VA-003 Utilize Vault CLI and API — Timed 20 Questions

Question 1

A DevOps engineer needs to write a new secret to the KV v2 engine at path 'secret/data/team' with key 'api_key' and value 'abc123'. Which Vault CLI command achieves this?

Accepted Answer

vault kv put secret/team api_key=abc123. Option B is correct because the KV v2 engine automatically prefixes the path with 'data/' when using the 'vault kv put' command. The correct path for writing a secret to the KV v2 engine is 'secret/data/team', but the CLI command 'vault kv put secret/team api_key=abc123' handles this internally by appending '/data/' to the path. This is a key difference from the 'vault write' command, which requires the full path including 'data/'.

Answer

vault kv put secret/data/team api_key=abc123

Answer

vault write secret/data/team api_key=abc123

Answer

vault write secret/team api_key=abc123

Question 2

An admin wants to list all enabled authentication methods using the Vault API. Which curl command is correct?

Accepted Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auth. Option B is correct because the Vault API endpoint to list all enabled authentication methods is a GET request to `/v1/sys/auth`. This endpoint returns a map of all enabled auth methods, and the command uses the correct HTTP method (GET) and the required `X-Vault-Token` header for authentication.

Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auths

Answer

curl -X POST -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/sys/auth

Answer

curl -H "X-Vault-Token: s.abc123" https://vault.example.com:8200/v1/auth

Question 3

A user wants to log in using the userpass auth method with username 'jdoe' and password 'p@ssw0rd'. What is the correct API endpoint and request?

Accepted Answer

POST /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}. The userpass auth method in Vault requires a POST request to the login endpoint with the password provided in the JSON body. Option D correctly uses POST /v1/auth/userpass/login/jdoe with {"password":"p@ssw0rd"}, which matches the Vault API specification for authenticating against a userpass backend.

Answer

GET /v1/auth/userpass/login/jdoe with header "password: p@ssw0rd"

Answer

PUT /v1/auth/userpass/login/jdoe with JSON body {"password":"p@ssw0rd"}

Answer

POST /v1/auth/userpass/login/jdoe?password=p@ssw0rd

Question 4

A security team needs to create a token with a custom TTL of 1 hour and associate it with a policy named 'read-only'. Which Vault CLI command accomplishes this?

Accepted Answer

vault token create -policy=read-only -ttl=1h. Option A is correct because `vault token create -policy=read-only -ttl=1h` uses the correct Vault CLI syntax for creating a token with a custom TTL and associating it with a policy. The `-policy` flag specifies the policy name, and `-ttl=1h` sets the time-to-live to 1 hour, which is the standard format for duration in Vault CLI commands.

Answer

vault write auth/token/create policies=read-only ttl=1h

Answer

vault token create -policy=read-only -ttl 1h

Answer

vault create token -policy=read-only -ttl=1h

Question 5

An operator wants to enable the AWS auth method at the default path. Which curl command is correct?

Accepted Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws. Option D is correct because enabling an auth method at the default path requires a POST request to the `/v1/sys/auth/aws` endpoint with a JSON payload containing the `type` field set to `"aws"`. The POST method is used to create a new mount, and the trailing slash is optional but accepted. The `X-Vault-Token` header provides the necessary authentication token.

Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws/

Answer

curl -X PUT -H "X-Vault-Token: s.abc" -d '{"type":"aws"}' https://vault:8200/v1/sys/auth/aws

Answer

curl -X POST -H "X-Vault-Token: s.abc" -d '{"method":"aws"}' https://vault:8200/v1/sys/auth/aws

Question 6

Which TWO of the following are valid methods to authenticate to Vault using the CLI?

Accepted Answer

vault login -method=userpass username=jdoe. Option B is correct because `vault login -method=userpass username=jdoe` is the valid CLI command to authenticate using the userpass auth method, which prompts for the password interactively. Option E is correct because `vault login -method=ldap username=jdoe` is the valid CLI command to authenticate using the LDAP auth method, also prompting for the password. Both commands follow the standard `vault login -method=<type>` syntax required by the Vault CLI.

Answer

vault auth -method=token token=s.abc

Answer

vault authenticate -method=userpass username=jdoe

Answer

Setting environment variable VAULT_AUTH=s.abc

Question 7

Which THREE of the following are correct about using the Vault API to read a secret from KV v2 engine?

Accepted Answer

The response JSON contains a 'data' key with the secret values. Option A is correct because the KV v2 engine returns secret data nested under a 'data' key in the JSON response. This is a deliberate design to separate metadata (e.g., version, created_time) from the actual secret values, which are placed under 'data.data'. The Vault API always uses GET for reading secrets from KV v2, making option B correct. Option E is correct because the KV v2 engine requires the path to include '/data/' after the mount point (e.g., /v1/secret/data/mysecret) to distinguish read operations from metadata or delete operations.

Answer

The API path is /v1/secret/mysecret

Answer

The HTTP method used is POST

Question 8

Refer to the exhibit. A developer ran the command and received the JSON output. Which command would retrieve only the value of 'api_key' in plain text?

Accepted Answer

vault read -field=data.api_key secret/data/team. Option C is correct because the `vault read` command with `-field=data.api_key` uses dot notation to navigate the nested JSON structure returned by the KV v2 secrets engine at `secret/data/team`. The KV v2 engine wraps the actual data under a `data` key, so to extract the `api_key` value directly, you must specify the full path `data.api_key`. Without this, the command would either fail or return the entire JSON object.

Answer

vault read -field=api_key secret/team

Answer

vault read -field=api_key secret/data/team

Answer

vault read secret/data/team

Question 9

Refer to the exhibit. A user has a token that has the 'default' policy attached. What actions can the user perform on 'secret/data/team'?

Accepted Answer

Read and list only. The 'default' policy in Vault provides broad read and list capabilities across most paths, including 'secret/data/team'. It does not grant create, update, or delete permissions, which require explicit policy rules. Therefore, the user can only read and list secrets at that path.

Answer

No actions

Answer

Read only

Answer

Create, read, update, delete, list

Question 10

You are a Vault administrator for a large organization. Your team uses a centralized Vault cluster with multiple auth methods enabled, including userpass, LDAP, and approle. Recently, a developer reported that they are unable to authenticate using their userpass credentials, receiving the error 'permission denied'. The developer confirms the username and password are correct. Other developers using userpass can authenticate successfully. The Vault audit logs show that the authentication request for this developer is reaching Vault but failing with 'invalid password'. You have verified that the password is correct by resetting it via the Vault CLI. The developer's userpass entry exists and is not disabled. Which of the following is the most likely cause and correct course of action?

Accepted Answer

The developer's account is locked due to too many failed login attempts. The admin should unlock the account using 'vault write auth/userpass/users//unlock'.. Option D is correct because Vault's userpass auth method supports account locking after a configurable number of failed login attempts (default is 0, meaning no lockout, but if set to a positive integer via `max_attempts`, the account becomes locked). The audit log shows 'invalid password' despite the password being verified as correct, and other users can authenticate, which points to a lockout rather than a password or user entry issue. The admin can unlock the account using `vault write auth/userpass/users//unlock` to restore access.

Answer

The developer's user entry is disabled. The admin should enable it using 'vault write auth/userpass/users/<username>/enable'.

Answer

The developer's password has expired. The admin should update the password with a new one.

Answer

The developer's password hash is corrupted. The admin should delete and recreate the user entry.

Question 11

Which TWO of the following Vault CLI commands can be used to write data to Vault?

Accepted Answer

vault write. Option D is correct because `vault write` is the primary Vault CLI command for writing data directly to a specified path, including secrets, policies, or configuration. Option E is correct because `vault kv put` is the dedicated command for writing key-value pairs to the KV secrets engine, which is a common use case for storing secret data.

Answer

vault set

Answer

vault put

Answer

vault push

Question 12

A DevOps engineer is tasked with automating the rotation of a static secret stored in Vault's KV secrets engine (version 2). The secret is currently stored at path 'secret/data/app/config' with keys 'username' and 'password'. The engineer wants to update the 'password' key using the Vault CLI from a CI/CD pipeline. The pipeline uses a token with a policy that grants 'create', 'update', and 'read' capabilities on 'secret/data/app/*'. Which CLI command should the engineer use to update only the 'password' key, leaving other keys unchanged?

Accepted Answer

vault kv patch secret/data/app/config password=newpass. Option C is correct because `vault kv patch` is specifically designed for KV v2 secrets engines to update individual keys without overwriting other keys. It performs a read-modify-write operation under the hood, sending a PATCH request to the API, which only modifies the specified fields. The policy grants 'create', 'update', and 'read' on 'secret/data/app/*', which aligns with the required capabilities for patching.

Answer

vault kv put secret/data/app/config password=newpass

Answer

vault update secret/data/app/config password=newpass

Answer

vault write secret/data/app/config password=newpass

Question 13

A DevOps engineer is troubleshooting a Vault CLI command that is failing with the error 'Error writing data: Error making API request'. The engineer has verified that the Vault token is valid and unexpired. Which of the following is the most likely cause of this error?

Accepted Answer

The policy attached to the token does not allow writing to the specified path.. The error 'Error writing data: Error making API request' with a valid, unexpired token typically indicates an authorization failure. Vault enforces policy-based access control; if the token's attached policy does not include a 'write' or 'create' capability on the specified path, the API will reject the request with this generic error. Since the token is valid and not revoked, the most likely cause is insufficient permissions.

Answer

The Vault token has been revoked.

Answer

Network connectivity to Vault is intermittent, causing timeouts.

Answer

The secret engine at that path has not been enabled.

Question 14

A company uses Vault to manage secrets for multiple applications. A new security policy requires that all human users authenticate using LDAP and that all machine-to-machine authentication uses AppRole. An administrator has configured an LDAP auth method at 'ldap/' and an AppRole at 'approle/'. The administrator creates a role 'web-app' with a secret ID TTL of 30 days and a token TTL of 1 hour. After deploying the web application, the application successfully logs in using the AppRole role ID and secret ID, retrieves a token, and reads secrets. However, after 1 hour, the application begins receiving 'permission denied' errors when trying to read secrets. The application logs show that it is using the same token obtained during initial login. Which action should the administrator take to resolve this issue?

Accepted Answer

Configure the application to renew the token before it expires by calling the 'auth/token/renew' endpoint.. Option D is correct because the application's token has a TTL of 1 hour, and once it expires, Vault will reject any further requests using that token. The application must renew the token before it expires by calling the 'auth/token/renew' endpoint, which extends the token's lifetime (up to the maximum TTL configured on the role). This is the standard pattern for long-running applications using short-lived tokens.

Answer

Increase the secret ID TTL to 60 days so the application can re-authenticate less frequently.

Answer

Set the token TTL to 0 (unlimited) so the token never expires.

Answer

Have the application re-authenticate with the AppRole using the same secret ID after the token expires.

Question 15

Drag and drop the steps to set up Vault's Transit secrets engine for encryption/decryption into the correct order.

Question 16

Match each Vault policy capability to its permission.

Question 17

A developer wants to authenticate to Vault using LDAP credentials. Which CLI command should they use?

Accepted Answer

vault login -method=ldap username=john. Option A is correct because `vault login -method=ldap username=john` is the standard Vault CLI command to authenticate using LDAP credentials. This command triggers the LDAP auth method, prompting the user for their password (or accepting it via `-password` flag) and returning a Vault token upon successful authentication against the configured LDAP server.

Answer

vault token create -policy=ldap

Answer

vault write auth/ldap/login username=john

Answer

vault auth enable ldap

Question 18

An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?

Accepted Answer

PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}. Option C is correct because creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.

Answer

POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}

Answer

POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}

Answer

PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}

Question 19

A user receives 'permission denied' when running 'vault write secret/data/myapp value=123'. The user's token has a policy that includes 'path "secret/data/*" { capabilities = ["read", "list"] }'. What is the most likely cause?

Accepted Answer

The path requires create or update capability.. The user's policy grants only 'read' and 'list' capabilities on the path 'secret/data/*'. The 'vault write' command requires either 'create' or 'update' capability (or both) on the path. Since the policy lacks these capabilities, Vault returns a 'permission denied' error, even though the token is valid and the secret engine is mounted.

Answer

The user is not authenticated.

Answer

The secret engine is not mounted.

Answer

The token is expired.

Question 20

A team wants to retrieve a dynamic database credential from Vault. Which CLI command should be used?

Accepted Answer

vault write database/creds/readonly. Option C is correct because Vault uses the `vault write` command to generate dynamic credentials from a database secrets engine. The `database/creds/readonly` path triggers the generation of a new credential (username/password) for the configured role, and the response includes the lease ID, username, and password. Unlike static secrets, dynamic credentials are created on demand and require a write operation to the role path.

Answer

vault list database/creds/readonly

Answer

vault generate database/creds/readonly

Answer

vault read database/creds/readonly