VA-003 Compare and configure secrets engines Practice Test 3 — 15 Questions

Question 1

A security architect is designing a secrets management solution with Vault. Which THREE secrets engines are most appropriate for dynamically generating credentials for external systems?

Accepted Answer

PKI secrets engine. The PKI secrets engine is correct because it dynamically generates X.509 certificates for TLS/mTLS authentication, enabling short-lived credentials that reduce the risk of key compromise. This aligns with the requirement for dynamically generating credentials for external systems, as certificates can be issued on-demand with configurable TTLs and revocation support.

Answer

KV v2 secrets engine

Answer

Transit secrets engine

Question 2

Refer to the exhibit. A Vault administrator ran the commands shown. What is the result?

Accepted Answer

The AWS secrets engine is enabled at path internal/aws and will generate IAM users with admin access. Option D is correct because the command `vault secrets enable -path=internal/aws aws` enables the AWS secrets engine at the custom path `internal/aws`. The subsequent configuration with `lease` and `roles` sets up the engine to generate STS credentials (temporary security credentials) via the `sts` endpoint, not IAM users. However, the exhibit shows the role is configured with `credential_type=iam_user` and `policy_arn=arn:aws:iam::aws:policy/AdministratorAccess`, which means the engine will generate IAM users with full admin access, not STS credentials. The path is custom, and the engine is enabled successfully.

Answer

The AWS secrets engine is enabled at path aws/ and will generate IAM users with full admin access

Answer

The commands will fail because the AWS secrets engine cannot be enabled at a custom path

Answer

The AWS secrets engine is enabled at path internal/aws and will generate STS credentials

Question 3

Refer to the exhibit. After executing these commands, what is the expected behavior?

Accepted Answer

The ciphertext is base64 encoded, and the plaintext is base64 decoded automatically. Option B is correct because the Vault transit secrets engine, when configured with `auto_decode` enabled, automatically base64-decodes the ciphertext returned from encryption operations and base64-encodes plaintext before decryption. The command `vault write -f transit/keys/my-key/encrypt/orders` with the `auto_decode` parameter set to `true` ensures that the output ciphertext is base64-encoded for safe transport, and the corresponding decryption operation will automatically base64-decode the input ciphertext before processing.

Answer

The key is automatically rotated every 30 days

Answer

The decryption command requires the key version to be specified

Answer

The encryption operation will fail because the key type 'aes256-gcm96' is incorrect

Question 4

Refer to the exhibit. An application uses this policy to access Vault. The application is able to read database credentials from `database/creds/my-role`. However, attempts to list all roles at `database/roles/` fail. What is the most likely cause?

Accepted Answer

The policy does not allow the 'list' capability on the path `database/roles/`. The policy grants 'read' capability on `database/creds/my-role` but does not include the 'list' capability on `database/roles/`. In Vault, listing requires an explicit 'list' capability in the policy, even if 'read' is allowed on sub-paths. Without 'list', the API call to `LIST database/roles/` returns a permission denied error.

Answer

The path `database/roles/` is not a valid path for listing roles

Answer

The database secrets engine is not enabled

Answer

The application needs the 'sudo' capability to list roles

Question 5

A developer wants to store an API key for their application in Vault using the key-value secrets engine. They need to be able to retrieve the key and also roll back to a previous version if needed. Which secrets engine configuration should they use?

Accepted Answer

Enable the KV v2 secrets engine at a custom path. The KV v2 secrets engine supports versioning, allowing retrieval of previous versions and rollback capabilities. This directly meets the requirement to store an API key and revert to an older version if needed. KV v1 does not support versioning, while Transit and Database engines serve different purposes (encryption and dynamic credentials, respectively).

Answer

Enable the Transit secrets engine at a custom path

Answer

Enable the KV v1 secrets engine at a custom path

Answer

Enable the Database secrets engine at a custom path

Question 6

A Vault administrator has enabled the PKI secrets engine and configured a root CA. They now need to issue certificates for multiple internal services, each with its own common name (CN). Which is the most efficient way to issue certificates while maintaining security?

Accepted Answer

Create a separate role for each service with specific allowed domains. Option A is correct because creating a separate role for each service allows you to enforce least-privilege by restricting each role to specific allowed domains (e.g., via `allowed_domains` and `allow_subdomains`). This ensures that each service can only request certificates for its own CN, preventing cross-service impersonation while maintaining efficient, role-based issuance. The PKI secrets engine uses roles to define TTL, key type, and domain constraints, making per-service roles the most secure and manageable approach.

Answer

Create one role with the allow_any_name parameter set to true

Answer

Create one role with a wildcard allowed domain and use the common_name parameter when issuing

Answer

Create one role without any allowed domains and specify the common name in the request

Question 7

An organization uses the AWS secrets engine to generate IAM users for each application. They want to ensure that if a Vault server is compromised, the attacker cannot use the AWS secrets engine configuration to gain access to the AWS account. Which additional security measure should be implemented?

Accepted Answer

Use a non-root IAM user with minimal privileges for the engine and restrict the engine's role policies to the minimum needed. Option D is correct because the core principle of least privilege ensures that even if the Vault server is compromised, the attacker can only perform actions allowed by the minimal IAM policy attached to the non-root user. This limits the blast radius, preventing the attacker from gaining full administrative access to the AWS account. The AWS secrets engine uses the configured IAM credentials to create temporary IAM users, so restricting those credentials to only the necessary permissions is the most effective mitigation.

Answer

Enable Vault's seal wrapping to encrypt the engine configuration

Answer

Store the AWS access key used by the engine in a separate Vault instance

Answer

Use a dedicated Vault server for the AWS engine

Question 8

A company needs to generate short-lived, dynamic database credentials for its MySQL instances. Which secrets engine should be configured?

Accepted Answer

Database secrets engine. The Database secrets engine is specifically designed to generate short-lived, dynamic credentials for databases like MySQL. It creates unique, time-bound usernames and passwords on demand, which aligns with the requirement for temporary database access without manual credential management.

Answer

KV secrets engine

Answer

AWS secrets engine

Answer

PKI secrets engine

Question 9

An operator wants to enable the database secrets engine at a custom path 'db-creds'. Which command should be used?

Accepted Answer

vault secrets enable -path=db-creds database. Option B is correct because the `vault secrets enable` command with the `-path` flag allows you to mount the database secrets engine at a custom path. The syntax `vault secrets enable -path=db-creds database` correctly specifies the custom path and the engine type, enabling the database secrets engine at the desired location.

Answer

vault secrets enable database

Answer

vault write sys/mounts/db-creds type=database

Answer

vault secrets tune -path=db-creds database

Question 10

A Vault instance was upgraded from version 1.9 to 1.13. After the upgrade, a secrets engine mounted at 'transit/' is unresponsive and returns an error. The engine type is transit. What is the most likely cause?

Accepted Answer

The plugin version is incompatible with the new Vault version. Secrets engines may require plugin binary updates. After a major Vault upgrade, the plugin version may become incompatible. Option B is correct because plugin version incompatibility is a common issue.

Answer

The engine was accidentally disabled during the upgrade

Answer

The namespace was changed during the upgrade

Answer

The transit engine can only be mounted at the default path 'transit/'

Question 11

An organization wants to encrypt data in transit and at rest using a centralized key management system. Which secrets engine is designed for encryption/decryption operations without storing data?

Accepted Answer

Transit secrets engine. The Transit secrets engine performs encryption/decryption operations on data in transit without storing the data itself. It is designed for centralized key management, allowing applications to send plaintext for encryption or ciphertext for decryption via API calls, while the keys remain securely managed within Vault. This makes it ideal for encrypting data in transit and at rest without persisting the data.

Answer

KV secrets engine

Answer

PKI secrets engine

Answer

Database secrets engine

Question 12

A team is adopting Vault and wants to organize secrets by application and environment (e.g., production, staging). What is the best practice for secrets engine path naming?

Accepted Answer

Use hierarchical paths like 'app/env/secret'. Hierarchical paths like 'app/env/secret' are the best practice because they allow Vault's ACL policies to apply fine-grained access control at each level of the path. This structure maps directly to the organization's application and environment boundaries, enabling least-privilege access without complex policy rules. It also simplifies secret rotation and auditing by keeping related secrets logically grouped.

Answer

Use a single path like 'secrets/' for simplicity

Answer

Use the same path for all applications but separate with prefixes like 'app1-'

Answer

Use random UUIDs to avoid guessing

Question 13

A DevOps engineer configures the AWS secrets engine to assume a specific IAM role for generating dynamic credentials. The engine is enabled and the root configuration is set. Which parameter is essential in the role configuration to allow assuming the IAM role?

Accepted Answer

arn. The `arn` parameter is essential in the role configuration for the AWS secrets engine because it specifies the Amazon Resource Name (ARN) of the IAM role that Vault will assume to generate dynamic credentials. Without this parameter, Vault cannot identify which IAM role to assume via AWS STS AssumeRole API, making dynamic credential generation impossible.

Answer

role_type

Answer

credential_type

Answer

inline_policy

Question 14

An administrator wants to view all currently enabled secrets engines and their mount paths. Which command provides this information?

Accepted Answer

vault secrets list. The correct command is `vault secrets list` (or its alias `vault secrets list -detailed`), which displays all enabled secrets engines along with their mount paths, accessor, type, and configuration. This is the standard CLI command for enumerating secrets engines in Vault, equivalent to reading the `sys/mounts` endpoint but with a user-friendly output format.

Answer

vault list sys/mounts

Answer

vault secrets show

Question 15

A developer needs to generate a new certificate for an internal web service using the PKI secrets engine. A role named 'webserver' has been created. What is the correct command to issue the certificate?

Accepted Answer

vault write pki/issue/webserver common_name=web.example.com. Option D is correct because the PKI secrets engine uses the path `pki/issue/<role_name>` to issue certificates. The `vault write` command sends a POST request to this endpoint with the required `common_name` parameter, which generates a new certificate signed by the CA associated with the 'webserver' role.

Answer

vault write pki/webserver/issue

Answer

vault write pki/webserver/cert common_name=web.example.com

Answer

vault read pki/cert/webserver