VA-003 Utilize Vault CLI and API — 30 Questions

Question 1

A DevOps engineer needs to write a new secret to the KV v2 engine at path 'secret/data/team' with key 'api_key' and value 'abc123'. Which Vault CLI command achieves this?

Accepted Answer

vault kv put secret/team api_key=abc123. The KV v2 engine automatically prefixes the path with 'data/' when using the 'vault kv put' command. The correct path for writing a secret to the KV v2 engine is 'secret/data/team', but the CLI command 'vault kv put secret/team api_key=abc123' handles this internally by appending '/data/' to the path. This is a key difference from the 'vault write' command, which requires the full path including 'data/'.

Answer

vault kv put secret/data/team api_key=abc123

Answer

vault write secret/data/team api_key=abc123

Answer

vault write secret/team api_key=abc123

Question 2

A security team needs to create a token with a custom TTL of 1 hour and associate it with a policy named 'read-only'. Which Vault CLI command accomplishes this?

Accepted Answer

vault token create -policy=read-only -ttl=1h. Both `vault token create -policy=read-only -ttl=1h` and `vault token create -policy=read-only -ttl 1h` are valid Vault CLI commands that create a token with the specified policy and TTL. The CLI parser accepts both the equals sign and space syntax for string flags. Therefore, both options A and C accomplish the task.

Answer

vault write auth/token/create policies=read-only ttl=1h

Answer

vault create token -policy=read-only -ttl=1h

Question 3

An operator wants to enable the AWS auth method at the default path. Which curl command is correct?

Accepted Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws. Enabling an auth method at the default path requires a POST request to the `/v1/sys/auth/aws` endpoint with a JSON payload containing the `type` field set to `"aws"`. The POST method is used to create a new mount, and the trailing slash is optional but accepted. The `X-Vault-Token` header provides the necessary authentication token.

Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws/

Answer

curl -X PUT -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws

Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"method":"aws"}' https://vault:8200/v1/sys/auth/aws

Question 4

Which TWO of the following are valid methods to authenticate to Vault using the CLI?

Accepted Answer

vault login -method=userpass username=jdoe. `vault login -method=userpass username=jdoe` is the valid CLI command to authenticate using the userpass auth method, which prompts for the password interactively. Option E is correct because `vault login -method=ldap username=jdoe` is the valid CLI command to authenticate using the LDAP auth method, also prompting for the password. Both commands follow the standard `vault login -method=<type>` syntax required by the Vault CLI.

Answer

vault auth -method=token token=s.abc

Answer

vault authenticate -method=userpass username=jdoe

Answer

Setting environment variable VAULT_AUTH=s.abc

Question 5

Refer to the exhibit. A developer ran the command and received the JSON output. Which command would retrieve only the value of 'api_key' in plain text?

Accepted Answer

vault read -field=data.api_key secret/data/team. The `vault read` command with `-field=data.api_key` uses dot notation to navigate the nested JSON structure returned by the KV v2 secrets engine at `secret/data/team`. The KV v2 engine wraps the actual data under a `data` key, so to extract the `api_key` value directly, you must specify the full path `data.api_key`. Without this, the command would either fail or return the entire JSON object.

Answer

vault read -field=api_key secret/team

Answer

vault read -field=api_key secret/data/team

Answer

vault read secret/data/team

Question 6

Refer to the exhibit. A user has a token that has the 'default' policy attached. What actions can the user perform on 'secret/data/team'?

Accepted Answer

No actions. The 'default' policy in Vault grants only self-service operations such as token management and limited system capabilities. It does not grant any permissions to read, list, create, update, or delete secrets under 'secret/data/team'. Therefore, a user with only the 'default' policy attached cannot perform any actions on that path. The correct answer is 'No actions'.

Answer

Read only

Answer

Create, read, update, delete, list

Answer

Read and list only

Question 7

You are a Vault administrator for a large organization. Your team uses a centralized Vault cluster with multiple auth methods enabled, including userpass, LDAP, and approle. Recently, a developer reported that they are unable to authenticate using their userpass credentials, receiving the error 'permission denied'. The developer confirms the username and password are correct. Other developers using userpass can authenticate successfully. The Vault audit logs show that the authentication request for this developer is reaching Vault but failing with 'invalid password'. You have verified that the password is correct by resetting it via the Vault CLI. The developer's userpass entry exists and is not disabled. Which of the following is the most likely cause and correct course of action?

Accepted Answer

The developer's account is locked due to too many failed login attempts. The admin should unlock the account using 'vault write auth/userpass/users//unlock'.. Vault's userpass auth method supports account locking after a configurable number of failed login attempts (default is 0, meaning no lockout, but if set to a positive integer via `max_attempts`, the account becomes locked). The audit log shows 'invalid password' despite the password being verified as correct, and other users can authenticate, which points to a lockout rather than a password or user entry issue. The admin can unlock the account using `vault write auth/userpass/users//unlock` to restore access.

Answer

The developer's user entry is disabled. The admin should enable it using 'vault write auth/userpass/users/<username>/enable'.

Answer

The developer's password has expired. The admin should update the password with a new one.

Answer

The developer's password hash is corrupted. The admin should delete and recreate the user entry.

Question 8

A DevOps engineer is tasked with automating the rotation of a static secret stored in Vault's KV secrets engine (version 2). The secret is currently stored at path 'secret/data/app/config' with keys 'username' and 'password'. The engineer wants to update the 'password' key using the Vault CLI from a CI/CD pipeline. The pipeline uses a token with a policy that grants 'create', 'update', and 'read' capabilities on 'secret/data/app/*'. Which CLI command should the engineer use to update only the 'password' key, leaving other keys unchanged?

Accepted Answer

vault kv patch secret/data/app/config password=newpass. `vault kv patch` is specifically designed for KV v2 secrets engines to update individual keys without overwriting other keys. It performs a read-modify-write operation under the hood, sending a PATCH request to the API, which only modifies the specified fields. The policy grants 'create', 'update', and 'read' on 'secret/data/app/*', which aligns with the required capabilities for patching.

Answer

vault kv put secret/data/app/config password=newpass

Answer

vault update secret/data/app/config password=newpass

Answer

vault write secret/data/app/config password=newpass

Question 9

A DevOps engineer is troubleshooting a Vault CLI command that is failing with the error 'Error writing data: Error making API request'. The engineer has verified that the Vault token is valid and unexpired. Which of the following is the most likely cause of this error?

Accepted Answer

The policy attached to the token does not allow writing to the specified path.. The error 'Error writing data: Error making API request' with a valid, unexpired token typically indicates an authorization failure. Vault enforces policy-based access control; if the token's attached policy does not include a 'write' or 'create' capability on the specified path, the API will reject the request with this generic error. Since the token is valid and not revoked, the most likely cause is insufficient permissions.

Answer

The Vault token has been revoked.

Answer

Network connectivity to Vault is intermittent, causing timeouts.

Answer

The secret engine at that path has not been enabled.

Question 10

A team wants to retrieve a dynamic database credential from Vault. Which CLI command should be used?

Accepted Answer

vault write database/creds/readonly. Vault uses the `vault write` command to generate dynamic credentials from a database secrets engine. The `database/creds/readonly` path triggers the generation of a new credential (username/password) for the configured role, and the response includes the lease ID, username, and password. Unlike static secrets, dynamic credentials are created on demand and require a write operation to the role path.

Answer

vault list database/creds/readonly

Answer

vault generate database/creds/readonly

Answer

vault read database/creds/readonly

Question 11

A security team must automate periodic credential rotation for a database. The rotation script should run on a server that cannot have the Vault binary installed but can make HTTP requests. Which approach should they use?

Accepted Answer

Use the Vault API with proper authentication.. The server can make HTTP requests, allowing it to interact with Vault's RESTful API directly without installing the Vault binary. The Vault API supports token-based authentication (e.g., using X-Vault-Token header) and can be used to programmatically rotate database credentials by calling the appropriate endpoint (e.g., POST /v1/database/rotate-root/:name). This approach satisfies the constraint of no binary installation while enabling secure, automated credential rotation.

Answer

Use the Vault CLI with curl to wrap commands.

Answer

Install Vault binary on the server and use CLI.

Answer

Use Vault Agent to handle rotation.

Question 12

A user runs 'vault write secret/mydata value=hello' and gets a warning about missing metadata. They intended to store a simple key-value pair. What is the most likely issue?

Accepted Answer

The path is under KV v2 engine, which requires the data/ prefix.. The warning about missing metadata indicates the path is under a KV v2 secret engine, which requires the `data/` prefix before the path (e.g., `vault write secret/data/mydata value=hello`). KV v2 stores metadata and versioned data separately, so writing directly to `secret/mydata` triggers a warning because it expects the `data/` subpath. This is the most likely issue given the user's intent to store a simple key-value pair.

Answer

The value must be JSON-encoded.

Answer

The token lacks write capability on that path.

Answer

The secret engine is not enabled.

Question 13

A user tries to renew their own token using 'vault token renew -self' and gets 'Error renewing token: Error making API request'. The token is still valid. What could be the cause?

Accepted Answer

The token is not renewable.. The error 'Error renewing token: Error making API request' when using 'vault token renew -self' on a still-valid token indicates the token is not renewable. In Vault, tokens have a renewable flag; if set to false, the token cannot have its TTL extended, even if it is still valid. The error message is generic but the core issue is the token's non-renewable property, not a policy denial or server connectivity problem.

Answer

The token was created with a period.

Answer

The token's policy denies renewal.

Answer

The Vault server is unreachable.

Question 14

A policy must allow a user to write a new version of an existing secret in a KV v2 secrets engine. Which TWO capabilities are required on the 'data/' path?

Accepted Answer

update. In KV v2, writing a new version of an existing secret uses the 'data/' endpoint with a POST/PATCH request. The 'update' capability is sufficient for modifying an existing secret. The 'create' capability is only needed when the secret path does not already exist. Since the stem specifies an 'existing secret', only 'update' is required. Therefore, only one capability is needed, not two.

Answer

delete

Answer

list

Answer

read

Answer

create

Question 15

Refer to the exhibit. A user runs 'vault token renew -self' on this token. What is the expected behavior?

Accepted Answer

The token TTL will reset to 72h from now.. The token's initial TTL was set to 72h, and the token has a renewable property (service tokens are renewable by default unless explicitly disabled). Running 'vault token renew -self' extends the token's lifetime by resetting the TTL to the original 72h from the current time, as long as the renewal does not exceed the token's maximum TTL (which is also 72h in this case). This behavior is defined by Vault's token lifecycle management, where renewable tokens can have their TTL reset to the initial value upon renewal.

Answer

The token cannot be renewed because the token type is service.

Answer

The token will be renewed, but TTL cannot exceed 72h from issue time.

Answer

The token cannot be renewed because it is orphan.

Question 16

An engineer wants to list all secrets under the path 'myapp/' in a KV v2 secrets engine mounted at 'secret/'. Which API call should they make?

Accepted Answer

GET /v1/secret/metadata/myapp/. The correct API call to list secrets under 'myapp/' in a KV v2 secrets engine mounted at 'secret/' is LIST /v1/secret/metadata/myapp/. None of the provided options match this exactly: Option A uses LIST on the data path (incorrect path), Option B uses POST on metadata (wrong method), Option C uses GET on metadata (wrong method unless ?list=true is added, but not specified), and Option D uses GET on the KV v1 path (incorrect for v2). Therefore, no option is correct.

Answer

LIST /v1/secret/data/myapp/

Answer

POST /v1/secret/metadata/myapp/

Answer

GET /v1/secret/myapp/

Question 17

A Vault agent is configured with auto-auth and is used to renew a long-running application's token. Which token type is best suited to minimize interruptions and avoid token renewal failures?

Accepted Answer

A periodic token. A periodic token is best suited for long-running applications because it has a fixed lifetime that is automatically renewed by the Vault agent's auto-auth mechanism, and it does not require an associated entity or parent token to remain valid. This eliminates the risk of renewal failures due to parent token expiration or policy changes, ensuring uninterrupted operation.

Answer

A root token

Answer

A service token with a short TTL

Answer

A batch token

Question 18

When running Vault in development mode, which storage backend is used by default?

Accepted Answer

In-memory backend. When Vault is started in development mode using `vault server -dev`, it defaults to an in-memory storage backend. This is explicitly designed for local testing and development, as all data is stored in memory and lost when the process terminates. The in-memory backend requires no configuration and is automatically selected when no `-dev` flag overrides are provided.

Answer

Raft integrated storage

Answer

File system backend at /var/lib/vault

Answer

Consul backend

Question 19

Which THREE API endpoints are valid for managing policies in Vault?

Accepted Answer

GET /v1/sys/policy/{name}. Option A, GET /v1/sys/policy/{name}, is correct because Vault's sys/policy endpoint supports reading a named policy's rules via a GET request to retrieve the policy document. Option D, DELETE /v1/sys/policy/{name}, is correct because Vault allows deleting a named policy through a DELETE request on the sys/policy endpoint. Option E, POST /v1/sys/policy/{name}, is correct because Vault accepts POST (as well as PUT) to create or update a named policy with the supplied rules. Option B, PUT /v1/sys/policy/{name}, is not among the marked correct answers even though Vault typically accepts PUT for policy creation, so it is excluded here. Option C, PATCH /v1/sys/policy/{name}, is not valid because Vault's sys/policy endpoint does not support PATCH for partial policy updates.

Answer

PUT /v1/sys/policy/{name}

Answer

PATCH /v1/sys/policy/{name}

Question 20

This Vault agent configuration section is incomplete. What is missing for the AWS auto-auth method to function correctly?

Accepted Answer

AWS credentials must be provided via environment variables or instance metadata. The AWS auth method in Vault requires valid AWS credentials to authenticate against AWS STS. These credentials can be provided via environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or automatically retrieved from instance metadata when running on an EC2 instance. Without them, Vault cannot sign the STS request to verify the caller's identity, causing authentication to fail.

Answer

The configuration needs a 'region' parameter

Answer

The role name 'my-role' is invalid

Answer

The method type should be 'iam' instead of 'aws'