HashiCorp Vault Associate VA-003 (VA-003) — Questions 301–375

Why this answer

How to eliminate wrong answers

Option A is wrong because `vault list sys/mounts` is not a valid command; Vault's CLI uses `vault read sys/mounts` or `vault secrets list` to retrieve mount information, and `list` is not supported on that path. Option C is wrong because `vault secrets show` is not a valid Vault CLI command; the correct subcommand is `list`, not `show`.

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because setting num_uses to a high number controls the number of times a token can be used, not its lifetime; premature revocation here is a TTL issue, not a usage count issue. Option B is wrong because periodic tokens never expire only if they are continually renewed before their period ends, but they still respect max_ttl unless explicitly set to not expire, which is not the default behavior and would introduce security risks. Option C is wrong because decreasing the token TTL to 12 hours would cause the token to expire before the 12-hour renewal interval, leading to even more frequent loss of access; the renewal happens every 12 hours, so a 12-hour TTL would not allow a successful renewal before expiration.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because using a root IAM user violates security best practices and the principle of least privilege, as root users have unrestricted access; the 'federation_token' credential type generates temporary tokens but still relies on a highly privileged root user. Option C is wrong because using a static access key with the 'iam_user' credential type defeats the purpose of dynamic credential generation, as it reuses the same key across applications, increasing the risk of exposure and violating least privilege. Option D is wrong because the 'assumed_role' credential type generates temporary credentials for an IAM role, which is suitable for cross-account access or role-based scenarios, but it does not create individual IAM users per application, making it less granular for per-application isolation.

Why this answer

How to eliminate wrong answers

Option A is wrong because the system backend's `max_ttl` sets an upper limit on token lifetimes, but it cannot extend a token beyond the mount's configured TTL; it only caps it. Option C is wrong because the mount `token_ttl` is applied regardless of whether the user specifies `token_policies`; the TTL and policies are independent parameters. Option D is wrong because a periodic token has no explicit TTL and instead relies on a `period` setting, and the output shows a specific duration (768 hours), not a periodic token behavior.

Why this answer

How to eliminate wrong answers

Option A is wrong because token authentication requires the pipeline to manage a long-lived Vault token, which contradicts the requirement of not managing long-lived credentials. Option B is wrong because LDAP authentication requires the pipeline to have a username and password or a long-lived LDAP session, which again introduces long-lived credential management. Option C is wrong because AWS IAM authentication is designed for workloads running on AWS, not for a pipeline running inside a Kubernetes cluster, and it would require the pipeline to manage AWS IAM roles or keys.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because setting secret_id_num_uses to 0 (unlimited) would allow any number of uses per secret ID, but it does not address the race condition where concurrent jobs generate and consume secret IDs simultaneously; the underlying issue is contention, not usage limits. Option B is wrong because creating separate AppRoles for each pipeline job would require significant administrative overhead and does not scale; the problem is not the number of roles but the concurrent use of a single role with single-use secret IDs. Option D is wrong because increasing secret_id_ttl to 24h does not resolve the 'secret ID is used' error; the error occurs because the secret ID is consumed by another job, not because it has expired, and the TTL is already unlimited (0).

Why this answer

How to eliminate wrong answers

Option A is wrong because revoking the lease and requesting a new credential with a longer TTL does not address the root cause—the application's failure to renew the lease; the credential will still expire if not renewed. Option C is wrong because calling sys/leases/renew is the correct API endpoint for renewal, but the developer needs to modify the application to call it periodically, not just use the lease ID from the response; the option implies a manual or one-time action, not a programmatic renewal loop. Option D is wrong because increasing the TTL of the database role to 2 hours only extends the maximum lease duration, but the application still does not renew the lease, so the credential will still be revoked after the TTL (now 2 hours) unless renewed; the issue is the lack of renewal, not the TTL length.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because performance standby nodes do not participate in the Raft consensus or storage layer; they only forward write requests to the active node and cannot independently handle a full regional outage without the primary cluster. Option B is wrong because Disaster Recovery replication with Performance Replication requires manual promotion of a DR cluster to primary during an outage, violating the 'without manual intervention' requirement. Option C is wrong because even with an automated failover script, DR replication is designed for disaster recovery, not low-latency reads across regions, and the script introduces complexity and potential failure points that do not meet the requirement for automatic handling.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because `/v1/sys/auths` is not a valid Vault API endpoint; the correct path is `/v1/sys/auth` (without the trailing 's'). Option C is wrong because it uses `-X POST` instead of the required GET method; the `/v1/sys/auth` endpoint only supports GET and DELETE operations, not POST. Option D is wrong because `/v1/auth` is not a valid API path; the correct base path for listing auth methods is `/v1/sys/auth`.

Why this answer

How to eliminate wrong answers

Option B is wrong because the `renewable` flag is fully independent of TTL values; setting `max_ttl` equal to `default_ttl` does not override or disable the `renewable` flag. Option C is wrong because the `renewable` flag is applicable to both token auth methods and secrets engines (e.g., database, AWS, PKI) when generating dynamic credentials; it is not limited to token auth methods. Option D is wrong because the lease's `renewable` property is controlled by the role configuration of the secrets engine that issued the lease, not by the client token's `renewable` status; the client token's renewability is a separate concern.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the KV v2 secrets engine stores static secrets (like fixed passwords or API keys) and does not generate dynamic, time-limited credentials; it simply retrieves stored values without any built-in expiration or rotation mechanism. Option C is wrong because the Consul secrets engine generates dynamic credentials for Consul services (e.g., ACL tokens) and is not designed for database username/password authentication. Option D is wrong because the Identity secrets engine manages entity and group identities within Vault, not external database credentials; it handles aliases and policies, not dynamic secret generation.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because adding `-explicit-max-ttl=36h` imposes a hard upper limit on the token's lifetime, which contradicts the purpose of a periodic token that should be renewable indefinitely without a fixed maximum. Option C is wrong because `-ttl=36h` creates a non-periodic token with a fixed TTL of 36 hours, after which it expires and cannot be renewed beyond that time. Option D is wrong because `-explicit-max-ttl=36h` alone creates a token with a hard maximum lifetime but no periodic renewal behavior, so it does not meet the requirement for a periodic token.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B (AWS IAM) is wrong because it requires the CI/CD pipeline to have access to AWS IAM credentials (access key and secret key) or an IAM role with a trust policy, which still involves storing a secret or assuming a role that may not be short-lived. Option C (AppRole) is wrong because it requires a secret_id and role_id to be stored in the pipeline; while secret_id can be wrapped or have a TTL, the role_id is typically static and must be securely stored, contradicting the 'without storing a secret' requirement. Option D (Username & Password) is wrong because it requires storing a static password in the pipeline, which is a long-lived secret and violates the short-lived token requirement.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a node's Raft index cannot be ahead of the leader's in a properly functioning Raft cluster; the leader always has the most up-to-date log index, and if a node were ahead, it would indicate a split-brain scenario or corruption, which is not typical after a partition. Option C is wrong because Raft does not rely on clock synchronization for timeouts; it uses election timeouts based on randomized timers, and clock skew is not a factor in Raft's consensus algorithm. Option D is wrong because manual removal and re-addition is a recovery step for a permanently failed node, not the likely cause of a node failing to rejoin after a partition; the cluster should automatically handle rejoin if quorum is restored.

Why this answer

How to eliminate wrong answers

Option A is wrong because `-prefix` is a flag, not a positional argument; placing it after the path is syntactically incorrect. Option B is wrong because `vault lease revoke aws/creds/myrole` without the `-prefix` flag attempts to revoke a single lease with that exact ID, which does not exist (lease IDs are full UUIDs), so it will fail. Option D is wrong because `-path` is not a valid flag for `vault lease revoke`; the correct flag to revoke by prefix is `-prefix`.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because even if the secret already exists, the policy does not grant 'update' capability, so the write fails. Option B is wrong because the path matches, but capability matching is also required; the policy only allows 'read', not 'write'. Option D is wrong because the failure is due to missing 'create'/'update' capability, not missing 'list' capability; 'list' is irrelevant for a write operation.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because token auth is used for machine-to-machine authentication via pre-shared tokens, not for human users authenticating with corporate credentials. Option B is wrong because GitHub auth is an OAuth-based method for authenticating with GitHub identities, not for corporate Active Directory. Option C is wrong because userpass auth stores credentials locally in Vault's backend, requiring manual user management and not integrating with external directory services like Active Directory.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because T2 does not expire immediately; it continues to work as an orphan token until its own TTL expires. Option C is wrong because T2 is not revoked immediately; only T1 is revoked, and without the cascade flag, child tokens are not affected. Option D is wrong because T2's TTL remains unchanged at 2 hours; it is not reduced to match T1's remaining TTL, as Vault does not adjust child token TTLs upon parent revocation.

Why this answer

How to eliminate wrong answers

Option A is wrong because `vault kv put` performs a full write, which would overwrite the entire secret at 'secret/data/app/config', deleting the 'username' key if not included. Option B is wrong because `vault update` is not a valid Vault CLI command; the correct verb for writing data is `vault write`. Option D is wrong because `vault write` on a KV v2 path sends a PUT request that replaces the entire secret data, similar to `vault kv put`, and would remove the 'username' key.

Why this answer

How to eliminate wrong answers

Option B is wrong because the 'sudo' capability is not required for reading secrets; it is used for privileged operations like updating mount configurations or policies, not for standard read/list actions. Option C is wrong because insufficient TTL would cause token expiration, not a 'permission denied' error; the token is being used correctly as verified, so TTL is not the issue. Option D is wrong because the administrator has already verified that the service account has the correct Vault role attached, implying the role binding to the Kubernetes namespace is correct; the error stems from path structure, not namespace binding.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because periodic secret ID rotation does not solve the problem of a single compromised application affecting others; all applications still share the same role, so rotating the secret ID would disrupt all applications simultaneously. Option C is wrong because reducing the token TTL to 1 minute only limits the lifespan of tokens, but it does not isolate applications; a compromised application could still continuously re-authenticate and access resources, and revoking its access would still require revoking the entire role. Option D is wrong because adding CIDR bindings restricts the source IP addresses that can authenticate, but if multiple applications share the same role and originate from different IPs, this could block legitimate traffic; more importantly, it does not allow selective revocation for a single compromised application.

Why this answer

How to eliminate wrong answers

Option B is wrong because `vault write` on an existing intermediate CA cannot change its `signature_bits`; this parameter is immutable after issuance and only applies at generation time. Option C is wrong because using a different issuer_name that already has SHA256 would require a pre-existing intermediate CA configured with SHA256, which is not a direct action to fix the current intermediate — it avoids the root cause. Option D is wrong because a role's `signature_bits` only affects the signing algorithm for certificates issued by that role, but the intermediate CA's own certificate algorithm is fixed at creation; the role cannot override the CA's signing key algorithm.

Why this answer

How to eliminate wrong answers

Option A is wrong because token metadata is used for audit and identity purposes, not for enforcing access control; Vault does not evaluate metadata to allow or deny API requests. Option B is wrong because a root token has unrestricted access to all paths and policies cannot restrict a root token—root tokens bypass all policy checks by design. Option D is wrong because the token type (service vs. batch) determines lifecycle and revocation behavior, not access permissions; a service token still requires an attached policy to define what it can read.

Why this answer

How to eliminate wrong answers

Option A is wrong because adding a policy that uses the email claim does not cause the claim to appear in the token; the claim must first be requested via the correct scope. Option B is wrong because modifying the OIDC provider's configuration (the external identity provider) is not the correct action; the administrator must adjust Vault's OIDC auth method configuration to request the 'email' scope. Option C is wrong because custom claim mapping is used to rename or transform claims that are already present, not to request new claims that are missing due to an omitted scope.

Why this answer

How to eliminate wrong answers

Option B is wrong because the join command explicitly specifies the IP address of the first node, and the error 'no leader' indicates the issue is not a network connectivity or addressing problem but rather the absence of an unsealed leader. Option C is wrong because while a quorum of 2 nodes is needed for leader election, the core issue is that the first node is sealed; if it were unsealed, it would already be the leader and the third node could join. Option D is wrong because the second node does not need to be unsealed for the third node to join; the join process only requires an unsealed leader (the first node) to accept the new node, and the second node's sealed state does not prevent the third from joining.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `pki/webserver/issue` is not a valid endpoint; the correct path is `pki/issue/webserver`. Option B is wrong because `pki/webserver/cert` is not a valid endpoint for issuing certificates; it incorrectly appends 'cert' to the role name. Option C is wrong because `vault read pki/cert/webserver` retrieves an existing certificate by serial number or ID, not issue a new one, and 'webserver' is a role name, not a certificate identifier.

Why this answer

How to eliminate wrong answers

Option A is wrong because the backend defined in the config file will be enabled at the specified path when Vault starts; it is not disabled. Option B is wrong because the admin does not need to modify the config file to change the path; they can simply enable AppRole at another path via the CLI or API. Option D is wrong because Vault will not fail to start; the path in the config file is used for that specific mount, and enabling AppRole at a different path does not conflict with it.

Why this answer

How to eliminate wrong answers

Option A is wrong because service tokens with explicit max TTL are still parent-child tokens; if the parent token is revoked, the child token is also revoked, so the jobs would be affected by the pipeline token's lifecycle. Option C is wrong because periodic tokens are used for long-lived, renewable tokens with a fixed lifetime, not for creating short-lived tokens for jobs; they also create parent-child relationships by default. Option D is wrong because batch tokens are lightweight, non-renewable tokens that cannot create child tokens at all, so they cannot be used to generate tokens for deployment jobs.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because a Vault lease is not merely a permission to access a path; permissions are defined by policies attached to tokens or auth methods, not by leases. Option C is wrong because a lease is not a contract to use a secret for a certain duration; it is a technical mechanism that automatically manages the secret's lifecycle, including renewal and revocation, not a contractual agreement. Option D is wrong because the actual secret value is the data returned by Vault (e.g., a password or API key), while the lease is the metadata (lease ID, TTL, renewable flag) that controls that secret's lifecycle.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the secret ID TTL does not affect the token's lifetime; the secret ID is only used during initial authentication to obtain a token, and the token's TTL is independent. Option B is wrong because setting the token TTL to 0 (unlimited) violates the security policy requiring short-lived tokens and is not a recommended practice; Vault's default maximum TTL also limits this. Option C is wrong because re-authenticating with the same secret ID after the token expires would work, but it is inefficient and unnecessary; the application should instead renew the existing token to avoid the overhead of re-authentication and to maintain a continuous session.

Why this answer

How to eliminate wrong answers

Option A is wrong because it uses the PUT method, which is reserved for tuning an existing mount (e.g., updating configuration or adjusting default lease TTLs), not for creating a new mount; creating a mount requires POST. Option B is wrong because it targets the `/v1/sys/auth/aws` endpoint, which is used for enabling an auth method (like LDAP or AppRole), not for mounting a secrets engine; secrets engines are mounted under `/v1/sys/mounts/`. Option D is wrong because it specifies `"type":"aws-secrets"` in the body, but the correct type identifier for the AWS secrets engine is `"aws"`; `"aws-secrets"` is not a valid Vault engine type.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because the OIDC role configuration (e.g., allowed redirect URIs, bound claims) does not change when the provider rotates keys; a misconfigured role would cause consistent failures, not a sudden failure after key rotation. Option B is wrong because an expired token would produce a different error (e.g., 'token is expired' or 'token used before issued'), not a generic OIDC response validation failure, and the issue is tied to key rotation timing. Option C is wrong because if the OIDC provider were down, Vault would not be able to fetch the JWKS at all, leading to a connection timeout or discovery failure, not a signature validation failure on a response that was received.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting the lease TTL to infinite is not supported by Vault; leases always have a finite TTL defined by the secret engine's default or maximum, and infinite TTL would violate security best practices by never forcing rotation. Option B is wrong because using a cron job to call vault lease renew is brittle and not recommended; it introduces a single point of failure, lacks awareness of lease expiration timing, and does not handle Vault Agent's automatic renewal or template rendering. Option D is wrong because periodic tokens with auto-renewal are used for long-lived tokens, not for renewing secret leases; secret leases (e.g., database credentials, AWS IAM keys) require explicit lease renewal via the /sys/leases/renew endpoint, and periodic tokens do not automatically renew those leases.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an Audit Device logs all requests and responses to Vault for security monitoring, but it does not provide tokens or handle authentication for pods. Option B is wrong because the Storage Backend (e.g., Consul) is used for persisting Vault's encrypted data and cluster state, not for issuing tokens to applications. Option D is wrong because the Vault CLI with a token helper is an interactive tool requiring a human to authenticate and manage tokens, which does not meet the requirement for automated, non-interactive token retrieval at pod startup.

Why this answer

How to eliminate wrong answers

Option A is wrong because Okta is a third-party identity provider (IdP) that uses OIDC/SAML, not a direct authentication method for Active Directory; it would require additional configuration and is not the native AD integration method. Option B is wrong because AppRole is a machine-to-machine authentication method that uses role IDs and secret IDs, designed for applications and automation, not for human users with corporate credentials. Option C is wrong because Userpass is a built-in Vault auth method that stores usernames and passwords locally within Vault's internal storage, not against an external corporate Active Directory.

Why this answer

How to eliminate wrong answers

Option A is wrong because `vault list` is used to enumerate paths or keys under a given path, not to generate credentials; it would return a list of role names, not a credential. Option B is wrong because `vault generate` is not a valid Vault CLI command; the correct verb for generating dynamic secrets is `vault write`. Option D is wrong because `vault read` retrieves static secrets or configuration data, but for dynamic database credentials, a write operation is required to trigger credential creation and return the lease.

Why this answer

How to eliminate wrong answers

Option A is wrong because Shamir seals with auto-unseal using a cloud KMS is a contradictory configuration—Shamir seals require manual key shares to unseal, and auto-unseal replaces Shamir entirely; combining them would not achieve automated unseal without human intervention. Option B is wrong because an HSM seal with a quorum of smart cards still requires physical presence of multiple smart cards to unseal, which does not allow unsealing without human intervention after a data center outage. Option C is wrong because a Transit seal with a key that requires manual approval from a quorum of operators explicitly requires human approval for unsealing, contradicting the requirement for no human intervention during unseal.

Why this answer

How to eliminate wrong answers

Option A is wrong because network issues would cause lease revocation failures, but the question states the database is full of stale users, not that revocation is failing—Vault's lease revocation is a separate process from database user cleanup. Option B is wrong because the rotation statement controls how credentials are rotated, not how they are revoked; an incorrect rotation statement would affect credential renewal, not the presence of stale users. Option C is wrong because the `max_ttl` setting limits the maximum lifetime of a lease, but even if set high, Vault would still revoke the lease when it expires; the issue is that revocation does not delete the database user.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because revoking each token individually using its accessor is inefficient and impractical when a user has many tokens, requiring enumeration of all tokens and multiple API calls. Option C is wrong because the auth/token/revoke-prefix endpoint revokes tokens based on a path prefix (e.g., auth/token/create), not by user identity, so it would revoke tokens from multiple users sharing that path, not just the specific user. Option D is wrong because restarting the Vault server does not revoke tokens; tokens are persisted in storage and would remain valid after a restart, and this approach is disruptive and not a targeted revocation method.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a strong master key protects the Vault cluster's root key and seals/unseals the Vault, but it does not prevent Vault administrators from reading plaintext secrets once Vault is unsealed; administrators with appropriate policies can still access secret values. Option B is wrong because configuring storage backend encryption using a KMS encrypts the data at rest in the storage backend, but Vault administrators with access to the unsealed Vault can still read plaintext secrets; KMS encryption protects against physical theft of storage, not against administrative access. Option D is wrong because combining A and B still does not prevent Vault administrators from reading plaintext secrets; neither the master key nor storage backend encryption provides client-side encryption that keeps secrets opaque to Vault operators.

Why this answer

How to eliminate wrong answers

Option A is wrong because an expired Vault token would result in a '403 Forbidden' or 'permission denied' error, not a '400 Bad Request' with 'invalid role ARN', as token expiration is an authentication issue unrelated to the role ARN validation. Option C is wrong because if the role ARN had been changed in AWS but not updated in Vault, the error would likely be 'role not found' or a different AWS error, and the administrator confirmed the ARN is correct in Vault. Option D is wrong because calling the wrong API endpoint would result in a '404 Not Found' or '405 Method Not Allowed', not a '400 Bad Request' with a specific error about the role ARN.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing the master key in the transit secrets engine would defeat the purpose of splitting the key and does not provide auto-unseal; the transit engine is for encrypting data, not for managing unseal keys. Option B is wrong because AWS KMS as a seal (i.e., using AWS KMS as a seal wrapping mechanism) is a single-key auto-unseal approach, not a multi-share split-key method; it does not involve distributing key shares to multiple administrators. Option D is wrong because using a single unseal key stored in a password manager and manually unsealing violates the requirement to split the key into multiple shares and to avoid manual intervention.

Why this answer

Why these pairings

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because a root token is not required to write to a KV v2 path; a properly scoped policy with the correct path is sufficient. Option B is wrong because an expired TTL would cause a permission denied error due to token invalidity, not a path mismatch, and the question states the token is unable to write, not that it is expired. Option C is wrong because conflicting policies from a parent token would result in a denial based on the most restrictive policy, but the core issue here is the incorrect path, not a policy conflict.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because restoring the primary from backup would reintroduce stale data and potentially cause conflicts with the promoted secondary, and it does not recover the missing secrets that were never replicated. Option C is wrong because failing back to the original primary after restoring it would require the original primary to catch up with the secondary, but the missing secrets were never on the secondary, so they cannot be recovered through failback. Option D is wrong because re-promoting the original primary as the new primary would ignore the fact that the secondary has already been promoted and is now the authoritative source; this would cause a split-brain scenario and data inconsistency.

Why this answer

How to eliminate wrong answers

Option B is wrong because using a single flat path like 'secrets/' prevents any granular access control; all policies would apply to the entire path, violating the principle of least privilege. Option C is wrong because using prefixes like 'app1-' on a shared path still forces all secrets under one policy scope, making it impossible to restrict access to specific applications or environments without cumbersome regex-based policies. Option D is wrong because random UUIDs make secrets unmanageable and impossible to organize by application or environment; they also break the human-readable path structure that Vault policies rely on for clear, maintainable access rules.