VA-003 Practice Questions

Question 1

Refer to the exhibit. A developer tries to renew a token and receives this error. The token was created using 'vault token create -type=batch'. What is the most likely cause of this error?

Accepted Answer

The token is a batch token. Batch tokens are non-persistent and do not have associated lease IDs, so they cannot be renewed. The error occurs because the developer attempted to renew a batch token using 'vault token renew', which is only valid for service tokens that have a lease and can be extended. The exhibit shows a renewal failure, and since the token was created with 'vault token create -type=batch', the most likely cause is that batch tokens are inherently non-renewable.

Answer

The token is a service token and has expired

Answer

The token is a periodic token and its period has expired

Answer

The token is an orphan token

Question 2

An organization wants to use Vault's dynamic database credentials to manage MySQL access. They have multiple application servers that need to connect to different databases. What is the best practice for configuring database roles to minimize the number of Vault mounts?

Accepted Answer

Create a single database mount and define multiple roles within it, each with different credential generation parameters.. Vault allows a single database mount (e.g., `database/`) to manage multiple database connections, and within that mount, you can define multiple roles. Each role can specify different credential generation parameters (e.g., username template, default TTL, max TTL, and allowed roles) for distinct databases or application servers. This minimizes the number of mounts while still providing fine-grained access control and isolation of credentials.

Answer

Use the same database mount but create a separate role per application server.

Answer

Create a separate database mount for each database to isolate credential generation.

Answer

Use a single role that generates credentials for all databases by using a wildcard in the username.

Question 3

What is the purpose of the `storage` stanza in a Vault server configuration file?

Accepted Answer

Defines where Vault stores encrypted data.. The `storage` stanza in a Vault server configuration file defines the backend where Vault stores all encrypted data, including secrets, tokens, and metadata. This backend can be a file system, Consul, Raft, or other supported storage backends, and it is the persistent layer that holds the encrypted data after it has been processed by the seal mechanism. Without a properly configured `storage` stanza, Vault cannot persist any data and will fail to start.

Answer

Defines the encryption algorithm for secrets.

Answer

Defines the seal mechanism.

Answer

Defines the listener address.

Question 4

Which Vault CLI command is used to authenticate a user with a username and password to the userpass auth method?

Accepted Answer

vault login -method=userpass username=alice password=secret. `vault login -method=userpass` is the standard Vault CLI command to authenticate against the userpass auth method, passing the username and password as parameters. This command triggers the login endpoint (`/v1/auth/userpass/login/:username`) and returns a client token upon successful authentication.

Answer

vault auth userpass username=alice password=secret

Answer

vault token create -policy=userpass

Answer

vault authenticate userpass username=alice password=secret

Question 5

A user with this policy wants to delete secrets under the 'team/' path. Which additional capability must be added?

Accepted Answer

delete. The user's policy grants 'create' and 'update' capabilities on 'team/*', but not 'delete'. In Vault's ACL policy system, each operation (create, read, update, delete, list, sudo) must be explicitly allowed. Since 'delete' is missing, the user cannot delete secrets under 'team/'. Adding the 'delete' capability to the policy is required.

Answer

sudo

Answer

list

Answer

patch

Question 6

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Accepted Answer

Enable AppRole authentication, create a role, retrieve the RoleID, generate a SecretID, then login.. First enable the auth method, then create the role, then retrieve the RoleID, generate a SecretID, and finally login.

Answer

Create a role, enable AppRole authentication, retrieve the RoleID, generate a SecretID, then login.

Answer

Enable AppRole authentication, create a role, generate a SecretID, retrieve the RoleID, then login.

Answer

Enable AppRole authentication, create a role, retrieve the RoleID, login, then generate a SecretID.

Question 7

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Accepted Answer

Reducing the default lease TTL. Option A is correct because reducing the default lease TTL shortens the lifetime of newly issued leases, so they expire and are revoked sooner, decreasing the count of active leases at any given time. Option B is correct because revoking a lease explicitly invalidates it, immediately removing it from the set of active leases tracked by Vault. Option C is incorrect because creating a new lease adds another active lease rather than reducing the count. Option D is incorrect because increasing the max lease TTL allows leases to live longer, which tends to keep more leases active. Option E is incorrect because renewing a lease extends its lifetime, keeping it active instead of reducing the number of active leases.

Answer

Creating a new lease

Answer

Increasing the max lease TTL

Answer

Renewing a lease

Question 8

A Vault cluster uses Consul for HA. After a brief network partition, a standby node loses contact with the active node. What does the standby node do after a timeout?

Accepted Answer

It seals itself.. In a Vault cluster using Consul for high availability, only the active node serves requests. When a standby node loses contact with the active node due to a network partition, it cannot verify the active node's health or its own leadership status. After a configurable timeout (default 10 seconds), the standby node seals itself to prevent serving stale or inconsistent data, ensuring data integrity and security.

Answer

It becomes the active node.

Answer

It continues to serve requests.

Answer

It replicates data from the storage backend.

Question 9

Refer to the exhibit. What seal mechanism is configured for this Vault instance?

Accepted Answer

AWS KMS auto-unseal. The exhibit shows a Vault instance configured with `seal "awskms"` and a `region` and `kms_key_id` specified. This indicates that AWS KMS is used as the auto-unseal mechanism, where Vault delegates the unsealing process to AWS Key Management Service, eliminating the need for manual Shamir key shares.

Answer

HSM seal via PKCS#11

Answer

Shamir seal with default shares

Answer

No seal; Vault is in insecure mode

Question 10

Drag and drop the steps to initialize and unseal a Vault server for the first time into the correct order.

Accepted Answer

Start the server, then initialize Vault, then distribute the unseal keys, then unseal the Vault, then verify the status.. The correct sequence for initializing and unsealing a Vault server for the first time is: start the server, initialize Vault (which generates unseal keys), distribute the unseal keys to key holders, unseal the Vault using a threshold of keys, then verify the Vault is unsealed. This ensures proper security and operational readiness.

Answer

Initialize Vault, then start the server, then distribute the unseal keys, then unseal the Vault, then verify the status.

Answer

Start the server, then initialize Vault, then unseal the Vault, then distribute the unseal keys, then verify the status.

Answer

Start the server, then distribute the unseal keys, then initialize Vault, then unseal the Vault, then verify the status.

Question 11

Drag and drop the steps to create and use a periodic service token in Vault into the correct order.

Accepted Answer

Create role, generate token, use token, renew periodically. First create the role, then generate a token with a TTL, use it, and renew periodically.

Answer

Generate token, create role, use token, renew periodically

Answer

Create role, use token, renew periodically, generate token

Answer

Generate token, use token, renew periodically, create role

Question 12

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Accepted Answer

Barrier encryption key. Vault requires a storage backend (C) because all encrypted data — secrets, tokens, and configuration — must be persisted somewhere, and Vault itself never stores plaintext there. The barrier encryption key (B) is the root cryptographic material used by Vault's barrier to encrypt and decrypt everything written to that storage backend, so without it no data-at-rest encryption is possible. A seal mechanism (D) is also required because Vault starts in a sealed state and the seal/unseal process protects the barrier key (typically via Shamir secret sharing or an auto-unseal KMS), controlling access to the encryption key. An audit device (A) only logs requests and responses for compliance and is not needed to encrypt data at rest, and an authentication method (E) only verifies client identity to issue tokens, so neither is required for encryption at rest.

Answer

Audit device

Answer

Authentication method

Question 13

Which TWO of the following are features of the AWS secrets engine compared to the Azure secrets engine?

Accepted Answer

Can generate IAM users with custom policies. Option D is correct because the Vault AWS secrets engine can dynamically create IAM users and attach custom IAM policies to them, giving fine-grained, per-credential permissions that the Azure secrets engine (which issues service principals/roles) does not provide in the same IAM-user form. Option E is correct because the AWS secrets engine can issue STS temporary credentials via AssumeRole, including cross-account access through role ARNs, a capability specific to AWS's STS model and not offered by the Azure secrets engine. Option A is incorrect because SAML federation with Microsoft Entra ID is an Azure/identity-provider feature, not a capability of the AWS secrets engine. Option B is incorrect because native Azure Key Vault integration belongs to the Azure secrets engine, not the AWS one. Option C is incorrect because IAM instance profiles are used by EC2 instances to obtain credentials from the instance metadata service, not a connection method exposed as a feature of the Vault AWS secrets engine.

Answer

Supports federation via SAML with Microsoft Entra ID

Answer

Provides native integration with Azure Key Vault for key management

Answer

Allows connection to AWS via IAM instance profiles

Question 14

An organization is implementing Vault policies for the first time. They want to ensure that policies are easy to manage and follow the principle of least privilege. Which approach should they take when creating policies?

Accepted Answer

Create separate policies for each application and use group aliases to attach them.. It aligns with the principle of least privilege by creating separate policies for each application, ensuring that each application only has access to the specific paths and capabilities it requires. Using group aliases to attach these policies allows for centralized management and simplifies policy updates, as changes can be made at the group level rather than per user or token. This approach also leverages Vault's identity-based policies, which are evaluated based on the entity's group memberships, providing a scalable and maintainable policy structure.

Answer

Create policies with broad paths and then restrict via ACL tokens.

Answer

Create a single policy with a wildcard path '*' and full capabilities for all administrators.

Answer

Create a single policy with all paths and capabilities for all users.

Question 15

A DevOps engineer configures the AWS secrets engine to assume a specific IAM role for generating dynamic credentials. The engine is enabled and the root configuration is set. Which parameter is essential in the role configuration to allow assuming the IAM role?

Accepted Answer

arn. The `arn` parameter is essential in the role configuration for the AWS secrets engine because it specifies the Amazon Resource Name (ARN) of the IAM role that Vault will assume to generate dynamic credentials. Without this parameter, Vault cannot identify which IAM role to assume via AWS STS AssumeRole API, making dynamic credential generation impossible.

Answer

role_type

Answer

credential_type

Answer

inline_policy

HashiCorp Vault Associate VA-003 practice test

Three ways to study

Study VA-003 by domain

Study VA-003 by topic

Compare and configure secrets engines practice questions

Compare authentication methods practice questions

Create Vault policies practice questions

Assess Vault tokens practice questions

Manage Vault leases practice questions

Utilize Vault CLI and API practice questions

Explain encryption as a service practice questions

Explain Vault architecture practice questions

VA-003 fundamentals practice questions

VA-003 scenario practice questions

VA-003 troubleshooting practice questions

Top VA-003 questions

HashiCorp Vault Associate VA-003 practice questions