VA-003 Compare and configure secrets engines Practice Test 3 — 15 Questions

Question 1

A company is using Vault's PKI secrets engine to issue certificates for internal services. They have set up a root CA and an intermediate CA. The intermediate CA's certificate expires soon, and they need to renew it. They generate a new intermediate CSR and have it signed by the root CA. After importing the new intermediate certificate, the team notices that certificates issued by the old intermediate are still valid but new certificate requests fail with 'no valid intermediate CA found'. What step did the team likely miss?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

They forgot to set the new intermediate certificate as the issuing CA by writing it to the correct path (e.g., pki/intermediate/set-signed).. In Vault's PKI secrets engine, after the root CA signs a new intermediate certificate, the signed certificate must be explicitly set as the issuing CA by writing it to the `pki/intermediate/set-signed` endpoint. Without this step, Vault still references the old (expiring) intermediate certificate and cannot sign new ones, resulting in the 'no valid intermediate CA found' error. Simply importing the signed certificate is not sufficient; it must be configured as the active issuing CA. Option B is incorrect because failing to update CRL distribution points would affect CRL distribution, not cause a 'no valid intermediate CA found' error during certificate issuance.

Answer

They forgot to update the CRL distribution points on the new intermediate.

Answer

They changed the root CA's key algorithm, causing incompatibility.

Answer

They did not revoke the old intermediate CA before importing the new one.

Question 2

A multi-national company uses Vault's AWS secrets engine to manage access to multiple AWS accounts. They have a central Vault cluster and need to generate IAM users in account A that assume a role in account B for cross-account access. The team has configured the AWS secrets engine with the root credentials of account A. They created a role on the engine that should generate STS credentials for the cross-account role. However, when they try to generate credentials, Vault returns an error: 'AccessDenied: User: arn:aws:iam:::user/vault-user is not authorized to perform: STS:AssumeRole on resource: arn:aws:iam:::role/CrossAccountRole'. What additional configuration is required?

Accepted Answer

Attach an IAM policy to the Vault user in account A that allows sts:AssumeRole on the cross-account role ARN.. The error indicates that the Vault user in account A lacks the IAM permission to call sts:AssumeRole on the cross-account role in account B. Even though the AWS secrets engine is configured with root credentials of account A, the engine uses those credentials to make API calls on behalf of the Vault user. Therefore, you must attach an IAM policy to the Vault user in account A that explicitly allows sts:AssumeRole on the target role ARN in account B. This is a prerequisite for cross-account access via STS.

Answer

Create a new role in the AWS secrets engine that uses the cross-account role ARN directly.

Answer

Change the AWS secrets engine mount path to avoid conflicts.

Answer

Set up AWS federation with SAML to allow cross-account access.

Question 3

Which TWO of the following are correct statements about Vault secrets engines?

Accepted Answer

The Transit secrets engine performs encryption operations without storing the encrypted data.. The Transit secrets engine performs encryption operations such as encrypt, decrypt, sign, and verify without storing the encrypted data. Option C is correct: dynamic secrets engines (e.g., database, AWS) generate credentials on demand with a configurable Time-to-Live (TTL). Option A is incorrect because each secrets engine instance is mounted at a single path; however, the same engine type can be enabled at multiple paths. Option D is incorrect because a KV engine is either version 1 (unversioned) or version 2 (versioned), not both simultaneously. Option E is incorrect because static secrets, such as database static roles, do support rotation to rotate passwords periodically.

Answer

Secrets engines are enabled at a path, and each engine can be mounted at multiple paths.

Answer

The KV secrets engine can be configured to store both versioned and unversioned data simultaneously.

Answer

Static secrets engines do not support rotation.

Question 4

An administrator enables the PKI secrets engine at 'pki/' in Vault and configures a root CA. A developer needs to issue a certificate with a specific common name and a TTL of 30 days. The role 'web-server' allows a maximum TTL of 720h. Which command issues the certificate with the desired TTL?

Accepted Answer

vault write pki/issue/web-server common_name=web.example.com ttl=720h. The PKI secrets engine issues certificates through the issue endpoint on a role. The role defines allowed parameters and limits such as max_ttl. Requesting a TTL within the role's maximum returns a certificate with that TTL. The sign endpoint requires a CSR, root/generate creates a CA, and exceeding max_ttl does not produce the desired result.

Answer

vault write pki/issue/web-server common_name=web.example.com ttl=8760h

Answer

vault write pki/sign/web-server common_name=web.example.com ttl=720h csr=@web.csr

Answer

vault write pki/root/generate/internal common_name=web.example.com ttl=720h

Question 5

A platform team is enabling the PKI secrets engine to issue X.509 certificates for internal services. They need to configure a root CA and then create a role that allows services to request certificates with specific attributes. Which TWO actions are required to allow a service to generate a certificate with a custom common name and a TTL of 24 hours? (Choose two.)

Accepted Answer

Create a role with 'vault write pki/roles/internal allowed_domains=example.com allow_subdomains=true max_ttl=24h'.. To issue certificates with a custom common name and a 24-hour TTL, the PKI secrets engine must have a CA configured and a role that permits such issuance. Generating a root CA creates the signing authority, and creating a role with allowed_domains, allow_subdomains, and max_ttl defines the constraints. These two actions enable the service to request certificates meeting the criteria. Other options are either unnecessary or do not directly fulfill the requirement.

Answer

Enable the PKI secrets engine at the default path using 'vault secrets enable pki'.

Answer

Configure a CA certificate bundle using 'vault write pki/config/ca pem_bundle=@ca_bundle.pem'.

Answer

Set the maximum lease TTL for the PKI secrets engine using 'vault secrets tune -max-lease-ttl=24h pki/'.

Question 6

A security engineer is enabling the Transit secrets engine at 'transit/' to provide encryption as a service. They need to encrypt data that will later be decrypted by a different Vault cluster in a disaster recovery scenario. The engineer wants to export the encryption key so it can be imported into the DR cluster. Which key type should the engineer create to allow the key material to be exported?

Accepted Answer

aes256-gcm96 with exportable set to true. The Transit secrets engine allows certain key types to be exported if the 'exportable' attribute is set to true at creation time. For symmetric encryption keys like 'aes256-gcm96', setting exportable=true permits the key to be exported via the transit export endpoint. This is the only way to move the key material to another cluster; otherwise, the key remains non-exportable and cannot be transferred.

Answer

exportable

Answer

aes256-gcm96

Answer

rsa-2048

Question 7

A healthcare company uses Vault's PKI secrets engine to issue TLS certificates for internal services. They have configured a root CA and an intermediate CA. The security team wants to ensure that certificates issued by the intermediate CA can be automatically renewed without manual intervention, and that revocation information is available to clients. Which TWO actions should the security team take to meet these requirements? (Choose two.)

Accepted Answer

Set up a CRL distribution point in the certificate by configuring the 'crl_distribution_points' parameter on the role or issuer, and ensure the CRL is accessible to clients.. Vault's PKI secrets engine does not provide built-in automatic certificate renewal. To ensure certificates are renewed without manual intervention, an external automation process must be implemented to request new certificates before expiry. For revocation information, configuring CRL distribution points in issued certificates allows clients to retrieve the CRL and check revocation status. Together, these actions meet the requirements.

Answer

Enable the 'auto_renew' option on the PKI mount to automatically reissue certificates when they approach expiry.

Answer

Configure the role to allow certificates to be renewed by setting 'allow_renewal' to true and ensure clients have the necessary policy to call the renew endpoint.

Answer

Configure a role with a short TTL and enable the 'generate_lease' parameter so Vault automatically renews certificates before expiry.

Question 8

A financial institution uses Vault's Transit secrets engine to encrypt sensitive data before storing it in a database. They have created a key named 'payment-key' with type 'rsa-4096' and want to use it for both encryption and signing. A developer attempts to sign a message using the 'transit/sign/payment-key' endpoint but receives an error. The key was created with default parameters. What is the most likely reason for the error?

Accepted Answer

The key was created without the 'signing' capability; keys must be explicitly created with the 'sign' capability to be used for signing.. Vault's Transit engine allows keys to have specific capabilities set at creation. For asymmetric keys like 'rsa-4096', the default capabilities may not include signing. To use the key for signing, it must be created with the 'sign' capability explicitly specified. Without that capability, the sign endpoint will return an error. Rotation or endpoint choice does not resolve the issue.

Answer

The key type 'rsa-4096' does not support signing operations; only elliptic curve keys can sign.

Answer

The 'transit/sign/payment-key' endpoint requires the key to be of type 'ecdsa-p256' or 'ed25519'; RSA keys must use the 'transit/rsa-sign' endpoint instead.

Answer

The key must be rotated before it can be used for signing; new keys are encryption-only until rotated.

Question 9

A DevOps team uses Vault to store database credentials via the database secrets engine. They notice that after the default lease duration, applications receive errors when trying to connect. The team wants to ensure that applications automatically renew leases before expiration. What should they do?

Accepted Answer

Use Vault Agent to renew the secret.. Vault Agent is designed to automatically handle secret renewal and lifecycle management. It runs as a sidecar or daemon that periodically checks the lease duration and renews it before expiration, ensuring applications always have valid credentials without manual intervention or custom scripting.

Answer

Schedule a cron job to periodically read new credentials.

Answer

Set a longer default TTL on the role.

Answer

Set a longer max TTL on the mount.

Question 10

A security team wants to store static secrets like API keys in Vault. They need the secrets to be versioned and support rollback. Which secrets engine should they use?

Accepted Answer

KV v2. KV v2 is the correct choice because it is designed specifically for storing static secrets with built-in versioning and rollback capabilities. Unlike KV v1, which overwrites data without preserving history, KV v2 retains a configurable number of secret versions, allowing administrators to undelete or roll back to a previous version using the `vault kv rollback` command or API calls.

Answer

Cubbyhole

Answer

KV v1

Answer

Transit

Question 11

An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

Accepted Answer

AWS IAM is eventually consistent and the user may take a few seconds to propagate.. AWS IAM is an eventually consistent system. When Vault uses the AWS secrets engine to create an IAM user via the CreateUser API call, the user is not immediately available across all AWS services due to propagation delays. This eventual consistency means the generated IAM user may take a few seconds to be fully usable, which is a known behavior of AWS IAM.

Answer

The Vault write operation failed due to network latency.

Answer

The TTL on the role is too short.

Answer

Vault must wait for the AWS secret key to be rotated before returning the user.

Question 12

A developer wants to use Vault to encrypt sensitive data before storing it in a database. They need to perform encryption and decryption operations without ever exposing the encryption key. Which secrets engine should they use?

Accepted Answer

Transit. The Transit secrets engine is designed specifically for encryption-as-a-service workflows, allowing applications to encrypt and decrypt data using keys managed entirely within Vault. The encryption key never leaves Vault, satisfying the requirement to avoid exposing the key. In contrast, other engines like KV v2 store raw secrets but do not perform cryptographic operations without exposing the key material.

Answer

PKI

Answer

KV v2

Answer

Database

Question 13

Which TWO of the following are valid use cases for the Transit secrets engine? (Select exactly 2.)

Accepted Answer

Signing and verifying data. Option A is correct because the Transit secrets engine provides cryptographic operations as a service, including signing and verifying data via endpoints such as /transit/sign/:name and /transit/verify/:name, so applications can perform signature operations without handling raw signing keys. Option B is correct because Transit supports encryption and decryption through endpoints like /transit/encrypt/:name and /transit/decrypt/:name, allowing data to be encrypted in transit while the encryption key never leaves Vault. Option C is not the intended use case because Transit does not serve as a general-purpose key store; key storage is handled by other engines such as KV or by Vault's key management features, and Transit keys are used for cryptographic operations rather than being retrieved. Option D is incorrect because Transit does not store encrypted data at rest; it only performs encryption/decryption operations, while data storage belongs to engines like KV. Option E is incorrect because X.509 certificate management is handled by the PKI secrets engine, not the Transit secrets engine.

Answer

Storing encryption keys

Answer

Storing encrypted data at rest

Answer

Managing X.509 certificates

Question 14

Which THREE of the following are true about the KV v2 secrets engine? (Select exactly 3.)

Accepted Answer

It supports check-and-set operations for concurrent updates.. Option B is correct because the KV v2 secrets engine supports check-and-set (CAS) operations: when writing a secret you can supply the cas parameter with the expected current version, and the write fails if the version has changed, preventing lost updates during concurrent modifications. Option D is correct because KV v2 stores rich metadata for each secret version, including fields such as created_time, deletion_time, destroyed, and version, retrievable via the metadata endpoint (e.g., GET secret/metadata/<path>). Option E is correct because KV v2's defining feature is versioning: each write creates a new numbered version, allowing retrieval of specific versions and configuration of max_versions. Option A is wrong because KV v2 does support deletion, including soft deletion (delete) and permanent destruction (destroy) of specific versions. Option C is wrong because KV v2 supports undoing changes through versioning: you can read an earlier version and write it back, or use the undelete operation to restore a soft-deleted version.

Answer

It does not support deletion of secrets.

Answer

It does not support undoing changes.

Question 15

A financial services company runs a microservices application on Kubernetes. Each service needs to authenticate to Vault using Kubernetes auth and then read secrets from a shared KV v2 engine mounted at 'shared-kv'. The security team requires that Service-A can only read secrets under 'shared-kv/team-alpha/*' and Service-B can only read secrets under 'shared-kv/team-beta/*'. The Vault administrator has already configured the Kubernetes auth method and created roles for each service with bound service account names. However, both services are currently able to read all paths under 'shared-kv/'. The administrator wants to enforce the least privilege access. Which course of action should the administrator take?

Accepted Answer

Review and update the policy attached to the Kubernetes auth roles to restrict capabilities to the specific paths, e.g., 'path "shared-kv/data/team-alpha/*" { capabilities = ["read"] }'.. The issue is that the policy attached to the Kubernetes auth roles grants read access to the entire 'shared-kv/*' path. By updating the policy to restrict capabilities to specific paths like 'shared-kv/data/team-alpha/*' and 'shared-kv/data/team-beta/*', the administrator enforces least privilege. The 'data' prefix is required for KV v2 engines to access secret data, and the wildcard ensures only the respective team's secrets are readable.

Answer

Configure the Kubernetes auth role to use 'token_policies' with a restrictive policy and ensure the bound service account names are correct.

Answer

Create a new secrets engine for each team and mount them at 'team-alpha' and 'team-beta', then assign each service to its respective engine.

Answer

Add a 'path_deny' capability in the policy for the disallowed paths.