VA-003 Timed Practice Test 2 — 10 Questions

Question 1

Which THREE steps are required to configure the database secrets engine for generating dynamic credentials?

Accepted Answer

Create a role that maps to the database user and permissions. Option A is correct because creating a role is the step that maps a named role in Vault to a database user template and its associated permissions (e.g., SQL statements for creation and revocation). This role definition is what Vault uses to dynamically generate a unique username and password when credentials are requested, ensuring each lease gets a dedicated database account with the specified privileges.

Answer

Configure a policy to allow users to read credentials from the role

Answer

Tune the engine's default TTL

Question 2

A Vault instance was upgraded from version 1.9 to 1.13. After the upgrade, a secrets engine mounted at 'transit/' is unresponsive and returns an error. The engine type is transit. What is the most likely cause?

Accepted Answer

The plugin version is incompatible with the new Vault version. Secrets engines may require plugin binary updates. After a major Vault upgrade, the plugin version may become incompatible. Option B is correct because plugin version incompatibility is a common issue.

Answer

The engine was accidentally disabled during the upgrade

Answer

The namespace was changed during the upgrade

Answer

The transit engine can only be mounted at the default path 'transit/'

Question 3

An organization uses a PostgreSQL database. They configure a database secrets engine with a role that grants read-only access. However, after revoking the lease, the database user still exists. What is the most likely cause?

Accepted Answer

The revocation statement is not configured in the database connection. Option D is correct because when a database secrets engine role is configured in Vault, the revocation statement (e.g., `ALTER USER "{{name}}" NOLOGIN;` or `DROP USER IF EXISTS "{{name}}";`) must be explicitly defined in the database connection's `rotation_statements` or `revocation_statements`. If no revocation statement is set, Vault will successfully create and manage the database user but will not execute any SQL to disable or drop that user when the lease is revoked, leaving the user active in PostgreSQL.

Answer

The database secrets engine does not support revocation

Answer

The role's default_ttl is set too high

Answer

The lease duration is too long

Question 4

Refer to the exhibit. A user deletes the current version of 'secret/myapp' using 'vault kv delete secret/myapp'. What happens to the version?

Accepted Answer

It is deleted and can be undeleted if not destroyed. With default delete_version_after=0s and max_versions=0, deleting a version marks it as deleted but does not destroy it. The version can be undeleted. The cas_required setting affects write operations, not delete. Permanent destruction requires a separate 'destroy' command or automatic cleanup if delete_version_after is set.

Answer

It is destroyed because cas_required is true

Answer

It is permanently deleted immediately

Answer

It is marked as deleted but can be undeleted because cas_required is true

Question 5

Which THREE of the following are true regarding Vault's high availability (HA) and replication? (Choose three.)

Accepted Answer

In an HA cluster with Integrated Storage, only the active node can serve write requests. In an HA cluster with Integrated Storage (Raft), only the active node can serve write requests because Raft ensures strong consistency by requiring all writes to go through the elected leader. The leader replicates the write to a quorum of follower nodes before acknowledging the client, preventing split-brain scenarios. This is a fundamental property of the Raft consensus protocol used by Vault Integrated Storage.

Answer

With Integrated Storage, all nodes can handle write requests

Answer

Disaster Recovery Replication replicates everything including policies and audit logs

Question 6

A Vault cluster has two nodes configured for HA. The active node becomes unresponsive, and the standby node takes over. However, clients cannot connect to the new active node. The firewall rules allow traffic on port 8200. What is the most likely issue?

Accepted Answer

The TLS certificate on the standby node is not valid for the hostname clients are using.. Option A is correct because if the TLS certificate on the standby node does not match the hostname clients use, connections will fail. Option B is wrong because storage backend connectivity is not required for client listener. Option C is wrong because the unseal status is independent of TLS. Option D is wrong because a tainted node would not affect client connections to the active node.

Answer

The standby node cannot connect to the storage backend.

Answer

The original active node is tainted and blocking client requests.

Answer

The standby node is still sealed and cannot serve requests.

Question 7

A Vault cluster configured with auto-unseal using AWS KMS is deployed across two availability zones. After a network partition, the standby node remains sealed while the active node is unsealed and serving requests. What is the most likely reason the standby cannot unseal?

Accepted Answer

The standby node cannot communicate with AWS KMS due to the network partition.. In a Vault cluster with auto-unseal via AWS KMS, each node must independently communicate with AWS KMS to unseal itself. A network partition that isolates the standby node from AWS KMS prevents it from reaching the KMS endpoint, so it cannot decrypt its unseal key and remains sealed. The active node is unaffected because it is already unsealed and serving requests from the other side of the partition.

Answer

The standby node is using the wrong AWS region configuration.

Answer

The active node consumed all available KMS API quota for the region.

Answer

The cluster address on the standby is misconfigured.

Question 8

Given the output from 'vault operator raft list-peers', which node(s) will become unavailable if node1 (leader) experiences a network partition away from all other nodes?

Accepted Answer

Only node1 becomes unavailable; the cluster remains operational with a new leader from node2 or node3. Option A is correct because only node1 is unavailable; the remaining nodes (node2, node3, node4, node5) can still communicate and form quorum (3 voters out of 4, but node4 and node5 are non-voters; only voters count for quorum). Node2 and node3 are voters (2), less than majority of 5 voters? Wait initial voters: node1, node2, node3 are voters (3). If node1 is partitioned, node2 and node3 remain (2 voters out of 3, < majority? Actually quorum requires >50% of voters. With 3 voters, quorum is 2. So node2 and node3 can still form quorum (2 is majority of 3) and elect a new leader. So only node1 becomes unavailable. Option B is wrong because node2 and node3 can still agree. Option C is wrong because non-voters don't affect quorum. Option D is wrong.

Answer

All nodes become unavailable because node1 is the leader

Answer

No nodes become unavailable; node1 remains leader but cannot serve writes

Answer

Node1, node4, and node5 become unavailable

Question 9

A security team is configuring Vault's seal mechanism. They want to ensure that in the event of a data center outage, the Vault cluster can be unsealed without human intervention, but still require approval from multiple administrators to rekey the master key. Which seal type should they use?

Accepted Answer

Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication for any key usage.. Option B is correct because auto-unseal using a cloud KMS allows Vault to unseal automatically after a restart, and the KMS key can be configured to require MFA for cryptographic operations, effectively requiring multiple approvals for rekeying. Option A is wrong because Shamir seals require manual unseal. Option C is wrong because Transit seal requires a running Vault to unseal Vault. Option D is wrong because HSM with quorum still requires manual intervention to unseal.

Answer

Shamir seals with auto-unseal using a cloud KMS.

Answer

HSM seal with a quorum of smart cards.

Answer

Transit seal with a key that requires manual approval from a quorum of operators.

Question 10

A Vault administrator wants to minimize the impact of a single node failure in a three-node Raft cluster. Which TWO actions will help? (Choose two.)

Accepted Answer

Configure monitoring to detect and replace failed nodes quickly.. Configuring `retry_join` allows nodes to automatically rejoin the cluster after failure, and monitoring helps detect and replace failed nodes quickly. Load balancer and performance standby do not address node failure directly.

Answer

Set `disable_clustering` to true.

Answer

Use a load balancer to distribute client requests.

Answer

Enable `performance_standby` on all nodes.