VA-003 Utilize Vault CLI and API Practice Test 4 — 15 Questions

Question 1

Match each Vault policy capability to its permission.

Accepted Answer

create: Allows creating data at the path.. The correct matches are: create allows creating data, read allows reading data, update allows updating data, and delete allows deleting data. Common confusions involve swapping create and read capabilities.

Answer

create: Allows reading data at the path.

Answer

read: Allows creating data at the path.

Question 2

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 3

An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?

Accepted Answer

PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}. Creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.

Answer

POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}

Answer

POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}

Answer

PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}

Question 4

A user receives 'permission denied' when running 'vault write secret/data/myapp value=123'. The user's token has a policy that includes 'path "secret/data/*" { capabilities = ["read", "list"] }'. What is the most likely cause?

Accepted Answer

The path requires create or update capability.. The user's policy grants only 'read' and 'list' capabilities on the path 'secret/data/*'. The 'vault write' command requires either 'create' or 'update' capability (or both) on the path. Since the policy lacks these capabilities, Vault returns a 'permission denied' error, even though the token is valid and the secret engine is mounted.

Answer

The user is not authenticated.

Answer

The secret engine is not mounted.

Answer

The token is expired.

Question 5

An administrator wants to mount the AWS secrets engine at 'aws' path using the API. Which request is correct?

Accepted Answer

POST /v1/sys/mounts/aws with body {"type":"aws"}. Mounting a secrets engine in Vault is performed via a POST request to the `/v1/sys/mounts/<path>` endpoint with a JSON body containing the `"type"` field set to the engine's type identifier. For the AWS secrets engine, the type is `"aws"`, and the path is specified in the URL as `aws`. The POST method is required for creating a new mount, while PUT is used for tuning an existing mount.

Answer

PUT /v1/sys/mounts/aws with body {"type":"aws"}

Answer

POST /v1/sys/auth/aws with body {"type":"aws"}

Answer

POST /v1/sys/mounts/aws with body {"type":"aws-secrets"}

Question 6

An operator needs to create a periodic token with a period of 36 hours. Which command should they use?

Accepted Answer

vault token create -period=36h. The `vault token create -period=36h` command creates a periodic token with a specified renewal period of 36 hours. Periodic tokens have no explicit TTL; their lifetime is tied to the renewal period, and they can be renewed indefinitely as long as the parent token is valid. This matches the requirement for a token that automatically extends its lifetime every 36 hours.

Answer

vault token create -period=36h -explicit-max-ttl=36h

Answer

vault token create -ttl=36h

Answer

vault token create -explicit-max-ttl=36h

Question 7

A user wants to view information about their current token, including its policies and TTL. Which TWO CLI commands can be used?

Accepted Answer

vault read auth/token/lookup-self. Option A, `vault read auth/token/lookup-self`, is correct because it reads the `auth/token/lookup-self` endpoint, which returns details about the token used to make the request, including its policies, TTL, and other metadata. Option E, `vault token lookup`, is correct because it queries the same token lookup functionality through the CLI and, when run without a token argument, displays information about the current token such as policies and TTL. Option B, `vault token list`, is incorrect because it lists accessor values of tokens rather than showing details of the current token. Option C, `vault write auth/token/lookup`, is incorrect because the lookup endpoint is read-oriented and requires a token parameter; writing to it without a token does not return current-token information. Option D, `vault token info`, is incorrect because it is not a valid Vault CLI command.

Answer

vault token list

Answer

vault write auth/token/lookup

Answer

vault token info

Question 8

An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?

Accepted Answer

POST /v1/auth/token/renew. In HashiCorp Vault's token auth method, POST /v1/auth/token/renew (option B) is correct because token renewal is performed by submitting a token (and optional increment) to the renew endpoint, which extends the token's TTL. POST /v1/auth/token/create (option D) is correct because new tokens are minted by POSTing parameters such as policies, TTL, and renewable flags to the create endpoint. GET /v1/auth/token/lookup (option E) is correct because looking up a token's metadata (policies, TTL, display name) is a read operation against the lookup endpoint, typically using the X-Vault-Token header or the token as a parameter. Option A is wrong because token roles are managed under /v1/auth/token/roles using POST to create, GET to read, and DELETE to remove, not PUT. Option C is wrong because revoking a token is done with POST /v1/auth/token/revoke (or /revoke-self, /revoke-orphan), not DELETE.

Answer

PUT /v1/auth/token/roles

Answer

DELETE /v1/auth/token/revoke

Question 9

Refer to the exhibit. A user with this policy attempts to read 'secret/data/team/admin'. What will happen?

Accepted Answer

Read fails because deny overrides the broader path.. Vault's policy evaluation uses a deny-by-default model where explicit deny rules override any allow rules. The policy first allows read on 'secret/data/team/*' but then explicitly denies read on 'secret/data/team/admin'. Since the deny rule is more specific and matches the exact path, it takes precedence, causing the read operation to fail.

Answer

Read succeeds because the first path allows read.

Answer

Read fails because the path does not exist.

Answer

Read succeeds if the user also has sudo capability.

Question 10

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Accepted Answer

vault write shared/data/db_password value=s3cret. In Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Answer

vault write shared/db_password value=s3cret

Answer

vault write shared/metadata/db_password value=s3cret

Answer

vault write shared/config/db_password value=s3cret

Question 11

An administrator wants to retrieve the value of a secret stored at the path 'kv/secret/mykey' using the Vault CLI. Which command should they use?

Accepted Answer

vault read kv/secret/mykey. The correct command to retrieve a secret from Vault's KV secrets engine is `vault read`. This command is used to read data and metadata from a specified path. Option D is correct because `vault read kv/secret/mykey` will retrieve the value stored at that path, assuming the KV engine is mounted at `kv/`.

Answer

vault get kv/secret/mykey

Answer

vault retrieve kv/secret/mykey

Answer

vault show kv/secret/mykey

Question 12

A user attempts to read a secret at path 'secret/data/app' and receives a 403 Forbidden error. What is the most likely cause?

Accepted Answer

The token's policy does not grant read capability on that path. A 403 Forbidden error in Vault indicates that the token used for the request is valid and the path exists, but the token's attached policy does not grant the required 'read' capability on that specific path. This is a policy enforcement action by Vault's ACL system, which explicitly denies access when the policy lacks a matching 'read' rule for the path.

Answer

The secret engine is not mounted at 'secret/'

Answer

The secret key does not exist

Answer

The token has expired

Question 13

An administrator needs to securely provide a one-time use token to a remote service using Vault response wrapping. Which CLI flag or command should they use?

Accepted Answer

Use 'vault write -wrap-ttl=5m auth/token/create'. `vault write -wrap-ttl=5m auth/token/create` creates a one-time use token wrapped in a response-wrapping envelope with a specified TTL. The remote service can then unwrap the token using `vault unwrap` with the wrapping token, ensuring secure delivery without exposing the actual token in transit.

Answer

Use 'vault write -response-wrap auth/token/create'

Answer

Use 'vault unwrap' on the remote service

Answer

Use 'vault wrap auth/token/create'

Question 14

Which Vault CLI command is used to authenticate a user with a username and password to the userpass auth method?

Accepted Answer

vault login -method=userpass username=alice password=secret. `vault login -method=userpass` is the standard Vault CLI command to authenticate against the userpass auth method, passing the username and password as parameters. This command triggers the login endpoint (`/v1/auth/userpass/login/:username`) and returns a client token upon successful authentication.

Answer

vault auth userpass username=alice password=secret

Answer

vault token create -policy=userpass

Answer

vault authenticate userpass username=alice password=secret

Question 15

An administrator has created a policy file named 'app-policy.hcl'. Which command should they use to upload this policy to Vault?

Accepted Answer

vault policy write app-policy app-policy.hcl. The `vault policy write` command is the standard Vault CLI command to create or update a policy from a file. The syntax `vault policy write ` reads the HCL or JSON policy definition from the specified file and writes it to Vault's policy storage.

Answer

vault write sys/policy/app-policy @app-policy.hcl

Answer

vault create policy app-policy app-policy.hcl

Answer

vault set policy app-policy app-policy.hcl