VA-003 Utilize Vault CLI and API Practice Question
A team wants to retrieve a dynamic database credential from Vault. Which CLI command should be used?
⚠ Common exam trap
HashiCorp often tests the misconception that `vault read` is used for all secret retrieval, but dynamic secrets require a `vault write` because the operation creates a new credential rather than reading an existing one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault write database/creds/readonly
Vault uses the `vault write` command to generate dynamic credentials from a database secrets engine. The `database/creds/readonly` path triggers the generation of a new credential (username/password) for the configured role, and the response includes the lease ID, username, and password. Unlike static secrets, dynamic credentials are created on demand and require a write operation to the role path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vault list database/creds/readonly
Why it's wrong here
Incorrect. `vault list` is used to list available paths or roles, not to generate credentials. It would list roles under the path, not produce a new credential.
- ✗
vault generate database/creds/readonly
Why it's wrong here
Incorrect. `vault generate` is not a valid Vault CLI command. Dynamic credentials are generated using `vault write`.
- ✓
vault write database/creds/readonly
Why this is correct
Correct. Dynamic database credentials are generated by writing to the role path. Vault creates a new credential each time, returning lease details, username, and password.
- ✗
vault read database/creds/readonly
Why it's wrong here
Incorrect. `vault read` retrieves static secrets but does not generate dynamic credentials. Using it on a dynamic credential path does not produce a new credential.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.