH secrets engine

Answer

Cert secrets engine

Answer

Transit secrets engine

Question 12

A company wants to use Vault to generate IAM users dynamically for each application, following the principle of least privilege. Which secrets engine configuration should they use?

Accepted Answer

Enable AWS engine with a dedicated IAM user (limited permissions) and use 'iam_user' credential type. Option A is correct because the AWS secrets engine can be configured with a dedicated IAM user that has limited permissions, and by using the 'iam_user' credential type, Vault dynamically creates a new IAM user for each application. This approach adheres to the principle of least privilege by ensuring each application gets a unique set of credentials scoped to its specific needs, without sharing or reusing static keys.

Answer

Enable AWS engine with a root IAM user and use 'federation_token' credential type

Answer

Enable AWS engine with a static access key and use 'iam_user' credential type

Answer

Enable AWS engine with an IAM role and use 'assumed_role' credential type

Question 13

An administrator enables the database secrets engine for PostgreSQL. After configuring the connection, running `vault write database/config/someconfig` yields error: 'x509: certificate signed by unknown authority'. What is the most likely cause?

Accepted Answer

The PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle. The error 'x509: certificate signed by unknown authority' indicates that Vault, when connecting to the PostgreSQL database, received a TLS certificate from the server that was not signed by any Certificate Authority (CA) present in Vault's trusted CA bundle. Vault uses its system's CA pool or a custom CA bundle configured in the connection string to verify the database server's certificate. If the PostgreSQL server uses a self-signed certificate or one issued by an internal CA not trusted by Vault, this error occurs. Option B correctly identifies that the PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle.

Answer

The connection string is incorrect

Answer

The database engine is not enabled

Answer

The Vault server's TLS certificate is self-signed

Question 14

A team is evaluating which secrets engines to use for different use cases. Which TWO statements about secrets engines are true?

Accepted Answer

The KV v2 secrets engine supports versioning and can store metadata like TTL. Option C is correct because the KV v2 secrets engine stores multiple versions of a secret, supports metadata such as TTL and deletion time, and allows check-and-set operations for conflict detection. This makes it suitable for use cases requiring secret rotation and audit trails.

Answer

The AWS secrets engine can only generate static access keys

Answer

The Database secrets engine requires a root database user for all configurations

Answer

The Transit secrets engine can generate dynamic database credentials

Question 15

An administrator is configuring the Transit secrets engine for encryption as a service. Which TWO configuration options are valid?

Accepted Answer

Enabling automatic key derivation per context. Option C is correct because the Transit secrets engine supports key derivation, which allows a base key to be combined with a user-supplied context value to generate a unique encryption key per context. This enables multiple parties to use the same base key while deriving distinct keys for different data sets, enhancing security without managing separate keys. Option D is correct because the Transit engine allows administrators to set a rotation period for encryption keys, automatically rotating the key after a specified interval to comply with cryptographic best practices.

Answer

Using the engine to generate one-time passwords

Answer

Configuring the engine to export the key in plaintext

Answer

Setting a TTL on the key itself

VA-003 Compare and configure secrets engines Practice Test 2 — 15 Questions

Exhibit

VA-003 Compare and configure secrets engines Practice Test 2 — 15 Questions

Exhibit