VA-003 Utilize Vault CLI and API Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Accepted Answer

vault write shared/data/db_password value=s3cret. Option B is correct because in Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Answer

vault write shared/db_password value=s3cret

Answer

vault write shared/metadata/db_password value=s3cret

Answer

vault write shared/config/db_password value=s3cret

Question 2

An administrator wants to retrieve the value of a secret stored at the path 'kv/secret/mykey' using the Vault CLI. Which command should they use?

Accepted Answer

vault read kv/secret/mykey. The correct command to retrieve a secret from Vault's KV secrets engine is `vault read`. This command is used to read data and metadata from a specified path. Option D is correct because `vault read kv/secret/mykey` will retrieve the value stored at that path, assuming the KV engine is mounted at `kv/`.

Answer

vault get kv/secret/mykey

Answer

vault retrieve kv/secret/mykey

Answer

vault show kv/secret/mykey

Question 3

A user attempts to read a secret at path 'secret/data/app' and receives a 403 Forbidden error. What is the most likely cause?

Accepted Answer

The token's policy does not grant read capability on that path. A 403 Forbidden error in Vault indicates that the token used for the request is valid and the path exists, but the token's attached policy does not grant the required 'read' capability on that specific path. This is a policy enforcement action by Vault's ACL system, which explicitly denies access when the policy lacks a matching 'read' rule for the path.

Answer

The secret engine is not mounted at 'secret/'

Answer

The secret key does not exist

Answer

The token has expired

Question 4

An administrator needs to securely provide a one-time use token to a remote service using Vault response wrapping. Which CLI flag or command should they use?

Accepted Answer

Use 'vault write -wrap-ttl=5m auth/token/create'. Option C is correct because `vault write -wrap-ttl=5m auth/token/create` creates a one-time use token wrapped in a response-wrapping envelope with a specified TTL. The remote service can then unwrap the token using `vault unwrap` with the wrapping token, ensuring secure delivery without exposing the actual token in transit.

Answer

Use 'vault write -response-wrap auth/token/create'

Answer

Use 'vault unwrap' on the remote service

Answer

Use 'vault wrap auth/token/create'

Question 5

An engineer wants to list all secrets under the path 'myapp/' in a KV v2 secrets engine mounted at 'secret/'. Which API call should they make?

Accepted Answer

GET /v1/secret/metadata/myapp/. Option C is correct because in Vault KV v2, the LIST operation for secrets under a path is performed using a GET request to the `/v1/secret/metadata/myapp/` endpoint. This endpoint returns the list of secrets (keys) at that path, as the metadata path is used for listing and managing secret metadata, including subkeys. The trailing slash is required to indicate a directory listing.

Answer

LIST /v1/secret/data/myapp/

Answer

POST /v1/secret/metadata/myapp/

Answer

GET /v1/secret/myapp/

Question 6

Which Vault CLI command is used to authenticate a user with a username and password to the userpass auth method?

Accepted Answer

vault login -method=userpass username=alice password=secret. Option A is correct because `vault login -method=userpass` is the standard Vault CLI command to authenticate against the userpass auth method, passing the username and password as parameters. This command triggers the login endpoint (`/v1/auth/userpass/login/:username`) and returns a client token upon successful authentication.

Answer

vault auth userpass username=alice password=secret

Answer

vault token create -policy=userpass

Answer

vault authenticate userpass username=alice password=secret

Question 7

A Vault agent is configured with auto-auth and is used to renew a long-running application's token. Which token type is best suited to minimize interruptions and avoid token renewal failures?

Accepted Answer

A periodic token. A periodic token is best suited for long-running applications because it has a fixed lifetime that is automatically renewed by the Vault agent's auto-auth mechanism, and it does not require an associated entity or parent token to remain valid. This eliminates the risk of renewal failures due to parent token expiration or policy changes, ensuring uninterrupted operation.

Answer

A root token

Answer

A service token with a short TTL

Answer

A batch token

Question 8

When running Vault in development mode, which storage backend is used by default?

Accepted Answer

In-memory backend. When Vault is started in development mode using `vault server -dev`, it defaults to an in-memory storage backend. This is explicitly designed for local testing and development, as all data is stored in memory and lost when the process terminates. The in-memory backend requires no configuration and is automatically selected when no `-dev` flag overrides are provided.

Answer

Raft integrated storage

Answer

File system backend at /var/lib/vault

Answer

Consul backend

Question 9

An administrator has created a policy file named 'app-policy.hcl'. Which command should they use to upload this policy to Vault?

Accepted Answer

vault policy write app-policy app-policy.hcl. Option D is correct because the `vault policy write` command is the standard Vault CLI command to create or update a policy from a file. The syntax `vault policy write ` reads the HCL or JSON policy definition from the specified file and writes it to Vault's policy storage.

Answer

vault write sys/policy/app-policy @app-policy.hcl

Answer

vault create policy app-policy app-policy.hcl

Answer

vault set policy app-policy app-policy.hcl

Question 10

A DevOps engineer needs to create a token with a specific policy attached using the Vault API. Which API endpoint and request should they use?

Accepted Answer

POST /v1/auth/token/create with JSON body {"policies":["my-policy"]}. Option A is correct because the Vault API endpoint for creating tokens with specific policies is POST /v1/auth/token/create, and the JSON body must include the 'policies' key as an array of strings. This endpoint is part of the token auth method and allows attaching policies at token creation time.

Answer

POST /v1/auth/token/create-orphan with JSON body {"policies":["my-policy"]}

Answer

POST /v1/token/create with JSON body {"policy":"my-policy"}

Answer

POST /v1/sys/token with JSON body {"policy":"my-policy"}

Question 11

Which TWO statements are true when troubleshooting a failed Vault CLI command?

Accepted Answer

Run 'vault token lookup' to verify the token is valid and has the expected policies.. Option A is correct because `vault token lookup` is the standard diagnostic command to inspect the current token's metadata, including its validity, creation time, TTL, and associated policies. If the token is expired, revoked, or lacks the necessary policies for the failed command, this command will reveal the issue directly without side effects.

Answer

Run 'vault write' to test if the token can write to a path.

Answer

Run 'vault status' to check if the server is reachable.

Answer

Run 'vault read' to test if any secret is accessible.

Question 12

Which THREE are benefits of using Vault response wrapping?

Accepted Answer

Reduces the risk of secret exposure in transit. Vault response wrapping is a feature that encapsulates a secret or token in a single-use, time-limited wrapping token. Option A is correct because the secret is never transmitted in plaintext over the wire; instead, the wrapping token is sent, and the actual secret is retrieved only by unwrapping it, which reduces the risk of secret exposure during transit. Option C is correct because the wrapping token is designed for a single unwrap operation—once unwrapped, the token is destroyed, ensuring the secret is used only once. Option E is correct because response wrapping allows a user to delegate access to a secret by sharing the wrapping token instead of the actual token, enabling secure delegation without exposing the underlying credential.

Answer

Supports unlimited unwraps

Answer

Increases the TTL of the secret

Question 13

Which THREE API endpoints are valid for managing policies in Vault?

Accepted Answer

GET /v1/sys/policy/{name}. The GET, DELETE, and POST endpoints are valid for managing policies in Vault. GET retrieves a policy, DELETE removes it, and POST creates or updates a policy. These correspond to the standard CRUD operations supported by Vault's sys/policy API.

Answer

PUT /v1/sys/policy/{name}

Answer

PATCH /v1/sys/policy/{name}

Question 14

The CLI command returns a 403 error. What is the most likely cause?

Accepted Answer

The token does not have a policy allowing read on 'database/creds/readonly'. A 403 Forbidden error from Vault indicates that the request was authenticated (the token is valid) but the token's policies do not grant permission for the requested action. Since the command attempts to read from 'database/creds/readonly', the most likely cause is that the token lacks a policy allowing read access on that path. This is a standard authorization failure, not an authentication or configuration issue.

Answer

The role 'readonly' does not exist

Answer

The database secrets engine is not mounted at 'database/'

Answer

The field 'value' does not exist in the secret

Question 15

This Vault agent configuration section is incomplete. What is missing for the AWS auto-auth method to function correctly?

Accepted Answer

AWS credentials must be provided via environment variables or instance metadata. Option D is correct because the AWS auth method in Vault requires valid AWS credentials to authenticate against AWS STS. These credentials can be provided via environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or automatically retrieved from instance metadata when running on an EC2 instance. Without them, Vault cannot sign the STS request to verify the caller's identity, causing authentication to fail.

Answer

The configuration needs a 'region' parameter

Answer

The role name 'my-role' is invalid

Answer

The method type should be 'iam' instead of 'aws'

VA-003 Utilize Vault CLI and API Practice Test 3 — 15 Questions

Exhibit

VA-003 Utilize Vault CLI and API Practice Test 3 — 15 Questions

Exhibit