VA-003 Explain Vault architecture Practice Question
An organization uses Vault to manage SSH access via the SSH secrets engine. They have a large number of servers, each with a unique host key. The admin configures the SSH secrets engine with a one-time password (OTP) type. Users report that sometimes they cannot authenticate to some servers because the OTP is not accepted. The admin reviews the logs and finds that the server's SSH daemon is not contacting Vault to verify the OTP. The SSH daemon is configured with the Vault SSH helper. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the distinction between network connectivity failures (wrong IP, high load) and authentication/authorization failures (expired certificates, misconfigured tokens) — the trap here is assuming a connectivity issue when the root cause is a TLS handshake failure due to an expired client certificate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSH helper's client certificate is expired or not properly configured.
The SSH helper is a client-side component that must authenticate to Vault using a client certificate (mTLS) before it can verify OTPs. If this certificate is expired or misconfigured, the SSH daemon cannot establish a trusted connection to Vault, causing OTP verification to fail silently. This directly explains why the server is not contacting Vault despite the helper being installed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSH secrets engine's default TTL is too short.
Why it's wrong here
TTL affects OTP validity, not verification.
- ✗
The Vault server is under high load and dropping requests from SSH helpers.
Why it's wrong here
Less specific than certificate issue.
- ✓
The SSH helper's client certificate is expired or not properly configured.
Why this is correct
Certificate issues prevent authentication to Vault.
- ✗
The Vault server's IP address has changed and the SSH helper is using the old address.
Why it's wrong here
Would affect all servers, not just some.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.