VA-003 AWS Secret Engine Practice Question
An organization uses Vault with AWS IAM auth. After rotating the AWS IAM role credentials, users are unable to authenticate with Vault. The Vault audit logs show 'permission denied' for the AWS auth method. What is the most likely cause?
⚠ Common exam trap
Candidates often mistakenly think credential rotation requires updating IAM trust policies, but trust policies never contain credential material. The real issue could be an inadvertently disabled secret engine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The AWS secret engine is disabled
After rotating AWS IAM role credentials, the most likely cause of authentication failure is that the AWS secret engine was disabled during the rotation process. The 'permission denied' error in audit logs indicates the auth method is not enabled. While credential rotation itself does not directly cause engine disablement, it is possible that maintenance activities disabled it. Options A, B, and C are unrelated: trust policies do not contain credentials, token TTL and revocation affect client tokens, not the auth method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IAM role trust policy was not updated after credential rotation
Why it's wrong here
Incorrect. IAM role trust policies do not contain access keys or secret keys; they define which principals are trusted. Rotating credentials does not require trust policy changes.
- ✗
The Vault token TTL expired
Why it's wrong here
Incorrect. Token TTL expiration affects existing tokens but does not prevent initial authentication via AWS auth method.
- ✗
The client token used for AWS auth is revoked
Why it's wrong here
Incorrect. The client token referenced here is irrelevant; the error is from the auth method itself, not a specific token.
- ✓
The AWS secret engine is disabled
Why this is correct
Correct. If the AWS secret engine is disabled, Vault cannot process AWS authentication requests, resulting in 'permission denied'.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.