HashiCorp Vault Associate VA-003 (VA-003) — Questions 451–514

Option A is correct because the Vault Transit Secrets Engine always returns ciphertext as a base64-encoded string, regardless of whether the input plaintext was base64-encoded or raw. The API specification requires the client to decode the base64 ciphertext after receiving it if the original plaintext was raw bytes. There is no parameter to disable base64 encoding of the ciphertext output.

Option C is correct because the error 'No more available leases on this role' indicates that the role has a finite number of leases it can issue, controlled by the 'max_leases' parameter. When this limit is reached, Vault refuses to issue new credentials until existing leases expire or are revoked. The role's TTL and max_ttl being both 1 hour does not cause this error; rather, the exhaustion of the lease count does.

When AWS IAM role credentials are rotated, the trust policy attached to the IAM role must be updated to reflect the new credentials (access key and secret key) that Vault uses to call the AWS STS API. If the trust policy still references the old credentials, Vault's AWS auth method cannot validate the login request, resulting in a 'permission denied' error in the audit logs. This is the most likely cause because the rotation directly breaks the trust relationship between Vault and AWS.

When Vault is sealed, it cannot process any operations, including lease renewal. The error would indicate the sealed state.

Option C is correct because in a multi-datacenter Vault deployment, each datacenter must have its own independent storage backend to avoid a single point of failure and to ensure that a failure in one datacenter does not corrupt or disrupt the storage layer of another. Vault’s architecture requires that each cluster manages its own storage backend (e.g., Consul, Integrated Storage, or Raft) to maintain data isolation and consistency within that datacenter.

Option A is correct because the Transit secrets engine performs encryption and decryption operations entirely on the server side, never exposing the encryption keys to the client. This allows applications running in untrusted environments to offload cryptographic processing securely, as the keys remain within Vault's encrypted storage and are never transmitted to or stored by the application.

The user's policy grants only 'read' and 'list' capabilities on the path 'secret/data/*'. The 'vault write' command requires either 'create' or 'update' capability (or both) on the path. Since the policy lacks these capabilities, Vault returns a 'permission denied' error, even though the token is valid and the secret engine is mounted.

Option B is correct because the security policy requires both single-use (secret_id_num_uses=1) and a 1-hour expiration (secret_id_ttl=1h). In Vault's AppRole authentication, secret_id_num_uses controls how many times a secret_id can be used, and secret_id_ttl sets the time-to-live. Setting both ensures the secret_id is invalidated after one use or after one hour, whichever comes first, meeting the policy exactly.

Option A is correct because the Vault API uses a PUT request to `/v1/sys/leases/revoke` with a JSON body containing the `lease_id` to revoke a specific lease. This is the standard method for lease revocation as documented in the Vault API specification. Option D is correct because renewing a lease also requires a PUT request to `/v1/sys/leases/renew` with the `lease_id` in the request body, matching the expected API pattern for state-changing operations.

The valid capabilities are sudo and list. Modify, patch, and encrypt are not standard Vault policy capabilities.

The policy grants 'read' capability on `database/creds/my-role` but does not include the 'list' capability on `database/roles/`. In Vault, listing requires an explicit 'list' capability in the policy, even if 'read' is allowed on sub-paths. Without 'list', the API call to `LIST database/roles/` returns a permission denied error.

Disaster Recovery (DR) Replication is the correct choice because it provides asynchronous replication of Vault data (including configuration, policies, and secrets) from a primary cluster to a secondary cluster. In the event of a primary failure, the secondary cluster can be promoted to become writable, ensuring business continuity. This feature is specifically designed for disaster recovery scenarios where the secondary site must be able to take over write operations.

Periodic tokens have no max TTL; they can be renewed indefinitely as long as renewal occurs within the period (24h). Thus, the token can last forever if renewed in time.

These are key aspects of response wrapping.

A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.

Kubernetes auth is a valid Vault authentication method that allows Kubernetes service accounts to authenticate to Vault using a JSON Web Token (JWT) and a service account token. It is a first-class auth method in Vault, designed for dynamic, short-lived credentials in containerized environments.

The user can read credentials but cannot renew the lease because the policy grants 'read' and 'list' capabilities on the secret path, but renewing a lease requires the 'update' capability on the 'sys/leases/renew' endpoint. This endpoint is used to extend the lifetime of a lease, and without 'update' access, the renewal request is denied.

When a Vault cluster with Integrated Storage loses quorum (more than half of voter nodes are unavailable), the cluster cannot unseal because Raft requires a quorum of voters to elect a leader and process operations. Since all 5 nodes are sealed and the cluster has 3 voters, the outage likely caused the loss of at least 2 voters, breaking quorum. The correct recovery procedure is to use `vault operator raft recover` on a voter node, which creates a new single-node cluster with the existing data, allowing the administrator to then unseal and rejoin other nodes.

Option D is correct because the core principle of least privilege ensures that even if the Vault server is compromised, the attacker can only perform actions allowed by the minimal IAM policy attached to the non-root user. This limits the blast radius, preventing the attacker from gaining full administrative access to the AWS account. The AWS secrets engine uses the configured IAM credentials to create temporary IAM users, so restricting those credentials to only the necessary permissions is the most effective mitigation.

Option B is correct. In Vault, deny statements override any other capabilities regardless of policy ordering. Therefore, the explicit deny on the specific path prevents the write, even though the first policy allows create/update.

To write a new version of an existing secret in a KV v2 secrets engine, the user needs the 'update' capability on the 'data/' path. This is because the KV v2 API uses a POST/PATCH request to the 'data/' endpoint to create a new version of an existing secret, and the 'update' capability grants permission to modify existing data. The 'create' capability is also required because if the secret does not exist, the same endpoint call will create it, and the policy must allow both creation and update for a seamless write operation.

Option C is correct because the database secrets engine requires root credential rotation to enable automatic revocation of generated credentials. When the `connection_url` uses template variables like `{{username}}` and `{{password}}` but the admin credentials are static (not rotated via `rotate_root`), Vault cannot track the actual root password. Without root rotation, Vault lacks the ability to execute `REVOKE` commands after TTL expiry because it cannot authenticate to the database with the current root credentials to perform cleanup.

The Transit secrets engine is designed to perform cryptographic operations on data without exposing the encryption keys to the client. Option A is correct because the engine supports signing and verifying data using HMAC or asymmetric keys, allowing clients to verify integrity and authenticity without handling the private key. Option B is correct because the engine can encrypt data in transit (e.g., via API calls) while the encryption key remains securely stored within Vault, never leaving the server.

The Cubbyhole secrets engine creates a private, ephemeral storage space that is scoped to the requesting token. Each token gets its own isolated cubbyhole, and no other client or token can read or write to it, even with root privileges. This makes it the only built-in engine that guarantees a configuration value is unique to each Vault client and cannot be shared.

Option D is correct because Vault's `datakey` endpoint generates a data encryption key (DEK) that is wrapped by a Vault-managed key. The wrapped DEK can be safely stored and used offline in CI/CD pipelines, while the unwrapped key material never leaves Vault's memory — the DEK is unwrapped only when needed, and the wrapping key remains in Vault. This satisfies the policy requirement that encryption keys used in transit must never leave Vault's memory, as the DEK itself is not a transit key but a data key that can be used offline.

Option D is correct because the AWS auth method in Vault requires valid AWS credentials to authenticate against AWS STS. These credentials can be provided via environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or automatically retrieved from instance metadata when running on an EC2 instance. Without them, Vault cannot sign the STS request to verify the caller's identity, causing authentication to fail.

In a Vault cluster using Consul for high availability, only the active node serves requests. When a standby node loses contact with the active node due to a network partition, it cannot verify the active node's health or its own leadership status. After a configurable timeout (default 10 seconds), the standby node seals itself to prevent serving stale or inconsistent data, ensuring data integrity and security.

Performance replication must be explicitly configured on a Vault cluster to enable performance standby nodes. If performance replication is not configured, the cluster cannot have performance standby nodes that serve read requests, so the node would not respond to reads. This is the most likely cause because the question states the cluster 'uses performance replication' but the node is not responding, implying the configuration is missing or incorrect.

The exhibit shows a Vault instance configured with `seal "awskms"` and a `region` and `kms_key_id` specified. This indicates that AWS KMS is used as the auto-unseal mechanism, where Vault delegates the unsealing process to AWS Key Management Service, eliminating the need for manual Shamir key shares.

The `-field=ciphertext` flag in a Vault command instructs the CLI to extract and return only the value of the `ciphertext` key from the JSON response object. This is a standard Vault output filtering mechanism that allows users to isolate a specific field without parsing the full response, which is especially useful in scripting and automation.

An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

The barrier encryption key is the master key used to encrypt and decrypt the Vault data encryption key (DEK), which in turn encrypts all data written to the storage backend. Without this key, Vault cannot protect data at rest because the DEK would be stored in plaintext. It is a fundamental component of Vault's security architecture, ensuring that even if the storage backend is compromised, the data remains encrypted.

Option C is correct because `vault kv put` is the proper command to write or update a secret in the KV v2 secrets engine. The KV v2 engine requires the `put` subcommand to create or overwrite a secret at the specified path, and the syntax `vault kv put secret/myapp password=pass123` correctly writes the key-value pair to the path `secret/myapp` under the mounted engine at `secret/`.

Option B is correct because the `min_decryption_version` setting on a key in a key management system (such as AWS KMS or GCP Cloud KMS) controls the minimum key version that can be used to decrypt ciphertext. If this value is set too high (e.g., to the current version), older key versions are effectively disabled for decryption, causing any data encrypted with a previous key version to become undecryptable. This is a common misconfiguration when automating key rotation without properly managing version policies.

Option B is correct because the Vault transit secrets engine, when configured with `auto_decode` enabled, automatically base64-decodes the ciphertext returned from encryption operations and base64-encodes plaintext before decryption. The command `vault write -f transit/keys/my-key/encrypt/orders` with the `auto_decode` parameter set to `true` ensures that the output ciphertext is base64-encoded for safe transport, and the corresponding decryption operation will automatically base64-decode the input ciphertext before processing.

Option D is correct because the AWS secrets engine can dynamically generate IAM users with custom policies attached, allowing fine-grained access control for applications. Option E is correct because the engine can generate STS temporary credentials for cross-account access, enabling secure, time-limited access to AWS resources in different accounts.

The Kubernetes authentication method is correct because it allows pods to authenticate to Vault using their service account token, which is automatically mounted into the pod. This eliminates the need to hardcode any secrets in the pod definition, as Vault verifies the token against the Kubernetes API server and issues a temporary Vault token based on the pod's identity.

In Vault policies, capabilities define the allowed actions on paths. The `create` capability permits creating new data at a path without needing to read existing data, which is distinct from `update` that allows modifying existing data. Both `create` and `update` are valid, separate capabilities in Vault's policy system.

Batch tokens are lightweight and support a high creation rate, and they have a TTL (which cannot be renewed). They do not support explicit max TTL (they have TTL and no renewal), and they can have a use-limit.

A configured seal (B) and a storage backend (D) are mandatory for Vault to start. The seal protects the master key, and the storage backend persists data. The other options are not strictly necessary for startup.

Option B is correct because in Vault's KV v2 secrets engine, secrets are stored under the 'data' path. The correct CLI command to write a secret is 'vault write shared/data/db_password value=s3cret', which targets the data endpoint for the secret 'db_password' in the 'shared' mount.

Option D is correct because configuring log rotation on the file audit device allows the Vault server to automatically archive or delete old audit logs based on size or time thresholds, preventing the disk from filling up while retaining necessary audit data. This is the recommended approach in Vault for managing disk space without disabling security auditing or relying on external infrastructure changes.

Option D is correct because Vault's transit secrets engine appends key version information to the ciphertext by default. When decrypting, Vault checks that the key version embedded in the ciphertext matches a version of the key that exists in the destination Vault instance. If the ciphertext was created by a different Vault instance with a different key version history, the version embedded in the ciphertext will not correspond to any known key version, causing the 'invalid ciphertext' error.

The Vault transit engine uses distinct capabilities for key management versus data operations. 'Create' and 'update' allow managing the key itself (e.g., creating or rotating the key), but encryption of data requires the 'encrypt' capability on the transit key path. Without 'encrypt', the API call to encrypt data fails with a 'permission denied' error, even if the key exists and is properly configured.

The correct endpoint to retrieve a data key that can be used for local client-side encryption is POST /v1/transit/datakey/plaintext/my-key. This endpoint returns both the plaintext data key (for local encryption) and the ciphertext version of the key (for secure storage alongside the encrypted data). The 'plaintext' in the path indicates that the response includes the key in plaintext form, which is necessary for performing encryption locally.

When Vault revokes an IAM user, it deletes the IAM user credentials, but this does not affect resources already launched by that user. The EC2 instance runs under its own instance profile and is not tied to the IAM user's session after launch. AWS does not retroactively terminate or stop instances based on IAM user revocation; the instance continues to run until explicitly stopped or terminated.

The token does not have permissions on the "secret/data/prod/" path, so the read fails with a permission denied error.

Option D is correct because Kubernetes authentication works by having Vault validate a Kubernetes service account JWT token against the Kubernetes TokenReview API, while AppRole authentication requires a RoleID (which identifies the role) and a SecretID (which acts as a credential). The SecretID can be a generated value or a wrapped response, but the JWT token in Kubernetes auth is the sole credential presented to Vault.

The Vault transit secrets engine provides encryption as a service, and its core operations are encrypt, decrypt, rewrap, and datakey generation. Rewrap is valid because it decrypts ciphertext and re-encrypts it with the latest key version without exposing the plaintext to the caller, maintaining security during key rotation.

Initialize clusters, enable primary replication, generate token, enable secondary, promote if needed.

Option C is correct because the Shamir seal splits the master key into multiple key shares, requiring a threshold number of these shares to be entered during the unseal process before Vault can decrypt its data encryption key and become operational. This ensures that no single individual can unseal Vault, providing a distributed trust model.