VA-003 Utilize Vault CLI and API Practice Question
A DevOps engineer is troubleshooting a script that uses the Vault CLI to authenticate and read a secret. The script works when run manually from a terminal, but fails when executed by a CI/CD pipeline. The engineer has verified that the same environment variables (VAULT_ADDR, VAULT_TOKEN) are set in both environments. Which two of the following are likely causes of the failure? (Choose two.)
⚠ Common exam trap
A common pitfall in Vault exams is to confuse environment variable misconfiguration with network connectivity issues. Candidates may focus on token expiration or CLI version mismatches, but the real problem is often an incorrect VAULT_ADDR or network restrictions preventing access to the Vault server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pipeline does not have the VAULT_ADDR variable set correctly.
Even though the engineer verified that VAULT_ADDR is set in both environments, the CI/CD pipeline might have a different value or a typo in the variable definition. The Vault CLI uses the VAULT_ADDR environment variable to determine the endpoint for API calls; if it points to a wrong or unreachable address, authentication and secret retrieval will fail. This is a common misconfiguration when environment variables are injected differently in pipeline contexts versus manual shells.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The pipeline does not have the VAULT_ADDR variable set correctly.
Why this is correct
Without correct VAULT_ADDR, the CLI cannot connect to Vault, causing failure.
- ✗
The pipeline's VAULT_TOKEN is expired or revoked.
Why it's wrong here
The same token is used in both environments, so expiry/revocation would affect manual run too.
- ✗
The pipeline uses a different version of the Vault CLI.
Why it's wrong here
Version differences rarely cause permission errors; the CLI is largely backward-compatible.
- ✓
The pipeline runs in a restricted network that cannot reach the Vault server.
Why this is correct
Network restrictions can block API calls even if all variables are correct.
- ✗
The pipeline's shell does not have the vault binary in the PATH.
Why it's wrong here
This would cause a 'command not found' error, not a permission denied from Vault.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.