VA-003 Compare and configure secrets engines Practice Test 2 — 15 Questions

Question 1

A company uses Vault to manage database credentials for a production PostgreSQL cluster. The application team reports that dynamic credentials generated from the database secrets engine are being revoked before the application has finished using them. The Vault lease TTL is set to 1 hour, but the application workload sometimes runs for up to 2 hours. What is the MOST efficient way to ensure credentials remain valid for the full workload duration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the default_lease_ttl on the database secrets engine mount to 2 hours.. Increasing the default_lease_ttl on the database secrets engine mount ensures that all credentials generated by that engine have a TTL of 2 hours, matching the maximum workload duration without requiring application changes. Option A is wrong because setting max_ttl on the role alone does not change the default TTL; the application would still need to request a longer TTL when generating credentials. Option B is wrong because changing the server's default_lease_ttl affects all secrets in Vault, not just database credentials, which could reduce security unnecessarily. Option D is wrong because manually renewing leases adds complexity and overhead; it's more efficient to adjust the lease TTL at the engine level.

Answer

Set max_ttl to 2 hours on the database role.

Answer

Set the Vault server's default_lease_ttl to 2 hours in the server configuration.

Answer

Have the application manually renew the lease every 30 minutes.

Question 2

An administrator runs the commands shown in the exhibit. Later, they run 'vault kv delete kv-v2/secret' and then 'vault kv undelete -versions=1 kv-v2/secret' to recover the secret. Which command must the administrator run to verify that the secret is now readable?

Accepted Answer

vault kv get kv-v2/secret. 'vault kv get' is the standard command to read and display the latest version of a secret from a KV v2 secrets engine. After running 'vault kv undelete -versions=1', version 1 is restored from a deleted state, and 'vault kv get kv-v2/secret' will retrieve and show that version's data, confirming it is readable.

Answer

vault kv list kv-v2/secret

Answer

vault read kv-v2/data/secret

Answer

vault kv metadata get kv-v2/secret

Question 3

A financial services company runs a microservices application on Kubernetes. Each service needs to authenticate to Vault using Kubernetes auth and then read secrets from a shared KV v2 engine mounted at 'shared-kv'. The security team requires that Service-A can only read secrets under 'shared-kv/team-alpha/*' and Service-B can only read secrets under 'shared-kv/team-beta/*'. The Vault administrator has already configured the Kubernetes auth method and created roles for each service with bound service account names. However, both services are currently able to read all paths under 'shared-kv/'. The administrator wants to enforce the least privilege access. Which course of action should the administrator take?

Accepted Answer

Review and update the policy attached to the Kubernetes auth roles to restrict capabilities to the specific paths, e.g., 'path "shared-kv/data/team-alpha/*" { capabilities = ["read"] }'.. The issue is that the policy attached to the Kubernetes auth roles grants read access to the entire 'shared-kv/*' path. By updating the policy to restrict capabilities to specific paths like 'shared-kv/data/team-alpha/*' and 'shared-kv/data/team-beta/*', the administrator enforces least privilege. The 'data' prefix is required for KV v2 engines to access secret data, and the wildcard ensures only the respective team's secrets are readable.

Answer

Configure the Kubernetes auth role to use 'token_policies' with a restrictive policy and ensure the bound service account names are correct.

Answer

Create a new secrets engine for each team and mount them at 'team-alpha' and 'team-beta', then assign each service to its respective engine.

Answer

Add a 'path_deny' capability in the policy for the disallowed paths.

Question 4

A company wants to securely store database credentials for a dynamic application that spins up new instances frequently. They need to ensure each instance gets a unique, time-limited username/password pair with minimal operational overhead. Which approach should they use?

Accepted Answer

Enable the database secrets engine and configure role-based dynamic credential generation. The database secrets engine in HashiCorp Vault is designed specifically for dynamic credential generation, creating unique, time-limited username/password pairs on-demand for each instance. This approach minimizes operational overhead by automating credential lifecycle management, including automatic revocation after the TTL expires, which aligns perfectly with the requirement for frequently spinning up instances.

Answer

Use the transit secrets engine to encrypt the static credentials and distribute them

Answer

Use the PKI secrets engine to issue certificates for database authentication

Answer

Store the credentials in KV v2 and have each instance read them

Question 5

Which TWO of the following are valid methods to enable a secrets engine at a non-default path in Vault?

Accepted Answer

vault write sys/mounts/my-aws type=aws. Options B and C are both valid methods to enable a secrets engine at a non-default path in Vault. Option B uses the raw API endpoint via 'vault write sys/mounts/my-aws type=aws', which is a valid low-level approach. Option C uses the higher-level 'vault secrets enable -path=my-aws aws' command, which is the standard CLI method. Option E ('vault secrets enable my-aws aws') is invalid because it incorrectly places the path before the engine type; the correct syntax for a default path is 'vault secrets enable aws', but for a non-default path the '-path' flag is required.

Answer

vault secrets enable -custom-path=my-aws aws

Answer

vault secrets enable -mount-path=my-aws aws

Answer

vault secrets enable my-aws aws

Question 6

A DevOps engineer creates the configuration above. After testing, they notice that the generated database credentials are not being revoked after the TTL expires. What is the most likely cause?

Accepted Answer

The database configuration uses a connection_url with template variables but provides static admin credentials, not root rotation. The database secrets engine requires root credential rotation to enable automatic revocation of generated credentials. When the `connection_url` uses template variables like `{{username}}` and `{{password}}` but the admin credentials are static (not rotated via `rotate_root`), Vault cannot track the actual root password. Without root rotation, Vault lacks the ability to execute `REVOKE` commands after TTL expiry because it cannot authenticate to the database with the current root credentials to perform cleanup.

Answer

The creation_statements do not include the REVOKE command

Answer

The role definition has a syntax error in the creation_statements

Answer

The secrets engine is enabled at a path other than 'database/'

Question 7

Drag and drop the steps to configure Vault's database secrets engine with PostgreSQL into the correct order.

Accepted Answer

Enable the database secrets engine, then configure the PostgreSQL connection, then create a role, then generate credentials, and finally revoke the lease.. The correct sequence for configuring Vault's database secrets engine with PostgreSQL is: first enable the secrets engine, then configure the database connection, then create a role that defines the credential generation parameters, then generate credentials, and finally revoke the lease when done. This order ensures all prerequisites are met at each step.

Answer

Configure the PostgreSQL connection, then enable the database secrets engine, then create a role, then generate credentials, and finally revoke the lease.

Answer

Create a role, then configure the PostgreSQL connection, then enable the database secrets engine, then generate credentials, and finally revoke the lease.

Answer

Generate credentials, then create a role, then configure the PostgreSQL connection, then enable the database secrets engine, and finally revoke the lease.

Question 8

Match each Vault storage backend to its description.

Accepted Answer

Consul: Stores data in a highly available key-value store, commonly used for Vault's backend.. Vault supports multiple storage backends. Consul and Integrated Raft are both highly available, while File is for single-node setups. Common confusions include mixing Consul's distributed KV nature with file-based storage or incorrectly attributing external dependencies to Raft.

Answer

Consul: Stores data in encrypted files on disk with manual replication.

Answer

Integrated Raft: Stores data in an external key-value store like etcd.

Question 9

A team wants to store static secrets like database passwords and rotate them periodically. Which secrets engine should they enable?

Accepted Answer

KV v2 secrets engine. The KV v2 secrets engine is designed for static secrets like database passwords, offering versioning, configurable deletion, and periodic rotation via lease management or external automation. It stores secrets as key-value pairs with metadata, making it ideal for static credentials that need controlled lifecycle management.

Answer

AWS secrets engine

Answer

PKI secrets engine

Answer

Transit secrets engine

Question 10

An application needs to obtain short-lived, time-limited credentials to access an external database using username/password authentication. Which secrets engine should be used?

Accepted Answer

Database secrets engine. The Database secrets engine is designed specifically to generate short-lived, dynamic credentials for databases, including external databases accessed via username/password authentication. It creates unique, time-limited usernames and passwords on-the-fly, which are automatically revoked after a configurable TTL, meeting the requirement for temporary credentials.

Answer

KV v2 secrets engine

Answer

Consul secrets engine

Answer

Identity secrets engine

Question 11

A security team wants to ensure that secrets stored in Vault are encrypted in transit and at rest, and that even Vault administrators cannot read the plaintext secret values. Which configuration is required?

Accepted Answer

Enable the Transit secrets engine and encrypt secrets before writing them to KV. The Transit secrets engine allows clients to encrypt data (including secrets) using Vault-managed encryption keys before writing the ciphertext to a storage backend like KV. This ensures that even Vault administrators with access to the raw storage backend cannot read plaintext secret values, as the encryption key is never exposed to them. The Transit engine also supports encryption in transit via TLS and at rest via the encrypted ciphertext stored in the KV engine, meeting the full requirement.

Answer

Set a strong master key for the Vault cluster

Answer

Configure storage backend encryption using a KMS

Answer

Both A and B

Question 12

An organization needs to automatically issue X.509 certificates for internal services. Which secrets engine should they use?

Accepted Answer

PKI secrets engine. The PKI secrets engine is specifically designed to generate X.509 certificates for internal services. It acts as a certificate authority (CA), handling certificate signing requests (CSRs), issuing certificates with configurable lifetimes, and managing revocation via CRLs or OCSP. This directly meets the requirement for automated certificate issuance.

Answer

SSH secrets engine

Answer

Cert secrets engine

Answer

Transit secrets engine

Question 13

A company wants to use Vault to generate IAM users dynamically for each application, following the principle of least privilege. Which secrets engine configuration should they use?

Accepted Answer

Enable AWS engine with a dedicated IAM user (limited permissions) and use 'iam_user' credential type. The AWS secrets engine can be configured with a dedicated IAM user that has limited permissions, and by using the 'iam_user' credential type, Vault dynamically creates a new IAM user for each application. This approach adheres to the principle of least privilege by ensuring each application gets a unique set of credentials scoped to its specific needs, without sharing or reusing static keys.

Answer

Enable AWS engine with a root IAM user and use 'federation_token' credential type

Answer

Enable AWS engine with a static access key and use 'iam_user' credential type

Answer

Enable AWS engine with an IAM role and use 'assumed_role' credential type

Question 14

An administrator enables the database secrets engine for PostgreSQL. After configuring the connection, running `vault write database/config/someconfig` yields error: 'x509: certificate signed by unknown authority'. What is the most likely cause?

Accepted Answer

The PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle. The error 'x509: certificate signed by unknown authority' indicates that Vault, when connecting to the PostgreSQL database, received a TLS certificate from the server that was not signed by any Certificate Authority (CA) present in Vault's trusted CA bundle. Vault uses its system's CA pool or a custom CA bundle configured in the connection string to verify the database server's certificate. If the PostgreSQL server uses a self-signed certificate or one issued by an internal CA not trusted by Vault, this error occurs. Option B correctly identifies that the PostgreSQL server's TLS certificate is not trusted by Vault's CA bundle.

Answer

The connection string is incorrect

Answer

The database engine is not enabled

Answer

The Vault server's TLS certificate is self-signed

Question 15

A team is evaluating which secrets engines to use for different use cases. Which TWO statements about secrets engines are true?

Accepted Answer

The KV v2 secrets engine supports versioning and can store metadata like TTL. The KV v2 secrets engine stores multiple versions of a secret, supports metadata such as TTL and deletion time, and allows check-and-set operations for conflict detection. This makes it suitable for use cases requiring secret rotation and audit trails.

Answer

The AWS secrets engine can only generate static access keys

Answer

The Database secrets engine requires a root database user for all configurations

Answer

The Transit secrets engine can generate dynamic database credentials