Courseiva
← Back to HashiCorp Vault Associate VA-003 questions

Scenario-based practice

Hard Difficulty Questions

Practise HashiCorp Vault Associate VA-003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
VA-003
exam code
HashiCorp
vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related VA-003 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Compare authentication methods practice questions

Compare authentication methods practice questions for VA-003.

Assess Vault tokens practice questions

Sharpen your VA-003 knowledge of Assess Vault tokens.

Create Vault policies practice questions

Sharpen your VA-003 knowledge of Create Vault policies.

Manage Vault leases practice questions

Manage Vault leases practice questions for VA-003.

Compare and configure secrets engines practice questions

Sharpen your VA-003 knowledge of Compare and configure secrets engines.

Utilize Vault CLI and API practice questions

Practise VA-003 questions linked to Utilize Vault CLI and API.

Explain Vault architecture practice questions

Explain Vault architecture practice questions for VA-003.

Explain encryption as a service practice questions

Explain encryption as a service practice questions for VA-003.

VA-003 fundamentals practice questions

Practise VA-003 questions linked to VA-003 fundamentals.

VA-003 scenario practice questions

Work through VA-003 questions on VA-003 scenario.

VA-003 troubleshooting practice questions

VA-003 troubleshooting practice questions for VA-003.

Practice set

Practice scenarios

Question 1hardmultiple choice
Full question →

An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

Question 2hardmultiple choice
Full question →

A company wants to grant developers the ability to read and write secrets under the path 'secret/dev/*', but only they should be able to delete their own secrets. Which policy design best meets this requirement?

Question 3hardmulti select
Full question →

An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?

Question 4hardmultiple choice
Full question →

A large e-commerce company uses Vault to manage database credentials for microservices. They have a Vault cluster of 5 nodes using Integrated Storage (Raft). To increase capacity, they add a sixth node to the cluster. Shortly after, they notice intermittent 'no leader' errors in the Vault logs, and some clients experience failures when reading secrets. The cluster was functioning correctly before the addition. What is the most likely cause and the recommended action?

Question 5hardmultiple choice
Full question →

A cloud-native application uses Vault's Kubernetes auth method to inject tokens into pods. Each pod receives a Vault token with a TTL of 1 hour, renewable. The application is designed to renew tokens before they expire. However, after a recent update, some pods are failing to authenticate with Vault, reporting 'token not found' errors. The operations team checks the Vault audit logs and sees that tokens associated with these pods are being revoked immediately after creation. The pods have not performed any revocation. What is the most likely cause?

Question 6hardmultiple choice
Full question →

An application is failing to decrypt data using the transit secrets engine. The ciphertext was generated with key 'my-key' version 3, but the engine currently shows key version 5. What is the most likely cause of the failure?

Question 7hardmultiple choice
Full question →

A Vault policy includes the following statement: path "secret/data/+/app" { capabilities = ["read"] }. Which paths would match this policy? (Assume KV v2)

Question 8hardmultiple choice
Full question →

A Vault cluster has a performance secondary cluster replicating from a primary. An administrator needs to generate a one-time password (OTP) for an SSH target. They are on the secondary cluster. They run `vault write ssh/otp/otp_role ip=10.0.0.1 username=admin`. What is the expected behavior?

Question 9hardmultiple choice
Full question →

An administrator creates a token role with 'allowed_policies' and tries to create a child token. What does this error indicate?

Exhibit

Refer to the exhibit.
```
$ vault write auth/token/create policies=default ttl=1h
Error writing data to auth/token/create: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/auth/token/create
Code: 400. Errors:

* token count per user (3) exceeded
```
Question 10hardmultiple choice
Full question →

A company uses HashiCorp Vault in production to manage secrets for its microservices. One microservice, 'order-svc', authenticates via AppRole and receives a service token with a TTL of 24 hours and a max TTL of 48 hours. Over the past few days, operations teams report that 'order-svc' fails to renew its token after approximately 23 hours, causing authentication failures. The token lookup shows the token is still alive with about 1 hour of TTL remaining, but renewal attempts return a 'permission denied' error. The Vault audit logs show the renewal request is reaching Vault and being denied. The token's policies include 'path "auth/token/renew-self" { capabilities = ["update"] }'. The token was created with the default options. What is the most likely cause of this failure?

Question 11hardmultiple choice
Full question →

A Vault cluster has several policies. One policy, "app-policy", contains: path "secret/data/app/*" { capabilities = ["create", "update"] }. Another policy, "admin-policy", includes: path "secret/data/app/db" { capabilities = ["deny"] }. A token is attached with both policies. Can the token write to "secret/data/app/db"?

Question 12hardmultiple choice
Full question →

An organization uses the transit engine with key rotation. They want to ensure that data encrypted with an older key version can be decrypted by Vault, but only if the key has not been deleted. Which of the following must be true?

Question 13hardmultiple choice
Full question →

A token is created with policies 'default' and 'web-app'. Later, a parent token's policy is updated to add 'logging'. The child token's policies are not updated. What will happen when the child token is used?

Question 14hardmulti select
Full question →

Which TWO statements are true about the AWS secrets engine? (Choose two.)

Question 15hardmultiple choice
Full question →

A company uses Kubernetes auth. A pod in namespace 'prod' with service account 'my-sa' can authenticate and read secrets. After upgrading the Kubernetes cluster, the same pod fails to authenticate with error 'JWT token issuer is not valid'. What is the most likely cause?

Question 16hardmultiple choice
Full question →

A DevOps team uses Vault's transit engine to encrypt secrets in CI/CD pipelines. They report that encryption operations are failing with 'permission denied' errors. The team has a policy granting 'create' and 'update' capabilities on the transit key path. What is the most likely missing capability?

Question 17hardmultiple choice
Full question →

A security team must automate periodic credential rotation for a database. The rotation script should run on a server that cannot have the Vault binary installed but can make HTTP requests. Which approach should they use?

Question 18hardmultiple choice
Full question →

A company deploys Vault in a production environment with three nodes using Integrated Storage (Raft). They have configured Performance Replication to a secondary datacenter. The primary datacenter experiences a complete outage. After restoring the primary, they promote the secondary to primary. However, they notice that some secrets written to the primary just before the outage are missing in the secondary. The replication status shows no errors. What is the most likely cause and correct action?

Question 19hardmultiple choice
Full question →

A company uses both userpass and AppRole authentication methods. They notice that tokens issued via AppRole are not properly revoked when the corresponding secret_id is deleted. Which concept explains this behavior?

Question 20hardmultiple choice
Full question →

A Vault cluster configured with auto-unseal using AWS KMS is deployed across two availability zones. After a network partition, the standby node remains sealed while the active node is unsealed and serving requests. What is the most likely reason the standby cannot unseal?

These VA-003 practice questions are part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style VA-003 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.