VA-003 Practice Questions

Question 1

An administrator wants to use Vault's authentication method that allows users to log in with their corporate credentials via a federated identity system. The credentials are stored in an external identity provider (IdP) and Vault should not store any passwords. Which authentication method should be configured?

Accepted Answer

OIDC authentication. OIDC (OpenID Connect) authentication is the correct choice because it enables federated identity, allowing users to log in with corporate credentials managed by an external IdP (e.g., Azure AD, Okta) without Vault storing any passwords. Vault acts as a relying party, delegating authentication to the IdP and receiving identity tokens, which aligns with the requirement for a passwordless, federated approach.

Answer

LDAP authentication

Answer

Userpass authentication

Answer

Token authentication

Question 2

A security engineer wants to ensure that all requests to Vault are logged for compliance. Which component must be configured?

Accepted Answer

Audit Device. An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

Answer

Secrets Engine

Answer

Storage Backend

Answer

Auth Method

Question 3

Drag and drop the steps to configure Vault's AWS secrets engine to generate IAM credentials into the correct order.

Accepted Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then create a role, then generate IAM credentials, then rotate root credentials.. The correct sequence for configuring Vault's AWS secrets engine to generate IAM credentials is: first enable the AWS secrets engine at a path, then configure the root IAM credentials that Vault will use to interact with AWS, then create a role that defines the permissions for generated credentials, then generate the actual IAM credentials using that role, and finally rotate the root credentials to enhance security. This order ensures that each step's prerequisites are met.

Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then generate IAM credentials, then create a role, then rotate root credentials.

Answer

Enable the AWS secrets engine, then create a role, then configure the root IAM credentials, then generate IAM credentials, then rotate root credentials.

Answer

Configure the root IAM credentials, then enable the AWS secrets engine, then create a role, then generate IAM credentials, then rotate root credentials.

Question 4

An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

Accepted Answer

AWS IAM is eventually consistent and the user may take a few seconds to propagate.. AWS IAM is an eventually consistent system. When Vault uses the AWS secrets engine to create an IAM user via the CreateUser API call, the user is not immediately available across all AWS services due to propagation delays. This eventual consistency means the generated IAM user may take a few seconds to be fully usable, which is a known behavior of AWS IAM.

Answer

The Vault write operation failed due to network latency.

Answer

The TTL on the role is too short.

Answer

Vault must wait for the AWS secret key to be rotated before returning the user.

Question 5

A security team wants to issue tokens that can be used for exactly 10 API calls, after which they must be renewed. Which two token parameters should be set on the token role?

Accepted Answer

ttl and renewable. To meet the requirement that tokens can be used for exactly 10 API calls and then be renewed, you must avoid setting `num_uses` because tokens with `num_uses` set cannot be renewed. Instead, set `ttl` to a short duration (e.g., 1 minute) and `renewable` to true. This allows the token to be used for a limited time (though not exactly 10 calls) and be renewed repeatedly. While this does not enforce exactly 10 calls, it aligns with the constraint that `num_uses` prevents renewal, making this the only viable pair among the options.

Answer

period and num_uses

Answer

ttl and num_uses

Answer

num_uses and renewable

Question 6

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Accepted Answer

Barrier encryption key. The barrier encryption key is the master key used to encrypt and decrypt the Vault data encryption key (DEK), which in turn encrypts all data written to the storage backend. Without this key, Vault cannot protect data at rest because the DEK would be stored in plaintext. It is a fundamental component of Vault's security architecture, ensuring that even if the storage backend is compromised, the data remains encrypted.

Answer

Audit device

Answer

Authentication method

Question 7

A user attempts to read a secret at path 'secret/data/app' and receives a 403 Forbidden error. What is the most likely cause?

Accepted Answer

The token's policy does not grant read capability on that path. A 403 Forbidden error in Vault indicates that the token used for the request is valid and the path exists, but the token's attached policy does not grant the required 'read' capability on that specific path. This is a policy enforcement action by Vault's ACL system, which explicitly denies access when the policy lacks a matching 'read' rule for the path.

Answer

The secret engine is not mounted at 'secret/'

Answer

The secret key does not exist

Answer

The token has expired

Question 8

A company wants to grant developers the ability to read and write secrets under the path 'secret/dev/*', but only they should be able to delete their own secrets. Which policy design best meets this requirement?

Accepted Answer

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "secret/dev/{{identity.entity.name}}/*" { capabilities = ["delete"] }. It grants full CRUDL access to 'secret/dev/*' for reading and writing, but then restricts delete to only the path 'secret/dev/{{identity.entity.name}}/*', which uses the entity's name to ensure developers can only delete secrets under their own sub-path. This leverages Vault's identity entity name templating to enforce per-developer delete scoping.

Answer

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] }

Answer

path "secret/dev/*" { capabilities = ["read", "list"] }

Answer

path "secret/dev/+/{{identity.entity.name}}" { capabilities = ["create", "read", "update", "delete"] }

Question 9

An administrator wants to write a secret 'myapp' with value 'password=pass123' to the KV v2 secret engine mounted at 'secret/'. Which command should they use?

Accepted Answer

vault kv put secret/myapp password=pass123. `vault kv put` is the proper command to write or update a secret in the KV v2 secrets engine. The KV v2 engine requires the `put` subcommand to create or overwrite a secret at the specified path, and the syntax `vault kv put secret/myapp password=pass123` correctly writes the key-value pair to the path `secret/myapp` under the mounted engine at `secret/`.

Answer

vault kv write secret/myapp password=pass123

Answer

vault kv create secret/myapp password=pass123

Answer

vault write secret/myapp password=pass123

Question 10

When running Vault in development mode, which storage backend is used by default?

Accepted Answer

In-memory backend. When Vault is started in development mode using `vault server -dev`, it defaults to an in-memory storage backend. This is explicitly designed for local testing and development, as all data is stored in memory and lost when the process terminates. The in-memory backend requires no configuration and is automatically selected when no `-dev` flag overrides are provided.

Answer

Raft integrated storage

Answer

File system backend at /var/lib/vault

Answer

Consul backend

Question 11

An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?

Accepted Answer

POST /v1/auth/token/renew. The `POST /v1/auth/token/renew` endpoint is the standard Vault API call to extend the Time-To-Live (TTL) of an existing token, which is a core token lifecycle operation. This endpoint accepts the token to renew in the request body and returns a new lease duration, adhering to Vault's token management design.

Answer

PUT /v1/auth/token/roles

Answer

DELETE /v1/auth/token/revoke

Question 12

A large e-commerce company uses Vault to manage database credentials for microservices. They have a Vault cluster of 5 nodes using Integrated Storage (Raft). To increase capacity, they add a sixth node to the cluster. Shortly after, they notice intermittent 'no leader' errors in the Vault logs, and some clients experience failures when reading secrets. The cluster was functioning correctly before the addition. What is the most likely cause and the recommended action?

Accepted Answer

The cluster now has an even number of nodes, which can cause split-brain scenarios and leader election issues. Recommended action: remove the new node to revert to 5 nodes, or add a seventh node to make it odd.. The Vault cluster uses Integrated Storage (Raft), which relies on a consensus protocol that requires an odd number of nodes to maintain a quorum. Adding a sixth node creates an even number, increasing the risk of a split-brain scenario where no single group can achieve a majority, leading to 'no leader' errors and client failures. The recommended action is to either remove the new node to revert to 5 nodes or add a seventh node to restore an odd count.

Answer

The cluster's Raft protocol requires all nodes to be voters, but the new node is a non-voter. Recommended action: promote the new node to voter.

Answer

The new node has a different storage performance, causing it to lag behind and not participate in consensus. Recommended action: replace the new node with a faster instance.

Answer

The new node was not properly joined to the cluster and is running as a standalone server. Recommended action: re-run the join command and ensure the node is part of the cluster.

Question 13

Which TWO of the following are valid uses of a token accessor? (Select exactly 2 options.)

Accepted Answer

Lookup token properties. A token accessor is a non-sensitive reference to a Vault token that allows certain operations without exposing the token ID itself. The `lookup` and `revoke` operations are valid uses of a token accessor because they can be performed using the accessor via the Vault API or CLI (e.g., `vault token lookup -accessor ` and `vault token revoke -accessor `). These operations do not require the actual token value, preserving security while enabling token management.

Answer

Wrap the token

Answer

Create a child token

Answer

Renew the token

Question 14

Which TWO of the following are features of the AWS secrets engine compared to the Azure secrets engine?

Accepted Answer

Can generate IAM users with custom policies. The AWS secrets engine can dynamically generate IAM users with custom policies attached, allowing fine-grained access control for applications. Option E is correct because the engine can generate STS temporary credentials for cross-account access, enabling secure, time-limited access to AWS resources in different accounts.

Answer

Supports federation via SAML with Azure AD

Answer

Provides native integration with Azure Key Vault for key management

Answer

Allows connection to AWS via IAM instance profiles

Question 15

An administrator needs to issue tokens that are automatically renewable by the client (so they can stay alive as long as renewed) but must expire no later than 30 days. Which TWO token parameters should be configured on the token role?

Accepted Answer

max_ttl. (max_ttl) is correct because it enforces the absolute maximum lifetime of the token, ensuring it expires no later than 30 days regardless of renewals. Option D (period) is correct because setting a period makes the token automatically renewable by the client, allowing it to stay alive as long as it is renewed before the period expires. Together, period enables automatic renewal behavior and max_ttl caps the total lifespan at 30 days.

Answer

renewable

Answer

ttl

Answer

num_uses

HashiCorp Vault Associate VA-003 practice test

Three ways to study

Study VA-003 by domain

Study VA-003 by topic

Compare authentication methods practice questions

Assess Vault tokens practice questions

Create Vault policies practice questions

Manage Vault leases practice questions

Compare and configure secrets engines practice questions

Utilize Vault CLI and API practice questions

Explain Vault architecture practice questions

Explain encryption as a service practice questions

VA-003 fundamentals practice questions

VA-003 scenario practice questions

VA-003 troubleshooting practice questions

Top VA-003 questions

HashiCorp Vault Associate VA-003 practice questions