VA-003 Compare and configure secrets engines Practice Question
A company is using Vault's PKI secrets engine to issue certificates for internal services. They have set up a root CA and an intermediate CA. The intermediate CA's certificate expires soon, and they need to renew it. They generate a new intermediate CSR and have it signed by the root CA. After importing the new intermediate certificate, the team notices that certificates issued by the old intermediate are still valid but new certificate requests fail with 'no valid intermediate CA found'. What step did the team likely miss?
⚠ Common exam trap
HashiCorp often tests the specific API workflow of Vault's PKI secrets engine, where candidates confuse the CSR generation and signing process with the final step of importing the signed certificate via `set-signed`, assuming that simply having the signed certificate in the mount path is sufficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
They forgot to set the new intermediate certificate as the issuing CA by writing it to the correct path (e.g., pki/intermediate/set-signed).
In Vault's PKI secrets engine, after the root CA signs a new intermediate certificate, the signed certificate must be explicitly set as the issuing CA by writing it to the `pki/intermediate/set-signed` endpoint. Without this step, Vault still references the old (expiring) intermediate certificate and cannot sign new ones, resulting in the 'no valid intermediate CA found' error. Simply importing the signed certificate is not sufficient; it must be configured as the active issuing CA. Option B is incorrect because failing to update CRL distribution points would affect CRL distribution, not cause a 'no valid intermediate CA found' error during certificate issuance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
They forgot to set the new intermediate certificate as the issuing CA by writing it to the correct path (e.g., pki/intermediate/set-signed).
Why this is correct
After signing the CSR, the signed certificate must be written back to the intermediate mount via set-signed endpoint.
- ✗
They forgot to update the CRL distribution points on the new intermediate.
Why it's wrong here
Incorrect. Failing to update CRL distribution points does not cause the 'no valid intermediate CA found' error. That error occurs when Vault cannot find a valid intermediate certificate configured to issue new certificates, which is specifically resolved by performing the `set-signed` step.
- ✗
They changed the root CA's key algorithm, causing incompatibility.
Why it's wrong here
The root CA's key algorithm is unchanged; the intermediate uses a key pair compatible with the root.
- ✗
They did not revoke the old intermediate CA before importing the new one.
Why it's wrong here
Revoking the old intermediate is not required; it can coexist until its expiration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.