VA-003 Utilize Vault CLI and API Practice Question
A security team needs to automate the rotation of a database password stored in Vault. The password is currently written as a static secret at 'database/creds/prod'. They want to use the Vault API to read and rewrite the secret, ensuring that the previous version is preserved for audit. The script must handle the case where the secret path may not exist. Which approach should they use?
⚠ Common exam trap
A common misconception is that PUT is the standard write operation in Vault, but in KV v2, POST is used to create new versions while preserving history, whereas PUT overwrites the entire secret and destroys previous versions unless using advanced features like `cas` (check-and-set).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use POST to write a new version at the secret path, which automatically preserves previous versions
Vault's KV Secrets Engine (version 2) uses POST to create a new version of a secret at a given path, automatically preserving previous versions for audit. This approach ensures the password is rotated without data loss, and the API handles non-existent paths by creating the secret if it does not exist, satisfying the requirement to handle missing paths gracefully.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use POST to write a new version at the secret path, which automatically preserves previous versions
Why this is correct
POST is the correct method to create a new version in KV v2, preserving history.
- ✗
Use GET on the secret path, then PUT with the new data including the old version's data
Why it's wrong here
This is unnecessarily complex and may not preserve the old version as a separate version.
- ✗
Use DELETE to remove the old secret, then POST to create a new one
Why it's wrong here
DELETE would permanently remove all versions.
- ✗
Use PUT to write the new password directly, then use GET to verify
Why it's wrong here
PUT would overwrite without checking existence, potentially losing the old version.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.