VA-003 Utilize Vault CLI and API Practice Test 2 — 15 Questions

Question 1

Match each Vault policy capability to its permission.

Question 2

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. Option A is correct because `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 3

An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?

Accepted Answer

PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}. Option C is correct because creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.

Answer

POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}

Answer

POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}

Answer

PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}

Question 4

A user receives 'permission denied' when running 'vault write secret/data/myapp value=123'. The user's token has a policy that includes 'path "secret/data/*" { capabilities = ["read", "list"] }'. What is the most likely cause?

Accepted Answer

The path requires create or update capability.. The user's policy grants only 'read' and 'list' capabilities on the path 'secret/data/*'. The 'vault write' command requires either 'create' or 'update' capability (or both) on the path. Since the policy lacks these capabilities, Vault returns a 'permission denied' error, even though the token is valid and the secret engine is mounted.

Answer

The user is not authenticated.

Answer

The secret engine is not mounted.

Answer

The token is expired.

Question 5

A team wants to retrieve a dynamic database credential from Vault. Which CLI command should be used?

Accepted Answer

vault write database/creds/readonly. Option C is correct because Vault uses the `vault write` command to generate dynamic credentials from a database secrets engine. The `database/creds/readonly` path triggers the generation of a new credential (username/password) for the configured role, and the response includes the lease ID, username, and password. Unlike static secrets, dynamic credentials are created on demand and require a write operation to the role path.

Answer

vault list database/creds/readonly

Answer

vault generate database/creds/readonly

Answer

vault read database/creds/readonly

Question 6

An administrator wants to mount the AWS secrets engine at 'aws' path using the API. Which request is correct?

Accepted Answer

POST /v1/sys/mounts/aws with body {"type":"aws"}. Option C is correct because mounting a secrets engine in Vault is performed via a POST request to the `/v1/sys/mounts/<path>` endpoint with a JSON body containing the `"type"` field set to the engine's type identifier. For the AWS secrets engine, the type is `"aws"`, and the path is specified in the URL as `aws`. The POST method is required for creating a new mount, while PUT is used for tuning an existing mount.

Answer

PUT /v1/sys/mounts/aws with body {"type":"aws"}

Answer

POST /v1/sys/auth/aws with body {"type":"aws"}

Answer

POST /v1/sys/mounts/aws with body {"type":"aws-secrets"}

Question 7

A security team must automate periodic credential rotation for a database. The rotation script should run on a server that cannot have the Vault binary installed but can make HTTP requests. Which approach should they use?

Accepted Answer

Use the Vault API with proper authentication.. Option C is correct because the server can make HTTP requests, allowing it to interact with Vault's RESTful API directly without installing the Vault binary. The Vault API supports token-based authentication (e.g., using X-Vault-Token header) and can be used to programmatically rotate database credentials by calling the appropriate endpoint (e.g., POST /v1/database/rotate-root/:name). This approach satisfies the constraint of no binary installation while enabling secure, automated credential rotation.

Answer

Use the Vault CLI with curl to wrap commands.

Answer

Install Vault binary on the server and use CLI.

Answer

Use Vault Agent to handle rotation.

Question 8

A user runs 'vault write secret/mydata value=hello' and gets a warning about missing metadata. They intended to store a simple key-value pair. What is the most likely issue?

Accepted Answer

The path is under KV v2 engine, which requires the data/ prefix.. The warning about missing metadata indicates the path is under a KV v2 secret engine, which requires the `data/` prefix before the path (e.g., `vault write secret/data/mydata value=hello`). KV v2 stores metadata and versioned data separately, so writing directly to `secret/mydata` triggers a warning because it expects the `data/` subpath. This is the most likely issue given the user's intent to store a simple key-value pair.

Answer

The value must be JSON-encoded.

Answer

The token lacks write capability on that path.

Answer

The secret engine is not enabled.

Question 9

An operator needs to create a periodic token with a period of 36 hours. Which command should they use?

Accepted Answer

vault token create -period=36h. Option A is correct because the `vault token create -period=36h` command creates a periodic token with a specified renewal period of 36 hours. Periodic tokens have no explicit TTL; their lifetime is tied to the renewal period, and they can be renewed indefinitely as long as the parent token is valid. This matches the requirement for a token that automatically extends its lifetime every 36 hours.

Answer

vault token create -period=36h -explicit-max-ttl=36h

Answer

vault token create -ttl=36h

Answer

vault token create -explicit-max-ttl=36h

Question 10

A user tries to renew their own token using 'vault token renew -self' and gets 'Error renewing token: Error making API request'. The token is still valid. What could be the cause?

Accepted Answer

The token is not renewable.. The error 'Error renewing token: Error making API request' when using 'vault token renew -self' on a still-valid token indicates the token is not renewable. In Vault, tokens have a renewable flag; if set to false, the token cannot have its TTL extended, even if it is still valid. The error message is generic but the core issue is the token's non-renewable property, not a policy denial or server connectivity problem.

Answer

The token was created with a period.

Answer

The token's policy denies renewal.

Answer

The Vault server is unreachable.

Question 11

A user wants to view information about their current token, including its policies and TTL. Which TWO CLI commands can be used?

Accepted Answer

vault read auth/token/lookup-self. Option A is correct because `vault read auth/token/lookup-self` is a standard Vault CLI command that retrieves information about the current token, including its policies, Time-To-Live (TTL), and other metadata. This command uses the token lookup-self API endpoint, which is specifically designed for the calling token to inspect itself without needing explicit read permissions on its own token ID.

Answer

vault token list

Answer

vault write auth/token/lookup

Answer

vault token info

Question 12

A policy must allow a user to write a new version of an existing secret in a KV v2 secrets engine. Which TWO capabilities are required on the 'data/' path?

Accepted Answer

update. To write a new version of an existing secret in a KV v2 secrets engine, the user needs the 'update' capability on the 'data/' path. This is because the KV v2 API uses a POST/PATCH request to the 'data/' endpoint to create a new version of an existing secret, and the 'update' capability grants permission to modify existing data. The 'create' capability is also required because if the secret does not exist, the same endpoint call will create it, and the policy must allow both creation and update for a seamless write operation.

Answer

delete

Answer

list

Answer

read

Question 13

An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?

Accepted Answer

POST /v1/auth/token/renew. Option B is correct because the `POST /v1/auth/token/renew` endpoint is the standard Vault API call to extend the Time-To-Live (TTL) of an existing token, which is a core token lifecycle operation. This endpoint accepts the token to renew in the request body and returns a new lease duration, adhering to Vault's token management design.

Answer

PUT /v1/auth/token/roles

Answer

DELETE /v1/auth/token/revoke

Question 14

Refer to the exhibit. A user with this policy attempts to read 'secret/data/team/admin'. What will happen?

Accepted Answer

Read fails because deny overrides the broader path.. Option C is correct because Vault's policy evaluation uses a deny-by-default model where explicit deny rules override any allow rules. The policy first allows read on 'secret/data/team/*' but then explicitly denies read on 'secret/data/team/admin'. Since the deny rule is more specific and matches the exact path, it takes precedence, causing the read operation to fail.

Answer

Read succeeds because the first path allows read.

Answer

Read fails because the path does not exist.

Answer

Read succeeds if the user also has sudo capability.

Question 15

Refer to the exhibit. A user runs 'vault token renew -self' on this token. What is the expected behavior?

Accepted Answer

The token TTL will reset to 72h from now.. The token's initial TTL was set to 72h, and the token has a renewable property (service tokens are renewable by default unless explicitly disabled). Running 'vault token renew -self' extends the token's lifetime by resetting the TTL to the original 72h from the current time, as long as the renewal does not exceed the token's maximum TTL (which is also 72h in this case). This behavior is defined by Vault's token lifecycle management, where renewable tokens can have their TTL reset to the initial value upon renewal.

Answer

The token cannot be renewed because the token type is service.

Answer

The token will be renewed, but TTL cannot exceed 72h from issue time.

Answer

The token cannot be renewed because it is orphan.