VA-003 Compare and configure secrets engines Practice Test 3 — 15 Questions

Question 1

An administrator is configuring the Transit secrets engine for encryption as a service. Which TWO configuration options are valid?

Accepted Answer

Enabling automatic key derivation per context. The Transit secrets engine supports key derivation, which allows a base key to be combined with a user-supplied context value to generate a unique encryption key per context. This enables multiple parties to use the same base key while deriving distinct keys for different data sets, enhancing security without managing separate keys. Option D is correct because the Transit engine allows administrators to set a rotation period for encryption keys, automatically rotating the key after a specified interval to comply with cryptographic best practices.

Answer

Using the engine to generate one-time passwords

Answer

Configuring the engine to export the key in plaintext

Answer

Setting a TTL on the key itself

Question 2

A security architect is designing a secrets management solution with Vault. Which THREE secrets engines are most appropriate for dynamically generating credentials for external systems?

Accepted Answer

PKI secrets engine. The PKI secrets engine is correct because it dynamically generates X.509 certificates for TLS/mTLS authentication, enabling short-lived credentials that reduce the risk of key compromise. This aligns with the requirement for dynamically generating credentials for external systems, as certificates can be issued on-demand with configurable TTLs and revocation support.

Answer

KV v2 secrets engine

Answer

Transit secrets engine

Question 3

Refer to the exhibit. After executing these commands, what is the expected behavior?

Accepted Answer

The decryption command requires the key version to be specified. In the Vault Transit secrets engine, when a key has multiple versions (e.g., after rotation), the decryption command requires the key version to be specified to ensure the correct key is used. If the version is not specified, Vault defaults to the latest version, which may not match the version used for encryption, leading to decryption failure. Therefore, option C is correct.

Answer

The key is automatically rotated every 30 days

Answer

The ciphertext is base64 encoded, and the plaintext is base64 decoded automatically

Answer

The encryption operation will fail because the key type 'aes256-gcm96' is incorrect

Question 4

Refer to the exhibit. An application uses this policy to access Vault. The application is able to read database credentials from `database/creds/my-role`. However, attempts to list all roles at `database/roles/` fail. What is the most likely cause?

Accepted Answer

The policy does not allow the 'list' capability on the path `database/roles/`. The policy grants 'read' capability on `database/creds/my-role` but does not include the 'list' capability on `database/roles/`. In Vault, listing requires an explicit 'list' capability in the policy, even if 'read' is allowed on sub-paths. Without 'list', the API call to `LIST database/roles/` returns a permission denied error.

Answer

The path `database/roles/` is not a valid path for listing roles

Answer

The database secrets engine is not enabled

Answer

The application needs the 'sudo' capability to list roles

Question 5

A developer wants to store an API key for their application in Vault using the key-value secrets engine. They need to be able to retrieve the key and also roll back to a previous version if needed. Which secrets engine configuration should they use?

Accepted Answer

Enable the KV v2 secrets engine at a custom path. The KV v2 secrets engine supports versioning, allowing retrieval of previous versions and rollback capabilities. This directly meets the requirement to store an API key and revert to an older version if needed. KV v1 does not support versioning, while Transit and Database engines serve different purposes (encryption and dynamic credentials, respectively).

Answer

Enable the Transit secrets engine at a custom path

Answer

Enable the KV v1 secrets engine at a custom path

Answer

Enable the Database secrets engine at a custom path

Question 6

A Vault administrator has enabled the PKI secrets engine and configured a root CA. They now need to issue certificates for multiple internal services, each with its own common name (CN). Which is the most efficient way to issue certificates while maintaining security?

Accepted Answer

Create a separate role for each service with specific allowed domains. Creating a separate role for each service allows you to enforce least-privilege by restricting each role to specific allowed domains (e.g., via `allowed_domains` and `allow_subdomains`). This ensures that each service can only request certificates for its own CN, preventing cross-service impersonation while maintaining efficient, role-based issuance. The PKI secrets engine uses roles to define TTL, key type, and domain constraints, making per-service roles the most secure and manageable approach.

Answer

Create one role with the allow_any_name parameter set to true

Answer

Create one role with a wildcard allowed domain and use the common_name parameter when issuing

Answer

Create one role without any allowed domains and specify the common name in the request

Question 7

An organization uses the AWS secrets engine to generate IAM users for each application. They want to ensure that if a Vault server is compromised, the attacker cannot use the AWS secrets engine configuration to gain access to the AWS account. Which additional security measure should be implemented?

Accepted Answer

Use a non-root IAM user with minimal privileges for the engine and restrict the engine's role policies to the minimum needed. The core principle of least privilege ensures that even if the Vault server is compromised, the attacker can only perform actions allowed by the minimal IAM policy attached to the non-root user. This limits the blast radius, preventing the attacker from gaining full administrative access to the AWS account. The AWS secrets engine uses the configured IAM credentials to create temporary IAM users, so restricting those credentials to only the necessary permissions is the most effective mitigation.

Answer

Enable Vault's seal wrapping to encrypt the engine configuration

Answer

Store the AWS access key used by the engine in a separate Vault instance

Answer

Use a dedicated Vault server for the AWS engine

Question 8

A company needs to generate short-lived, dynamic database credentials for its MySQL instances. Which secrets engine should be configured?

Accepted Answer

Database secrets engine. The Database secrets engine is specifically designed to generate short-lived, dynamic credentials for databases like MySQL. It creates unique, time-bound usernames and passwords on demand, which aligns with the requirement for temporary database access without manual credential management.

Answer

KV secrets engine

Answer

AWS secrets engine

Answer

PKI secrets engine

Question 9

An operator wants to enable the database secrets engine at a custom path 'db-creds'. Which command should be used?

Accepted Answer

vault secrets enable -path=db-creds database. The `vault secrets enable` command with the `-path` flag allows you to mount the database secrets engine at a custom path. The syntax `vault secrets enable -path=db-creds database` correctly specifies the custom path and the engine type, enabling the database secrets engine at the desired location.

Answer

vault secrets enable database

Answer

vault write sys/mounts/db-creds type=database

Answer

vault secrets tune -path=db-creds database

Question 10

A Vault instance was upgraded from version 1.9 to 1.13. After the upgrade, a secrets engine mounted at 'transit/' is unresponsive and returns an error. The engine type is transit. What is the most likely cause?

Accepted Answer

The engine was accidentally disabled during the upgrade. During a Vault upgrade, there is a possibility that the upgrade process inadvertently disables certain secrets engines if there are configuration conflicts or if the engine was enabled using deprecated methods. This is especially likely in major version jumps like from 1.9 to 1.13, where significant changes in the engine management code could lead to such issues. Options B, C, and D are incorrect: namespaces are not altered during upgrades, the transit engine can be mounted at any path, and since transit is built-in, plugin incompatibility does not apply.

Answer

The namespace was changed during the upgrade

Answer

The transit engine can only be mounted at the default path 'transit/'

Answer

The plugin version is incompatible with the new Vault version

Question 11

An organization wants to encrypt data in transit and at rest using a centralized key management system. Which secrets engine is designed for encryption/decryption operations without storing data?

Accepted Answer

Transit secrets engine. The Transit secrets engine performs encryption/decryption operations on data in transit without storing the data itself. It is designed for centralized key management, allowing applications to send plaintext for encryption or ciphertext for decryption via API calls, while the keys remain securely managed within Vault. This makes it ideal for encrypting data in transit and at rest without persisting the data.

Answer

KV secrets engine

Answer

PKI secrets engine

Answer

Database secrets engine

Question 12

A team is adopting Vault and wants to organize secrets by application and environment (e.g., production, staging). What is the best practice for secrets engine path naming?

Accepted Answer

Use hierarchical paths like 'app/env/secret'. Hierarchical paths like 'app/env/secret' are the best practice because they allow Vault's ACL policies to apply fine-grained access control at each level of the path. This structure maps directly to the organization's application and environment boundaries, enabling least-privilege access without complex policy rules. It also simplifies secret rotation and auditing by keeping related secrets logically grouped.

Answer

Use a single path like 'secrets/' for simplicity

Answer

Use the same path for all applications but separate with prefixes like 'app1-'

Answer

Use random UUIDs to avoid guessing

Question 13

A DevOps engineer configures the AWS secrets engine to assume a specific IAM role for generating dynamic credentials. The engine is enabled and the root configuration is set. Which parameter is essential in the role configuration to allow assuming the IAM role?

Accepted Answer

arn. The `arn` parameter is essential in the role configuration for the AWS secrets engine because it specifies the Amazon Resource Name (ARN) of the IAM role that Vault will assume to generate dynamic credentials. Without this parameter, Vault cannot identify which IAM role to assume via AWS STS AssumeRole API, making dynamic credential generation impossible.

Answer

role_type

Answer

credential_type

Answer

inline_policy

Question 14

An administrator wants to view all currently enabled secrets engines and their mount paths. Which command provides this information?

Accepted Answer

vault secrets list. The correct command to list all enabled secrets engines and their mount paths is `vault secrets list` (option B). Option D, `vault read sys/mounts`, is not a valid command in the Vault CLI; the endpoint `sys/mounts` is accessed via `vault secrets list` or by directly reading the path with `vault read sys/mounts` in some contexts, but the CLI command `vault read sys/mounts` does not exist. Options A and C are incorrect: `vault list sys/mounts` is not valid, and `vault secrets show` is not a real command.

Answer

vault list sys/mounts

Answer

vault secrets show

Answer

vault read sys/mounts

Question 15

A developer needs to generate a new certificate for an internal web service using the PKI secrets engine. A role named 'webserver' has been created. What is the correct command to issue the certificate?

Accepted Answer

vault write pki/issue/webserver common_name=web.example.com. The PKI secrets engine uses the path `pki/issue/<role_name>` to issue certificates. The `vault write` command sends a POST request to this endpoint with the required `common_name` parameter, which generates a new certificate signed by the CA associated with the 'webserver' role.

Answer

vault write pki/webserver/issue

Answer

vault write pki/webserver/cert common_name=web.example.com

Answer

vault read pki/cert/webserver