VA-003 Utilize Vault CLI and API Practice Question
A security team must automate periodic credential rotation for a database. The rotation script should run on a server that cannot have the Vault binary installed but can make HTTP requests. Which approach should they use?
⚠ Common exam trap
HashiCorp often tests the distinction between using the Vault API directly versus relying on the Vault CLI or Agent, trapping candidates who assume that automation always requires the Vault binary or that Vault Agent is a lightweight alternative that doesn't need installation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Vault API with proper authentication.
The server can make HTTP requests, allowing it to interact with Vault's RESTful API directly without installing the Vault binary. The Vault API supports token-based authentication (e.g., using X-Vault-Token header) and can be used to programmatically rotate database credentials by calling the appropriate endpoint (e.g., POST /v1/database/rotate-root/:name). This approach satisfies the constraint of no binary installation while enabling secure, automated credential rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the Vault CLI with curl to wrap commands.
Why it's wrong here
This approach is unnecessary; the Vault CLI is not installed, and curl can interact directly with the API without wrapping CLI commands. It adds complexity and does not satisfy the constraint of no binary installation.
- ✗
Install Vault binary on the server and use CLI.
Why it's wrong here
Installing the Vault binary violates the requirement that the server cannot have the Vault binary installed. This option is not feasible.
- ✓
Use the Vault API with proper authentication.
Why this is correct
Using the Vault API directly with proper authentication (e.g., using curl with an X-Vault-Token header) allows the server to interact with Vault via HTTP requests without installing any binary. This satisfies the constraint and enables automated credential rotation by calling the appropriate endpoint.
- ✗
Use Vault Agent to handle rotation.
Why it's wrong here
Vault Agent is a client daemon that requires the Vault binary to be installed, which violates the constraint. Additionally, Agent is typically used for tasks like caching and auto-authentication, not for direct database credential rotation in this scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.