VA-003 Compare and configure secrets engines Practice Question
Exhibit
Refer to the exhibit. ``` $ vault secrets enable -path=kv-v2 kv-v2 $ vault kv put kv-v2/secret username=admin password=s3cret $ vault kv get kv-v2/secret ====== Metadata ====== Key Value --- ----- created_time 2023-01-01T00:00:00Z deletion_time n/a destroyed false version 1 ====== Data ====== Key Value --- ----- password s3cret username admin $ vault kv metadata get kv-v2/secret Key Value --- ----- cas_required false created_time 2023-01-01T00:00:00Z current_version 1 custom_metadata map[] delete_version_after 0s max_versions 0 oldest_version 0 updated_time 2023-01-01T00:00:00Z ```
An administrator runs the commands shown in the exhibit. Later, they run 'vault kv delete kv-v2/secret' and then 'vault kv undelete -versions=1 kv-v2/secret' to recover the secret. Which command must the administrator run to verify that the secret is now readable?
⚠ Common exam trap
HashiCorp often tests the distinction between 'vault kv get' (reads secret data) and 'vault kv metadata get' (reads metadata only), leading candidates to choose the metadata command when they need to verify data readability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault kv get kv-v2/secret
'vault kv get' is the standard command to read and display the latest version of a secret from a KV v2 secrets engine. After running 'vault kv undelete -versions=1', version 1 is restored from a deleted state, and 'vault kv get kv-v2/secret' will retrieve and show that version's data, confirming it is readable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vault kv list kv-v2/secret
Why it's wrong here
This lists keys under the path, but not the secret content.
- ✗
vault read kv-v2/data/secret
Why it's wrong here
The correct path is 'kv-v2/data/secret' but the command syntax is 'vault kv get', not 'vault read' directly for KV v2.
- ✓
vault kv get kv-v2/secret
Why this is correct
After undelete, the secret is readable; this command retrieves the data.
- ✗
vault kv metadata get kv-v2/secret
Why it's wrong here
This shows metadata, not the secret data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.