VA-003 Explain Vault architecture Practice Question
An organization wants to use Vault's dynamic database credentials to manage MySQL access. They have multiple application servers that need to connect to different databases. What is the best practice for configuring database roles to minimize the number of Vault mounts?
⚠ Common exam trap
HashiCorp often tests the misconception that more mounts equal better isolation, but the best practice in Vault is to minimize mounts and use roles for logical separation, as mounts are a higher-level administrative boundary that should be reserved for different secret engines or vastly different access policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a single database mount and define multiple roles within it, each with different credential generation parameters.
Vault allows a single database mount (e.g., `database/`) to manage multiple database connections, and within that mount, you can define multiple roles. Each role can specify different credential generation parameters (e.g., username template, default TTL, max TTL, and allowed roles) for distinct databases or application servers. This minimizes the number of mounts while still providing fine-grained access control and isolation of credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the same database mount but create a separate role per application server.
Why it's wrong here
Roles should be per database, not per server.
- ✗
Create a separate database mount for each database to isolate credential generation.
Why it's wrong here
Unnecessary complexity.
- ✓
Create a single database mount and define multiple roles within it, each with different credential generation parameters.
Why this is correct
One mount per engine type, multiple roles for different databases.
- ✗
Use a single role that generates credentials for all databases by using a wildcard in the username.
Why it's wrong here
Cannot have different permissions per database.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.