VA-003 Utilize Vault CLI and API — 20 Questions

Question 1

Refer to the exhibit. A user has a token that has the 'default' policy attached. What actions can the user perform on 'secret/data/team'?

Accepted Answer

No actions. The 'default' policy in Vault grants only self-service operations such as token management and limited system capabilities. It does not grant any permissions to read, list, create, update, or delete secrets under 'secret/data/team'. Therefore, a user with only the 'default' policy attached cannot perform any actions on that path. The correct answer is 'No actions'.

Answer

Read only

Answer

Create, read, update, delete, list

Answer

Read and list only

Question 2

An engineer wants to list all secrets under the path 'myapp/' in a KV v2 secrets engine mounted at 'secret/'. Which API call should they make?

Accepted Answer

GET /v1/secret/metadata/myapp/. The correct API call to list secrets under 'myapp/' in a KV v2 secrets engine mounted at 'secret/' is LIST /v1/secret/metadata/myapp/. None of the provided options match this exactly: Option A uses LIST on the data path (incorrect path), Option B uses POST on metadata (wrong method), Option C uses GET on metadata (wrong method unless ?list=true is added, but not specified), and Option D uses GET on the KV v1 path (incorrect for v2). Therefore, no option is correct.

Answer

LIST /v1/secret/data/myapp/

Answer

POST /v1/secret/metadata/myapp/

Answer

GET /v1/secret/myapp/

Question 3

A DevOps engineer needs to write a new secret to the KV v2 engine at path 'secret/data/team' with key 'api_key' and value 'abc123'. Which Vault CLI command achieves this?

Accepted Answer

vault kv put secret/team api_key=abc123. The KV v2 engine automatically prefixes the path with 'data/' when using the 'vault kv put' command. The correct path for writing a secret to the KV v2 engine is 'secret/data/team', but the CLI command 'vault kv put secret/team api_key=abc123' handles this internally by appending '/data/' to the path. This is a key difference from the 'vault write' command, which requires the full path including 'data/'.

Answer

vault kv put secret/data/team api_key=abc123

Answer

vault write secret/data/team api_key=abc123

Answer

vault write secret/team api_key=abc123

Question 4

An admin wants to list all enabled authentication methods using the Vault API. Which curl command is correct?

Accepted Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auth. The Vault API endpoint to list all enabled authentication methods is a GET request to `/v1/sys/auth`. This endpoint returns a map of all enabled auth methods, and the command uses the correct HTTP method (GET) and the required `X-Vault-Token` header for authentication.

Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auths

Answer

curl -X POST -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auth

Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/auth

Question 5

A user wants to log in using the userpass auth method with username 'jdoe' and password 'p@ssw0rd'. What is the correct API endpoint and request?

Accepted Answer

POST /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}. The userpass auth method in Vault requires a POST request to the login endpoint with the password provided in the JSON body. Option D correctly uses POST /v1/auth/userpass/login/jdoe with {"password":"p@ssw0rd"}, which matches the Vault API specification for authenticating against a userpass backend.

Answer

GET /v1/auth/userpass/login/jdoe with header "password: p@ssw0rd"

Answer

PUT /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}

Answer

POST /v1/auth/userpass/login/jdoe?password=p@ssw0rd

Question 6

A security team needs to create a token with a custom TTL of 1 hour and associate it with a policy named 'read-only'. Which Vault CLI command accomplishes this?

Accepted Answer

vault token create -policy=read-only -ttl=1h. Both `vault token create -policy=read-only -ttl=1h` and `vault token create -policy=read-only -ttl 1h` are valid Vault CLI commands that create a token with the specified policy and TTL. The CLI parser accepts both the equals sign and space syntax for string flags. Therefore, both options A and C accomplish the task.

Answer

vault write auth/token/create policies=read-only ttl=1h

Answer

vault create token -policy=read-only -ttl=1h

Question 7

An operator wants to enable the AWS auth method at the default path. Which curl command is correct?

Accepted Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws. Enabling an auth method at the default path requires a POST request to the `/v1/sys/auth/aws` endpoint with a JSON payload containing the `type` field set to `"aws"`. The POST method is used to create a new mount, and the trailing slash is optional but accepted. The `X-Vault-Token` header provides the necessary authentication token.

Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws/

Answer

curl -X PUT -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws

Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"method":"aws"}' https://vault:8200/v1/sys/auth/aws

Question 8

Which TWO of the following are valid methods to authenticate to Vault using the CLI?

Accepted Answer

vault login -method=userpass username=jdoe. `vault login -method=userpass username=jdoe` is the valid CLI command to authenticate using the userpass auth method, which prompts for the password interactively. Option E is correct because `vault login -method=ldap username=jdoe` is the valid CLI command to authenticate using the LDAP auth method, also prompting for the password. Both commands follow the standard `vault login -method=<type>` syntax required by the Vault CLI.

Answer

vault auth -method=token token=s.abc

Answer

vault authenticate -method=userpass username=jdoe

Answer

Setting environment variable VAULT_AUTH=s.abc

Question 9

Which THREE of the following are correct about using the Vault API to read a secret from KV v2 engine?

Accepted Answer

The response JSON contains a 'data' key with the secret values. The KV v2 engine returns secret data nested under a 'data' key in the JSON response. This is a deliberate design to separate metadata (e.g., version, created_time) from the actual secret values, which are placed under 'data.data'. The Vault API always uses GET for reading secrets from KV v2, making option B correct. Option E is correct because the KV v2 engine requires the path to include '/data/' after the mount point (e.g., /v1/secret/data/mysecret) to distinguish read operations from metadata or delete operations.

Answer

The API path is /v1/secret/mysecret

Answer

The HTTP method used is POST

Question 10

Refer to the exhibit. A developer ran the command and received the JSON output. Which command would retrieve only the value of 'api_key' in plain text?

Accepted Answer

vault read -field=data.api_key secret/data/team. The `vault read` command with `-field=data.api_key` uses dot notation to navigate the nested JSON structure returned by the KV v2 secrets engine at `secret/data/team`. The KV v2 engine wraps the actual data under a `data` key, so to extract the `api_key` value directly, you must specify the full path `data.api_key`. Without this, the command would either fail or return the entire JSON object.

Answer

vault read -field=api_key secret/team

Answer

vault read -field=api_key secret/data/team

Answer

vault read secret/data/team

Question 11

You are a Vault administrator for a large organization. Your team uses a centralized Vault cluster with multiple auth methods enabled, including userpass, LDAP, and approle. Recently, a developer reported that they are unable to authenticate using their userpass credentials, receiving the error 'permission denied'. The developer confirms the username and password are correct. Other developers using userpass can authenticate successfully. The Vault audit logs show that the authentication request for this developer is reaching Vault but failing with 'invalid password'. You have verified that the password is correct by resetting it via the Vault CLI. The developer's userpass entry exists and is not disabled. Which of the following is the most likely cause and correct course of action?

Accepted Answer

The developer's account is locked due to too many failed login attempts. The admin should unlock the account using 'vault write auth/userpass/users//unlock'.. Vault's userpass auth method supports account locking after a configurable number of failed login attempts (default is 0, meaning no lockout, but if set to a positive integer via `max_attempts`, the account becomes locked). The audit log shows 'invalid password' despite the password being verified as correct, and other users can authenticate, which points to a lockout rather than a password or user entry issue. The admin can unlock the account using `vault write auth/userpass/users//unlock` to restore access.

Answer

The developer's user entry is disabled. The admin should enable it using 'vault write auth/userpass/users/<username>/enable'.

Answer

The developer's password has expired. The admin should update the password with a new one.

Answer

The developer's password hash is corrupted. The admin should delete and recreate the user entry.

Question 12

Which TWO of the following Vault CLI commands can be used to write data to Vault?

Accepted Answer

vault write. `vault write` is the primary Vault CLI command for writing data directly to a specified path, including secrets, policies, or configuration. Option E is correct because `vault kv put` is the dedicated command for writing key-value pairs to the KV secrets engine, which is a common use case for storing secret data.

Answer

vault set

Answer

vault put

Answer

vault push

Question 13

A DevOps engineer is tasked with automating the rotation of a static secret stored in Vault's KV secrets engine (version 2). The secret is currently stored at path 'secret/data/app/config' with keys 'username' and 'password'. The engineer wants to update the 'password' key using the Vault CLI from a CI/CD pipeline. The pipeline uses a token with a policy that grants 'create', 'update', and 'read' capabilities on 'secret/data/app/*'. Which CLI command should the engineer use to update only the 'password' key, leaving other keys unchanged?

Accepted Answer

vault kv patch secret/data/app/config password=newpass. `vault kv patch` is specifically designed for KV v2 secrets engines to update individual keys without overwriting other keys. It performs a read-modify-write operation under the hood, sending a PATCH request to the API, which only modifies the specified fields. The policy grants 'create', 'update', and 'read' on 'secret/data/app/*', which aligns with the required capabilities for patching.

Answer

vault kv put secret/data/app/config password=newpass

Answer

vault update secret/data/app/config password=newpass

Answer

vault write secret/data/app/config password=newpass

Question 14

A DevOps engineer is troubleshooting a Vault CLI command that is failing with the error 'Error writing data: Error making API request'. The engineer has verified that the Vault token is valid and unexpired. Which of the following is the most likely cause of this error?

Accepted Answer

The policy attached to the token does not allow writing to the specified path.. The error 'Error writing data: Error making API request' with a valid, unexpired token typically indicates an authorization failure. Vault enforces policy-based access control; if the token's attached policy does not include a 'write' or 'create' capability on the specified path, the API will reject the request with this generic error. Since the token is valid and not revoked, the most likely cause is insufficient permissions.

Answer

The Vault token has been revoked.

Answer

Network connectivity to Vault is intermittent, causing timeouts.

Answer

The secret engine at that path has not been enabled.

Question 15

A company uses Vault to manage secrets for multiple applications. A new security policy requires that all human users authenticate using LDAP and that all machine-to-machine authentication uses AppRole. An administrator has configured an LDAP auth method at 'ldap/' and an AppRole at 'approle/'. The administrator creates a role 'web-app' with a secret ID TTL of 30 days and a token TTL of 1 hour. After deploying the web application, the application successfully logs in using the AppRole role ID and secret ID, retrieves a token, and reads secrets. However, after 1 hour, the application begins receiving 'permission denied' errors when trying to read secrets. The application logs show that it is using the same token obtained during initial login. Which action should the administrator take to resolve this issue?

Accepted Answer

Configure the application to renew the token before it expires by calling the 'auth/token/renew' endpoint.. The application's token has a TTL of 1 hour, and once it expires, Vault will reject any further requests using that token. The application must renew the token before it expires by calling the 'auth/token/renew' endpoint, which extends the token's lifetime (up to the maximum TTL configured on the role). This is the standard pattern for long-running applications using short-lived tokens.

Answer

Increase the secret ID TTL to 60 days so the application can re-authenticate less frequently.

Answer

Set the token TTL to 0 (unlimited) so the token never expires.

Answer

Have the application re-authenticate with the AppRole using the same secret ID after the token expires.

Question 16

Drag and drop the steps to set up Vault's Transit secrets engine for encryption/decryption into the correct order.

Accepted Answer

Enable the transit secrets engine, create a key, encrypt data, decrypt data, rotate the key. The correct order is to first enable the Transit secrets engine, then create a key, use the key to encrypt and decrypt data, and finally rotate the key for security. Enabling creates the path, key creation provides the encryption material, and rotation updates the key without interrupting operations.

Answer

Create a key, enable the transit secrets engine, encrypt data, decrypt data, rotate the key

Answer

Enable the transit secrets engine, create a key, rotate the key, encrypt data, decrypt data

Answer

Enable the transit secrets engine, encrypt data, create a key, decrypt data, rotate the key

Question 17

Match each Vault policy capability to its permission.

Accepted Answer

create: Allows creating data at the path.. The correct matches are: create allows creating data, read allows reading data, update allows updating data, and delete allows deleting data. Common confusions involve swapping create and read capabilities.

Answer

create: Allows reading data at the path.

Answer

read: Allows creating data at the path.

Question 18

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 19

An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?

Accepted Answer

PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}. Creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.

Answer

POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}

Answer

POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}

Answer

PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}

Question 20

A user receives 'permission denied' when running 'vault write secret/data/myapp value=123'. The user's token has a policy that includes 'path "secret/data/*" { capabilities = ["read", "list"] }'. What is the most likely cause?

Accepted Answer

The path requires create or update capability.. The user's policy grants only 'read' and 'list' capabilities on the path 'secret/data/*'. The 'vault write' command requires either 'create' or 'update' capability (or both) on the path. Since the policy lacks these capabilities, Vault returns a 'permission denied' error, even though the token is valid and the secret engine is mounted.

Answer

The user is not authenticated.

Answer

The secret engine is not mounted.

Answer

The token is expired.