VA-003 Compare and configure secrets engines — Timed 10 Questions

Question 1

A DevOps team uses Vault to store database credentials via the database secrets engine. They notice that after the default lease duration, applications receive errors when trying to connect. The team wants to ensure that applications automatically renew leases before expiration. What should they do?

Accepted Answer

Use Vault Agent to renew the secret.. Option C is correct because Vault Agent is designed to automatically handle secret renewal and lifecycle management. It runs as a sidecar or daemon that periodically checks the lease duration and renews it before expiration, ensuring applications always have valid credentials without manual intervention or custom scripting.

Answer

Schedule a cron job to periodically read new credentials.

Answer

Set a longer default TTL on the role.

Answer

Set a longer max TTL on the mount.

Question 2

A security team wants to store static secrets like API keys in Vault. They need the secrets to be versioned and support rollback. Which secrets engine should they use?

Accepted Answer

KV v2. KV v2 is the correct choice because it is designed specifically for storing static secrets with built-in versioning and rollback capabilities. Unlike KV v1, which overwrites data without preserving history, KV v2 retains a configurable number of secret versions, allowing administrators to undelete or roll back to a previous version using the `vault kv rollback` command or API calls.

Answer

Cubbyhole

Answer

KV v1

Answer

Transit

Question 3

An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

Accepted Answer

AWS IAM is eventually consistent and the user may take a few seconds to propagate.. Option D is correct because AWS IAM is an eventually consistent system. When Vault uses the AWS secrets engine to create an IAM user via the CreateUser API call, the user is not immediately available across all AWS services due to propagation delays. This eventual consistency means the generated IAM user may take a few seconds to be fully usable, which is a known behavior of AWS IAM.

Answer

The Vault write operation failed due to network latency.

Answer

The TTL on the role is too short.

Answer

Vault must wait for the AWS secret key to be rotated before returning the user.

Question 4

A company is using the PKI secrets engine to issue certificates for internal services. They want to ensure that certificates are automatically revoked if a service is decommissioned. What should they implement?

Accepted Answer

Use Vault's built-in lifecycle management and revocation capabilities.. Option B is correct because Vault's PKI secrets engine includes built-in lifecycle management that can automatically revoke certificates when a lease expires or when a secret is deleted via the API. This allows you to tie certificate validity to the service's lifecycle in Vault, ensuring decommissioned services have their certificates revoked without manual intervention.

Answer

Implement certificate pinning in all services.

Answer

Set a very short TTL on certificates so they expire quickly.

Answer

Configure a Certificate Revocation List (CRL) that clients check.

Question 5

A developer wants to use Vault to encrypt sensitive data before storing it in a database. They need to perform encryption and decryption operations without ever exposing the encryption key. Which secrets engine should they use?

Accepted Answer

Transit. The Transit secrets engine is designed specifically for encryption-as-a-service workflows, allowing applications to encrypt and decrypt data using keys managed entirely within Vault. The encryption key never leaves Vault, satisfying the requirement to avoid exposing the key. In contrast, other engines like KV v2 store raw secrets but do not perform cryptographic operations without exposing the key material.

Answer

PKI

Answer

KV v2

Answer

Database

Question 6

A company has multiple Vault clusters in different regions. They want to use the replication feature to synchronise secrets across clusters. However, they want to exclude a specific secrets engine from replication for compliance reasons. What should they do?

Accepted Answer

Use performance replication and configure a mount filter.. Performance replication in Vault allows you to replicate secret data across clusters while using mount filters to include or exclude specific secrets engines. This is the correct approach because mount filters are designed precisely for this use case, enabling selective replication to meet compliance requirements without creating separate infrastructure.

Answer

Create a separate Vault cluster for that secrets engine.

Answer

Disable replication on that specific mount.

Answer

Use disaster recovery (DR) replication and exclude the mount.

Question 7

An administrator configured the database secrets engine with PostgreSQL. When an application requests credentials, Vault returns a username and password. However, the application reports that the credentials are not working. What is the most likely cause?

Accepted Answer

The database user used by Vault does not have sufficient privileges to create users.. The most likely cause is that the database user configured in Vault lacks the necessary privileges to create new database users. When Vault generates dynamic credentials, it uses its own database connection (the root or management user) to execute `CREATE USER` and `GRANT` statements. If that user does not have the `CREATEROLE` or `SUPERUSER` attribute (or equivalent `CREATE USER` privilege in PostgreSQL), the credential creation fails silently or produces unusable credentials, even though Vault returns a username and password.

Answer

The TTL on the role is set too low.

Answer

The connection string provided to Vault is incorrect.

Answer

The generated credentials were revoked by Vault before the application used them.

Question 8

A team wants to store configuration data such as feature flags in Vault. They need to be able to list all keys under a path. Which secrets engine supports listing?

Accepted Answer

KV v1. The KV v1 secrets engine stores key-value pairs and supports listing all keys under a path via the LIST operation (e.g., `vault list secret/`). This is because KV v1 maintains a flat, non-versioned directory structure that allows enumeration of keys. The team's requirement to list all keys under a path is directly satisfied by KV v1's inherent listing capability.

Answer

Transit

Answer

Cubbyhole

Answer

PKI

Question 9

Which TWO of the following are valid use cases for the Transit secrets engine? (Select exactly 2.)

Accepted Answer

Signing and verifying data. The Transit secrets engine is designed to perform cryptographic operations on data without exposing the encryption keys to the client. Option A is correct because the engine supports signing and verifying data using HMAC or asymmetric keys, allowing clients to verify integrity and authenticity without handling the private key. Option B is correct because the engine can encrypt data in transit (e.g., via API calls) while the encryption key remains securely stored within Vault, never leaving the server.

Answer

Storing encryption keys

Answer

Storing encrypted data at rest

Answer

Managing X.509 certificates

Question 10

Which THREE of the following are true about the KV v2 secrets engine? (Select exactly 3.)

Accepted Answer

It supports check-and-set operations for concurrent updates.. Option B is correct because KV v2 supports check-and-set (CAS) operations via the `cas` parameter in the write path. CAS ensures that a write only succeeds if the current version matches the expected value, preventing concurrent overwrites and providing optimistic locking for secret updates.

Answer

It does not support deletion of secrets.

Answer

It does not support undoing changes.