20+ practice questions focused on Compare and configure secrets engines — one of the most tested topics on the HashiCorp Vault Associate VA-003 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Compare and configure secrets engines PracticeA SaaS startup uses Vault to manage secrets for their microservices architecture. They have enabled the KV v2 secrets engine at 'secret/' and the database secrets engine at 'database/'. Developers often need to read application configuration from 'secret/app/config' and database credentials from 'database/creds/app-role'. Recently, the security team mandated that all secrets must be encrypted at rest using Vault's seal mechanism. They configured Vault to use AWS KMS as the seal. After enabling the seal, they noticed that reading from 'secret/app/config' still works, but reading from 'database/creds/app-role' returns an error: 'Error making API request: Code: 500. Errors: * 1 error occurred: * failed to decrypt data'. What is the most likely cause?
Explanation: If the AWS KMS key used for the seal has been rotated, Vault may still be able to decrypt the master key (using the old key) and thus read static secrets like those in KV v2. However, the database secrets engine requires decrypting its stored configuration (e.g., database password) each time a new credential is generated. If that configuration was encrypted before the key rotation and the old key is no longer available (e.g., disabled or deleted), Vault will fail to decrypt it, resulting in the observed error. The KV v2 engine may succeed because its data was read after the rotation or was cached, or the key rotation did not affect the specific ciphertext.
A DevOps team is configuring the AWS secrets engine to generate IAM users with dynamic credentials. They want to ensure that each Vault-generated IAM user is automatically deleted when its lease expires. Which TWO configuration steps are required to achieve this? (Choose two.)
Explanation: Setting the role's 'ttl' parameter to a finite duration ensures that the Vault-generated IAM user credentials expire after that time, triggering the lease expiration and automatic deletion. Option E is incorrect because including the 'delete' operation in 'policy_arns' or a custom inline policy grants permissions to the IAM user itself, not to Vault. Vault uses its own AWS credentials to perform the deletion, which must be configured separately in the AWS secrets engine's configuration.
Refer to the exhibit. A Vault administrator ran the commands shown. What is the result?
Explanation: The command `vault secrets enable -path=internal/aws aws` enables the AWS secrets engine at the custom path `internal/aws`. The subsequent configuration sets up a role with `credential_type=iam_user` and `policy_arn=arn:aws:iam::aws:policy/AdministratorAccess`, which means the engine will generate IAM users with full admin access. The path is custom, and the engine is enabled successfully.
A DevOps team uses Vault to store database credentials via the database secrets engine. They notice that after the default lease duration, applications receive errors when trying to connect. The team wants to ensure that applications automatically renew leases before expiration. What should they do?
Explanation: Vault Agent is designed to automatically handle secret renewal and lifecycle management. It runs as a sidecar or daemon that periodically checks the lease duration and renews it before expiration, ensuring applications always have valid credentials without manual intervention or custom scripting.
A security team wants to store static secrets like API keys in Vault. They need the secrets to be versioned and support rollback. Which secrets engine should they use?
Explanation: KV v2 is the correct choice because it is designed specifically for storing static secrets with built-in versioning and rollback capabilities. Unlike KV v1, which overwrites data without preserving history, KV v2 retains a configurable number of secret versions, allowing administrators to undelete or roll back to a previous version using the `vault kv rollback` command or API calls.
+15 more Compare and configure secrets engines questions available
Practice all Compare and configure secrets engines questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Compare and configure secrets engines. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Compare and configure secrets engines questions on the VA-003 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Compare and configure secrets engines is tested as part of the HashiCorp Vault Associate VA-003 blueprint. Practicing with targeted Compare and configure secrets engines questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free VA-003 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Compare and configure secrets engines is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Compare and configure secrets engines practice session with instant scoring and detailed explanations.
Start Compare and configure secrets engines Practice →