VA-003 Utilize Vault CLI and API Practice Test 5 — 15 Questions

Question 1

A DevOps engineer needs to create a token with a specific policy attached using the Vault API. Which API endpoint and request should they use?

Accepted Answer

POST /v1/auth/token/create with JSON body {"policies":["my-policy"]}. The Vault API endpoint for creating tokens with specific policies is POST /v1/auth/token/create, and the JSON body must include the 'policies' key as an array of strings. This endpoint is part of the token auth method and allows attaching policies at token creation time.

Answer

POST /v1/auth/token/create-orphan with JSON body {"policies":["my-policy"]}

Answer

POST /v1/token/create with JSON body {"policy":"my-policy"}

Answer

POST /v1/sys/token with JSON body {"policy":"my-policy"}

Question 2

Which TWO statements are true when troubleshooting a failed Vault CLI command?

Accepted Answer

Run 'vault token lookup' to verify the token is valid and has the expected policies.. Option A is correct because 'vault token lookup' inspects the current token's metadata, including its TTL, renewal status, and attached policies, which directly verifies whether the token is valid and authorized as expected. Option C is correct because if the token is expired, revoked, or missing, 'vault login' re-authenticates against the configured auth method and issues a fresh token so subsequent CLI commands can succeed. Option B is not a general troubleshooting step since 'vault write' mutates data at a path and requires knowing a valid path and payload, so it is not a reliable diagnostic. Option D is not among the marked answers because 'vault status' only reports seal and HA state, not token or policy validity, and it can succeed even when the token is the actual problem. Option E is likewise not marked because 'vault read' depends on a specific existing path and permissions, making it an unreliable test of general accessibility.

Answer

Run 'vault write' to test if the token can write to a path.

Answer

Run 'vault status' to check if the server is reachable.

Answer

Run 'vault read' to test if any secret is accessible.

Question 3

Which THREE are benefits of using Vault response wrapping?

Accepted Answer

Reduces the risk of secret exposure in transit. Option A is correct because Vault response wrapping returns a single-use wrapping token instead of the actual secret, so if the response is intercepted in transit the attacker only obtains a wrapping token that can be unwrapped once, reducing the risk of secret exposure. Option C is correct because a wrapping token is single-use: once it is unwrapped, the token is revoked and cannot be used again, which ensures the wrapped secret can be retrieved only once. Option E is correct because wrapping enables delegation of access without sharing the actual token — the wrapper can hand the wrapping token to another party (e.g., an app or trusted operator) who unwraps it to obtain a short-lived token with limited policy, without ever exposing the original token. Option B is not correct because wrapping tokens support only a single unwrap, not unlimited unwraps. Option D is not correct because response wrapping does not extend the TTL of the underlying secret; the wrapping token itself has a short TTL and the wrapped secret retains its own lease/TTL.

Answer

Supports unlimited unwraps

Answer

Increases the TTL of the secret

Question 4

The CLI command returns a 403 error. What is the most likely cause?

Accepted Answer

The token does not have a policy allowing read on 'database/creds/readonly'. A 403 Forbidden error from Vault indicates that the request was authenticated (the token is valid) but the token's policies do not grant permission for the requested action. Since the command attempts to read from 'database/creds/readonly', the most likely cause is that the token lacks a policy allowing read access on that path. This is a standard authorization failure, not an authentication or configuration issue.

Answer

The role 'readonly' does not exist

Answer

The database secrets engine is not mounted at 'database/'

Answer

The field 'value' does not exist in the secret

Question 5

A user with this policy wants to delete secrets under the 'team/' path. Which additional capability must be added?

Accepted Answer

delete. The user's policy grants 'create' and 'update' capabilities on 'team/*', but not 'delete'. In Vault's ACL policy system, each operation (create, read, update, delete, list, sudo) must be explicitly allowed. Since 'delete' is missing, the user cannot delete secrets under 'team/'. Adding the 'delete' capability to the policy is required.

Answer

sudo

Answer

list

Answer

patch

Question 6

An administrator wants to write a secret 'myapp' with value 'password=pass123' to the KV v2 secret engine mounted at 'secret/'. Which command should they use?

Accepted Answer

vault kv put secret/myapp password=pass123. `vault kv put` is the proper command to write or update a secret in the KV v2 secrets engine. The KV v2 engine requires the `put` subcommand to create or overwrite a secret at the specified path, and the syntax `vault kv put secret/myapp password=pass123` correctly writes the key-value pair to the path `secret/myapp` under the mounted engine at `secret/`.

Answer

vault kv write secret/myapp password=pass123

Answer

vault kv create secret/myapp password=pass123

Answer

vault write secret/myapp password=pass123

Question 7

An application needs to read a secret using the Vault API after authenticating with an AppRole RoleID and SecretID. The application has already obtained a Vault token. Which API endpoint should be called to read a secret at 'secret/data/myapp' with the token?

Accepted Answer

GET /v1/secret/data/myapp. After authentication, the application already has a Vault token and needs to read a secret from the KV v2 secrets engine. The correct API endpoint for reading a secret from the KV v2 engine is GET /v1/secret/data/myapp, where 'secret' is the mount path and 'data' is the sub-path for KV v2 operations. The token is passed in the X-Vault-Token header, not in the URL.

Answer

GET /v1/secret/metadata/myapp

Answer

POST /v1/auth/approle/login

Answer

GET /v1/secret/myapp

Question 8

Which TWO of the following are valid methods to authenticate to Vault using the CLI without using a token? (Choose two.)

Accepted Answer

vault login -method=userpass username=joe password=pass. Option A is correct because `vault login -method=userpass username=joe password=pass` invokes the userpass auth method's login endpoint and returns a Vault token, allowing CLI authentication without supplying an existing token. Option B is correct because `vault login -method=ldap username=joe password=pass` performs the same token-issuing login flow against the LDAP auth method, which is a valid non-token authentication path. Option C is not valid because `vault auth` is used to enable, disable, and tune auth methods, not to log in and obtain a token. Option D is not the documented CLI login workflow; while it resembles a raw API write to the userpass login path, the CLI's supported non-token login mechanism is `vault login -method=...`. Option E is incorrect because `vault token create` requires an existing token with sufficient permissions and creates a new token rather than authenticating without one.

Answer

vault auth -method=ldap username=joe password=pass

Answer

vault write auth/userpass/login/joe password=pass

Answer

vault token create -policy=default

Question 9

Which THREE of the following are true about using the Vault API with response wrapping? (Choose three.)

Accepted Answer

The wrapping token can only be used once to unwrap the response. Option B is correct because a response-wrapping token is single-use: the first call to the sys/wrapping/unwrap endpoint (or a lookup) consumes it, and any subsequent attempt fails. Option C is correct because clients enable wrapping by supplying the X-Vault-Wrap-TTL header on the request, which tells Vault to return a wrapping token instead of the actual response data. Option E is correct because Vault stores the wrapped response in the cubbyhole secret engine, which is scoped to the wrapping token and is where the data lives until it is unwrapped. Option A is wrong because the wrapping token has a TTL set by X-Vault-Wrap-TTL and expires like any other Vault token. Option D is wrong because unwrapping requires only the wrapping token itself, not the original token that created the wrapped response.

Answer

The wrapping token never expires

Answer

The original token used to make the wrapped request is required to unwrap the response

Question 10

A team is migrating from a monolithic application to microservices. Each microservice needs to authenticate to Vault using its own AppRole. The security team wants to enforce that each AppRole can only read secrets from its own dedicated path (e.g., service-a can only read from 'services/service-a/*', service-b from 'services/service-b/*'). They have created the AppRoles and policies. However, during testing, they notice that service-a can read secrets from service-b's path. The administrator checks the policy for service-a and sees it has a 'capabilities' list on 'services/service-a/*' and also 'services/service-b/*' by mistake. They correct the policy, but the issue persists. What is the most likely reason that service-a still has access?

Accepted Answer

The token was issued before the policy was corrected and still carries the old policy version; it must be replaced or renewed to get the updated permissions. Vault tokens are immutable once issued; they carry a snapshot of the policies at the time of creation. Correcting the policy on the Vault server does not retroactively update existing tokens. Service-a's token was issued before the policy fix and still contains the old policy that granted access to 'services/service-b/*'. The token must be replaced (revoked and re-issued) or renewed to pick up the updated policy permissions.

Answer

The policy still contains an error that grants access to the wrong path

Answer

The policy update has not been applied to the Vault cluster yet

Answer

The service-a token has a second policy attached that grants access to service-b

Question 11

An operator has authenticated to Vault and wants to inspect the metadata of the currently active token, including its accessor, policies, and creation time, without exposing the token's secret value. Which CLI command returns this information?

Accepted Answer

vault token lookup. `vault token lookup` without arguments queries the token auth method's lookup-self endpoint and returns metadata for the token in use, including accessor, policies, TTL, and creation time. It deliberately omits the token's secret value, so an operator can audit the active session safely. Other token subcommands perform renewal, capability checks, or creation instead.

Answer

vault token renew

Answer

vault read auth/token/lookup-self

Answer

vault token capabilities

Question 12

An application authenticates to Vault using the AppRole auth method and needs to retrieve the token's remaining TTL and renewable status programmatically. The application already has a valid token and calls the lookup-self endpoint. Which response fields should it read to determine whether the token can be renewed and how long it remains valid?

Accepted Answer

ttl and renewable. The token lookup-self response exposes `ttl` (remaining seconds) and `renewable` (boolean). An application reading these two fields can decide whether to renew the token before it expires or to re-authenticate. Timestamps, use counts, and policies are informative but do not answer the renewability and remaining-lifetime question on their own.

Answer

lease_duration and renewable

Answer

creation_time and expire_time

Answer

num_uses and policies

Question 13

A cloud engineer is scripting against the Vault HTTP API and must authenticate, then read a KV v2 secret, using only `curl`. Which TWO request elements are required for the read to succeed? (Choose two.)

Accepted Answer

A GET to the path `/v1/secret/data/apps/web/config`.. API reads require a valid token in the `X-Vault-Token` header and, for KV v2, a GET to the `/v1//data/` endpoint. The token authorizes the call against policy, while the data endpoint routes to the versioned secret store. Namespace and request-marker headers are situational and not required for a root-namespace read.

Answer

The header `X-Vault-Request: true` on the request.

Answer

A POST to the path `/v1/secret/apps/web/config` with a JSON body.

Answer

The header `X-Vault-Namespace: root` on the request.

Question 14

A security engineer needs to authenticate a CI pipeline to Vault using the AppRole auth method from the CLI without a pre-existing token. The engineer has the role_id and a wrapped secret_id. Which TWO commands are required to complete the login and obtain a usable token? (Choose two.)

Accepted Answer

vault unwrap <wrapping_token>. Authenticating with a wrapped SecretID requires two distinct actions: first, `vault unwrap` consumes the single-use wrapping token to reveal the real SecretID; second, `vault write auth/approle/login` submits the role_id and the unwrapped SecretID to receive a client token. Skipping the unwrap step sends the wrapping token as the SecretID, which the AppRole backend rejects because it does not match any stored SecretID.

Answer

vault token renew -self

Answer

vault login -method=approle role_id=<role_id>

Answer

vault write -wrap-ttl=120s auth/approle/role/web/secret-id

Question 15

A developer wants to inspect the metadata of the current Vault token, including its attached policies, TTL, and whether it is renewable, using a single CLI command. Which command should the developer run?

Accepted Answer

vault token lookup. The `vault token lookup` command retrieves metadata for the calling token when no token argument is supplied, exposing fields like `policies`, `ttl`, `renewable`, and `accessor`. It is a read-only operation with no side effects, unlike renewal. Commands such as `vault auth list` or `vault token capabilities` serve entirely different purposes and cannot report the token's policies and TTL.

Answer

vault token renew

Answer

vault auth list

Answer

vault token capabilities