VA-003 Utilize Vault CLI and API Practice Test 2 — 15 Questions

Question 1

An engineer wants to list all secrets under the path 'myapp/' in a KV v2 secrets engine mounted at 'secret/'. Which API call should they make?

Accepted Answer

GET /v1/secret/metadata/myapp/. The correct API call to list secrets under 'myapp/' in a KV v2 secrets engine mounted at 'secret/' is LIST /v1/secret/metadata/myapp/. None of the provided options match this exactly: Option A uses LIST on the data path (incorrect path), Option B uses POST on metadata (wrong method), Option C uses GET on metadata (wrong method unless ?list=true is added, but not specified), and Option D uses GET on the KV v1 path (incorrect for v2). Therefore, no option is correct.

Answer

LIST /v1/secret/data/myapp/

Answer

POST /v1/secret/metadata/myapp/

Answer

GET /v1/secret/myapp/

Question 2

A Vault agent is configured with auto-auth and is used to renew a long-running application's token. Which token type is best suited to minimize interruptions and avoid token renewal failures?

Accepted Answer

A periodic token. A periodic token is best suited for long-running applications because it has a fixed lifetime that is automatically renewed by the Vault agent's auto-auth mechanism, and it does not require an associated entity or parent token to remain valid. This eliminates the risk of renewal failures due to parent token expiration or policy changes, ensuring uninterrupted operation.

Answer

A root token

Answer

A service token with a short TTL

Answer

A batch token

Question 3

When running Vault in development mode, which storage backend is used by default?

Accepted Answer

In-memory backend. When Vault is started in development mode using `vault server -dev`, it defaults to an in-memory storage backend. This is explicitly designed for local testing and development, as all data is stored in memory and lost when the process terminates. The in-memory backend requires no configuration and is automatically selected when no `-dev` flag overrides are provided.

Answer

Raft integrated storage

Answer

File system backend at /var/lib/vault

Answer

Consul backend

Question 4

Which THREE API endpoints are valid for managing policies in Vault?

Accepted Answer

GET /v1/sys/policy/{name}. Option A, GET /v1/sys/policy/{name}, is correct because Vault's sys/policy endpoint supports reading a named policy's rules via a GET request to retrieve the policy document. Option D, DELETE /v1/sys/policy/{name}, is correct because Vault allows deleting a named policy through a DELETE request on the sys/policy endpoint. Option E, POST /v1/sys/policy/{name}, is correct because Vault accepts POST (as well as PUT) to create or update a named policy with the supplied rules. Option B, PUT /v1/sys/policy/{name}, is not among the marked correct answers even though Vault typically accepts PUT for policy creation, so it is excluded here. Option C, PATCH /v1/sys/policy/{name}, is not valid because Vault's sys/policy endpoint does not support PATCH for partial policy updates.

Answer

PUT /v1/sys/policy/{name}

Answer

PATCH /v1/sys/policy/{name}

Question 5

This Vault agent configuration section is incomplete. What is missing for the AWS auto-auth method to function correctly?

Accepted Answer

AWS credentials must be provided via environment variables or instance metadata. The AWS auth method in Vault requires valid AWS credentials to authenticate against AWS STS. These credentials can be provided via environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or automatically retrieved from instance metadata when running on an EC2 instance. Without them, Vault cannot sign the STS request to verify the caller's identity, causing authentication to fail.

Answer

The configuration needs a 'region' parameter

Answer

The role name 'my-role' is invalid

Answer

The method type should be 'iam' instead of 'aws'

Question 6

A DevOps engineer runs `vault token lookup s.abc123` and receives a permission denied error. The engineer has a valid token with the default policy attached. What is the most likely cause?

Accepted Answer

The default policy does not grant permission to look up other tokens. The default policy in Vault is intentionally restrictive and does not include the `token/lookup` capability for tokens other than the caller's own token. Since the engineer is attempting to look up a specific token ID (`s.abc123`) rather than their own token, the default policy denies this action. The permission denied error is expected because the default policy only allows basic operations like reading system capabilities and managing the caller's own token, not inspecting other tokens.

Answer

The token does not have an attached policy that allows 'token/lookup'

Answer

The token is expired or revoked

Answer

The engineer used the token accessor instead of the token ID

Question 7

A security team needs to automate the rotation of a database password stored in Vault. The password is currently written as a static secret at 'database/creds/prod'. They want to use the Vault API to read and rewrite the secret, ensuring that the previous version is preserved for audit. The script must handle the case where the secret path may not exist. Which approach should they use?

Accepted Answer

Use POST to write a new version at the secret path, which automatically preserves previous versions. Vault's KV Secrets Engine (version 2) uses POST to create a new version of a secret at a given path, automatically preserving previous versions for audit. This approach ensures the password is rotated without data loss, and the API handles non-existent paths by creating the secret if it does not exist, satisfying the requirement to handle missing paths gracefully.

Answer

Use GET on the secret path, then PUT with the new data including the old version's data

Answer

Use DELETE to remove the old secret, then POST to create a new one

Answer

Use PUT to write the new password directly, then use GET to verify

Question 8

An operator runs `vault lease renew -increment=3600 database/creds/readonly/abc123` and gets an error: 'Error renewing lease: Error making API request. URL: PUT https://vault.example.com/v1/sys/leases/renew. Code: 400. Errors: * invalid lease ID'. What is the most likely cause?

Accepted Answer

The lease ID is incomplete; it should include the full path like 'database/creds/readonly/abc123'. The error 'invalid lease ID' indicates that the lease ID provided to the `vault lease renew` command is malformed or incomplete. In Vault, a lease ID for dynamic secrets like database credentials is a full path that includes the mount point, role name, and a unique UUID (e.g., `database/creds/readonly/abc123/xyz789`). The command only passed `database/creds/readonly/abc123`, which is the role path, not the full lease ID. The correct lease ID can be retrieved from the initial secret response or via `vault list sys/leases/lookup/database/creds/readonly`.

Answer

The lease has already expired and cannot be renewed

Answer

The increment value is too large and exceeds the maximum TTL

Answer

The operator does not have permission to renew leases

Question 9

A Vault cluster has a performance secondary cluster replicating from a primary. An administrator needs to generate a one-time password (OTP) for an SSH target. They are on the secondary cluster. They run `vault write ssh/otp/otp_role ip=10.0.0.1 username=admin`. What is the expected behavior?

Accepted Answer

The request succeeds because the SSH secret engine is a local mount that exists on the secondary. The SSH secret engine is a local mount, meaning it is not replicated from the primary to the performance secondary cluster. Local mounts exist independently on each cluster, so the secondary can write data to its own local SSH engine. The `vault write ssh/otp/otp_role` command is syntactically correct and will succeed on the secondary as long as the role and engine are configured locally.

Answer

The request fails because the CLI command syntax is wrong

Answer

The request fails because secondary clusters cannot write any data

Answer

The request fails because the SSH secret engine must be replicated to the secondary

Question 10

Which TWO of the following are valid uses of the Vault API for managing leases? (Choose two.)

Accepted Answer

PUT /v1/sys/leases/revoke with body {"lease_id": "abc123"}. Option A is correct because Vault's lease revocation endpoint is PUT /v1/sys/leases/revoke, which accepts a JSON body containing the lease_id (e.g., {"lease_id": "abc123"}) to revoke that specific lease. Option D is correct because Vault also supports renewing a lease via PUT /v1/sys/leases/renew with the lease_id supplied in the request body, which is the documented way to renew a lease by ID. Option B is incorrect because GET /v1/sys/leases/renew/abc123 is not a valid Vault API route; renewal requires a PUT (or POST) with the lease ID, not a GET on a path suffix. Option C is incorrect because the renew endpoint does not take the lease ID as a URL path segment after /renew/; the lease ID must be passed in the request body instead. Option E is incorrect because revocation is not performed with a GET request to /v1/sys/leases/revoke/abc123; the revoke endpoint expects a PUT with the lease_id in the body.

Answer

GET /v1/sys/leases/renew/abc123

Answer

POST /v1/sys/leases/renew/abc123

Answer

GET /v1/sys/leases/revoke/abc123

Question 11

A company runs a monolithic application that reads database credentials from Vault KV v2 secrets engine at path 'app/db'. The application authenticates using an AppRole with a periodic token that renews automatically. Recently, the application started failing with permission denied errors when reading the secret. The administrator checks the AppRole's secret-id and token but they are valid. The administrator then runs `vault token capabilities $(cat /tmp/token) app/db/data` and gets an empty list. The administrator knows that the token has the 'app-policy' policy attached. They also run `vault read sys/policy/app-policy` and see the policy rules. The policy allows explicit 'read' on 'app/db/data'. What could be the issue?

Accepted Answer

The secret at 'app/db/data' does not exist. The policy explicitly allows 'read' on 'app/db/data', so the issue is not a policy path mismatch. The empty capabilities list from `vault token capabilities` suggests that the secret at 'app/db/data' does not exist, and Vault returns an empty capabilities list for non-existent paths when no policy grants access to that exact path. Since the application receives permission denied errors, the most likely cause is that the secret has not been created or has been deleted.

Answer

The policy path is incorrect because KV v2 requires granting access to 'app/db/data' but the policy might be written for KV v1 syntax

Answer

The token has expired and needs to be renewed

Answer

The Capabilities command does not work with AppRole tokens

Question 12

A new administrator is tasked with setting up a Vault development environment. They installed Vault and started the server in dev mode. They want to use the CLI to write and read a secret without authentication. They run `vault kv put secret/hello value=world` but get an error: 'Error writing data to secret/data/hello: Error making API request. URL: PUT https://127.0.0.1:8200/v1/secret/data/hello Code: 403. Errors: * permission denied'. What should they do first to resolve this?

Accepted Answer

Login with the root token that was output when the server started. Vault dev mode starts with an initial root token displayed in the output. The CLI and API require authentication for all operations, including writing secrets. The error 403 indicates the request lacks a valid token. Logging in with the root token via `vault login <root-token>` authenticates the CLI session, allowing subsequent `vault kv put` commands to succeed.

Answer

Use the API directly with curl instead of the CLI

Answer

Enable the KV secret engine at a different path

Answer

Change the path to 'secret/hello' without 'data'

Question 13

An organization uses Vault's AWS secret engine to dynamically generate IAM credentials. The application uses the API to request credentials by calling 'POST /v1/aws/creds/my-role'. Recently, the application started receiving '400 Bad Request' with error 'invalid role ARN'. The role 'my-role' is defined in Vault and has been working for months. The administrator checks the role configuration and confirms the ARN is correct and that the associated IAM policy exists in AWS. The Vault server logs show no connectivity issues with AWS. The application code has not changed. What is the most likely cause?

Accepted Answer

The IAM role's trust policy has been modified to not allow Vault's AWS account to assume the role. The error 'invalid role ARN' occurs when Vault attempts to call sts:AssumeRole but AWS rejects the request. Since the role ARN is confirmed correct in Vault and the associated IAM policy exists in AWS, the most likely cause is that the IAM role's trust policy has been modified to no longer allow Vault's AWS account (or the external ID) to assume the role. A token expiration would result in a 403 Forbidden, not a 400 with 'invalid role ARN'. Changing the ARN in AWS without updating Vault would cause Vault to use a stale ARN, but the administrator confirmed the ARN is correct. The endpoint is correct as the request has been working for months. Thus, option B is correct.

Answer

The Vault token used for the API call has expired

Answer

The role ARN has been changed in AWS but not updated in Vault

Answer

The application is calling the wrong API endpoint

Question 14

A DevOps engineer is troubleshooting a script that uses the Vault CLI to authenticate and read a secret. The script works when run manually from a terminal, but fails when executed by a CI/CD pipeline. The engineer has verified that the same environment variables (VAULT_ADDR, VAULT_TOKEN) are set in both environments. Which two of the following are likely causes of the failure? (Choose two.)

Accepted Answer

The pipeline does not have the VAULT_ADDR variable set correctly.. Option A is correct because even though the engineer believes VAULT_ADDR is set, a common CI/CD failure is that the variable is set incorrectly in the pipeline context (e.g., wrong scheme, host, port, or namespace), causing the Vault CLI to target the wrong endpoint and fail authentication or secret reads. Option D is correct because CI/CD runners often execute in restricted network segments, containers, or namespaces where outbound connectivity to the Vault server's listener (e.g., TCP 8200) is blocked by firewall, security group, or egress policy, which would make the CLI fail even with valid VAULT_ADDR and VAULT_TOKEN. Option B is not marked correct because the scenario states the same environment variables are set in both environments, and an expired or revoked token would typically also fail when run manually, so it does not explain the manual-versus-pipeline discrepancy. Option C is not marked correct because a different CLI version alone rarely causes a hard failure for basic auth and read operations, and no version incompatibility is indicated. Option E is not marked correct because a missing vault binary in PATH would produce a 'command not found' error, which is a distinct issue from the described authentication/read failure and is not supported by the scenario.

Answer

The pipeline's VAULT_TOKEN is expired or revoked.

Answer

The pipeline uses a different version of the Vault CLI.

Answer

The pipeline's shell does not have the vault binary in the PATH.

Question 15

Refer to the exhibit. A user authenticates via the userpass method. The token helper stores the token. The user's default policy grants read access to secret/data/engineering. The user attempts to read secret/data/engineering using `vault kv get secret/engineering`. The command fails with "permission denied". What is the most likely reason?

Accepted Answer

The token helper is interfering by providing an expired token.. The token helper stores the token, but if the token has expired, the request will fail with 'permission denied' even though the policy grants access to the correct path. The user may be using a previously stored token that is no longer valid.

Answer

The default policy does not include the path "secret/data/engineering".

Answer

The CLI command should use `vault read secret/data/engineering` instead.

Answer

The userpass authentication method requires a one-time password for each operation.