VA-003 Utilize Vault CLI and API Practice Question
An organization uses Vault's AWS secret engine to dynamically generate IAM credentials. The application uses the API to request credentials by calling 'POST /v1/aws/creds/my-role'. Recently, the application started receiving '400 Bad Request' with error 'invalid role ARN'. The role 'my-role' is defined in Vault and has been working for months. The administrator checks the role configuration and confirms the ARN is correct and that the associated IAM policy exists in AWS. The Vault server logs show no connectivity issues with AWS. The application code has not changed. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the distinction between a syntactically correct ARN and a role that is actually assumable, leading candidates to focus on the ARN string itself rather than the trust policy that governs cross-account access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role's trust policy has been modified to not allow Vault's AWS account to assume the role
The error 'invalid role ARN' occurs when Vault attempts to call sts:AssumeRole but AWS rejects the request. Since the role ARN is confirmed correct in Vault and the associated IAM policy exists in AWS, the most likely cause is that the IAM role's trust policy has been modified to no longer allow Vault's AWS account (or the external ID) to assume the role. A token expiration would result in a 403 Forbidden, not a 400 with 'invalid role ARN'. Changing the ARN in AWS without updating Vault would cause Vault to use a stale ARN, but the administrator confirmed the ARN is correct. The endpoint is correct as the request has been working for months. Thus, option B is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Vault token used for the API call has expired
Why it's wrong here
That would give a 403 or permission denied, not 'invalid role ARN'.
- ✓
The IAM role's trust policy has been modified to not allow Vault's AWS account to assume the role
Why this is correct
Vault assumes the role; if trust policy changes, it fails.
- ✗
The role ARN has been changed in AWS but not updated in Vault
Why it's wrong here
The error says 'invalid role ARN', but the administrator confirmed ARN is correct.
- ✗
The application is calling the wrong API endpoint
Why it's wrong here
The endpoint is correct.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.