VA-003 Compare and configure secrets engines Practice Question
An organization uses the AWS secrets engine to generate IAM users for each application. They want to ensure that if a Vault server is compromised, the attacker cannot use the AWS secrets engine configuration to gain access to the AWS account. Which additional security measure should be implemented?
⚠ Common exam trap
HashiCorp often tests the misconception that encryption or isolation (seal wrapping, separate instances) is sufficient to protect against credential abuse, when in reality the underlying IAM permissions are the critical control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a non-root IAM user with minimal privileges for the engine and restrict the engine's role policies to the minimum needed
The core principle of least privilege ensures that even if the Vault server is compromised, the attacker can only perform actions allowed by the minimal IAM policy attached to the non-root user. This limits the blast radius, preventing the attacker from gaining full administrative access to the AWS account. The AWS secrets engine uses the configured IAM credentials to create temporary IAM users, so restricting those credentials to only the necessary permissions is the most effective mitigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Vault's seal wrapping to encrypt the engine configuration
Why it's wrong here
Seal wrapping protects data in transit and at rest outside Vault's barrier, but once Vault is unsealed and compromised the engine can still read its AWS credentials and mint IAM users. Seal wrapping suits protecting data returned to clients or stored externally, not blocking a live Vault server from using engine configuration.
- ✗
Store the AWS access key used by the engine in a separate Vault instance
Why it's wrong here
Copying the access key to another Vault instance still leaves that key readable by whoever compromises the instance running the engine, so AWS access remains possible. Separate Vault clusters suit isolating tenants or regions, not preventing a compromised engine host from using its own AWS credentials.
- ✗
Use a dedicated Vault server for the AWS engine
Why it's wrong here
Isolating the engine on its own Vault server does not stop an attacker who compromises that server from reading the stored AWS credentials and calling AWS. Dedicated servers suit blast-radius separation between teams or environments, but the stem requires the engine's AWS credentials to be unusable by a Vault-hosted attacker.
- ✓
Use a non-root IAM user with minimal privileges for the engine and restrict the engine's role policies to the minimum needed
Why this is correct
The engine's own AWS credentials define the blast radius if Vault is compromised. Using a non-root IAM user with minimal privileges, plus tightly scoped role policies, limits what an attacker could do with the engine configuration.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.