How many Drag and Drop Matching Questions questions are on this page?

This page has 5 Drag and Drop Matching Questions scenario questions for the VA-003 exam, each with detailed explanations and wrong-answer analysis.

How should I approach VA-003 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to HashiCorp Vault Associate VA-003 questions

Scenario-based practice

Drag and Drop Matching Questions

Practise HashiCorp Vault Associate VA-003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

VA-003

exam code

HashiCorp

vendor

Scenario guide

How to approach drag and drop matching questions

Matching questions give you two columns — concepts, commands, or protocols on the left, and their definitions or use-cases on the right. You drag each left item to its correct match. These appear on most certification exams and punish superficial memorisation.

Quick answer

Drag and Drop Matching Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummatching

Full question →

Match each Vault term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Encrypted state requiring unseal

Decrypt master key to access data

Encryption layer protecting storage

Key splitting for unseal

Superuser token with full access

A
Secret: A piece of sensitive data stored in Vault
Correct: A secret is any sensitive data like passwords or API keys stored in Vault.
B
Token: A credential used to authenticate to Vault
Correct: Tokens are the primary method of authentication to Vault.
C
Policy: A method used to authenticate a user or machine to Vault
Why it fails: Incorrect: This describes an auth method, not a policy. Policies define access rules.
D
Auth Method: A set of rules defining access permissions in Vault
Why it fails: Incorrect: This describes a policy, not an auth method. Auth methods handle authentication.

Full breakdown with real-world context →

Question 2mediummatching

Full question →

Match each Vault replication type to its behavior.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Disaster recovery, async replication

Scale read operations, active-standby

Replicate only mount-specific data

Replicate all data across clusters

A
Performance Replication: Replicates mounts and policies but not secrets; used to scale read operations across clusters.
Correct. Performance Replication is designed for scaling read operations and does not replicate secrets or tokens.
B
Disaster Recovery Replication: Replicates everything including secrets and tokens; used for failover.
Correct. DR Replication replicates all data for disaster recovery failover.
C
Performance Replication: Replicates everything including secrets and tokens; used for failover.
Why it fails: Incorrect. This describes Disaster Recovery Replication, not Performance Replication.
D
Snapshot Replication: Replicates the entire state of Vault at a point in time for backup.
Why it fails: Incorrect. Vault does not have a 'Snapshot Replication' type; this is a fictional feature.
E
Disaster Recovery Replication: Replicates mounts and policies but not secrets; used to scale read operations.
Why it fails: Incorrect. This describes Performance Replication, not Disaster Recovery Replication.
F
Local Replication: Replicates data within a single cluster to ensure durability.
Why it fails: Incorrect. Vault does not have a 'Local Replication' type; replication is between clusters.

Full breakdown with real-world context →

Question 3mediummatching

Full question →

Match each Vault audit device to its output destination.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Writes to a local file

Sends to system syslog

Sends to a TCP or UDP endpoint

Publishes to Kafka topic

A
File: Writes audit logs to a local file
File audit device writes logs to a specified file path.
B
File: Sends audit logs to syslog
Why it fails: Incorrect — this describes the Syslog audit device, not File.
C
Syslog: Sends audit logs to syslog daemon
Syslog audit device sends logs to the system's syslog service.
D
Syslog: Writes audit logs to a file
Why it fails: Incorrect — this describes the File audit device, not Syslog.
E
Socket: Sends audit logs to a TCP or UDP endpoint
Socket audit device sends logs to a specified TCP or UDP address.
F
Socket: Writes audit logs to a file
Why it fails: Incorrect — this describes the File audit device, not Socket.

Full breakdown with real-world context →

Question 4mediummatching

Full question →

Match each Vault auth method to its authentication mechanism.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

RoleID and SecretID

Username/password against LDAP server

Static or periodic tokens

Service account token

JSON Web Token / OpenID Connect

A
Token: A single-use token generated at login
Token auth method generates a unique token per login session.
B
Userpass: Username and password authentication
Userpass uses static username/password credentials.
C
AppRole: Role ID and Secret ID
AppRole uses two-factor authentication with RoleID and SecretID.
D
Token: Username and password authentication
Why it fails: Incorrect – this describes Userpass, not Token.
E
Userpass: Role ID and Secret ID
Why it fails: Incorrect – this describes AppRole, not Userpass.
F
AppRole: A single-use token generated at login
Why it fails: Incorrect – this describes Token, not AppRole.

Full breakdown with real-world context →

Question 5mediummatching

Full question →

Match each Vault policy capability to its permission.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Allow creating data at a path

Allow reading data at a path

Allow modifying existing data

Allow deleting data

Allow listing keys

A
create: Allows creating data at the path.
The 'create' capability specifically permits the creation of new data at the given path.
B
read: Allows reading data at the path.
The 'read' capability permits reading data from the specified path.
C
update: Allows updating data at the path.
The 'update' capability permits modifying existing data at the path.
D
delete: Allows deleting data at the path.
The 'delete' capability permits removing data at the path.
E
create: Allows reading data at the path.
Why it fails: Incorrect — 'create' capability does not grant read access; that is the role of 'read'.
F
read: Allows creating data at the path.
Why it fails: Incorrect — 'read' capability does not grant create access; that is the role of 'create'.

Full breakdown with real-world context →

These VA-003 practice questions are part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style VA-003 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Drag and Drop Matching Questions

How to approach drag and drop matching questions

Quick answer

Related VA-003 topic practice pages

Compare and configure secrets engines practice questions

Compare authentication methods practice questions

Create Vault policies practice questions

Assess Vault tokens practice questions

Manage Vault leases practice questions

Utilize Vault CLI and API practice questions

Explain encryption as a service practice questions

Explain Vault architecture practice questions

VA-003 fundamentals practice questions

VA-003 scenario practice questions

VA-003 troubleshooting practice questions

Practice scenarios

Match each Vault term to its definition.

Match each Vault replication type to its behavior.

Match each Vault audit device to its output destination.

Match each Vault auth method to its authentication mechanism.

Match each Vault policy capability to its permission.