Courseiva
← Back to HashiCorp Vault Associate VA-003 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise HashiCorp Vault Associate VA-003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
VA-003
exam code
HashiCorp
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related VA-003 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Compare authentication methods practice questions

Compare authentication methods practice questions for VA-003.

Assess Vault tokens practice questions

Sharpen your VA-003 knowledge of Assess Vault tokens.

Create Vault policies practice questions

Sharpen your VA-003 knowledge of Create Vault policies.

Manage Vault leases practice questions

Manage Vault leases practice questions for VA-003.

Compare and configure secrets engines practice questions

Sharpen your VA-003 knowledge of Compare and configure secrets engines.

Utilize Vault CLI and API practice questions

Practise VA-003 questions linked to Utilize Vault CLI and API.

Explain Vault architecture practice questions

Explain Vault architecture practice questions for VA-003.

Explain encryption as a service practice questions

Explain encryption as a service practice questions for VA-003.

VA-003 fundamentals practice questions

Practise VA-003 questions linked to VA-003 fundamentals.

VA-003 scenario practice questions

Work through VA-003 questions on VA-003 scenario.

VA-003 troubleshooting practice questions

VA-003 troubleshooting practice questions for VA-003.

Practice set

Practice scenarios

Question 1mediummultiple choice
Full question →

Refer to the exhibit. After executing these commands, what is the expected behavior?

Exhibit

$ vault secrets enable -path=transit transit
$ vault write -f transit/keys/my-key type=aes256-gcm96
$ vault write transit/encrypt/my-key plaintext=$(base64 <<< "secretdata")
$ vault write transit/decrypt/my-key ciphertext=$CIPHER
Question 2easymultiple choice
Full question →

Refer to the exhibit. A user wants to write a secret 'db_password' with value 's3cret' to this secrets engine. Which CLI command should be used?

Exhibit

$ vault secrets enable -path=shared -version=2 kv
Question 3easymultiple choice
Full question →

Refer to the exhibit. What does min_decryption_version = 1 indicate?

Exhibit

$ vault read transit/keys/my-key
Key                       Value
---                       -----
allow_plaintext_backup    false
deletion_allowed          false
derived                   false
exportable                false
keys                      map[1:...]
latest_version            2
min_available_version     0
min_decryption_version    1
min_encryption_version    0
name                      my-key
supports_encryption       true
supports_decryption       true
supports_derivation       true
supports_key_rotation     true
type                      aes256-gcm96
Question 4hardmultiple choice
Full question →

Refer to the exhibit. Based on the output from 'vault status', which statement is true?

Exhibit

Key                      Value
---                      -----
Seal Type                shamir
Initialized              true
Sealed                   false
Total Shares             5
Threshold                3
Version                  1.15.2
Storage Type             consul
Cluster Name             vault-cluster
Cluster ID               abc123
HA Enabled               true
HA Cluster               n/a
HA Mode                  standby
Active Node Address      <none>
Raft Committed Index     42
Raft Applied Index       42
Question 5hardmultiple choice
Full question →

Refer to the exhibit. An application token has the above policy. Which operation will fail?

Exhibit

path "transit/keys/mykey" {
  capabilities = ["create", "update", "delete"]
}
path "transit/keys/mykey/rotate" {
  capabilities = ["update"]
}
path "transit/encrypt/mykey" {
  capabilities = ["create", "update"]
}
path "transit/decrypt/mykey" {
  capabilities = ["create", "update"]
}
Question 6mediummultiple choice
Full question →

Refer to the exhibit. An admin wants to ensure this token can be used for 60 hours total. Which action should be taken?

Exhibit

```
$ vault token lookup s.abc123
Key                 Value
---                 -----
accessor            a1b2c3d4e5f6
creation_time       1700000000
creation_ttl        24h
display_name        my-app
explicit_max_ttl    48h
expire_time         1700014400
id                  s.abc123
issue_time          1700000000
meta                map[service:app1]
num_uses            0
orphan              true
path                auth/token/create
policies            [default my-policy]
renewable           true
ttl                 24h
type                service
```
Question 7mediummultiple choice
Full question →

Refer to the exhibit. A user with this policy attempts to read the secret at path "secret/data/team-a/admin". What will happen?

Exhibit

path "secret/data/team-a/*" {
  capabilities = ["read", "list"]
}
path "secret/data/team-a/admin" {
  capabilities = ["deny"]
}
Question 8easymultiple choice
Full question →

Based on the exhibit, what is the maximum total lifespan of this lease?

Exhibit

Refer to the exhibit.

```
$ vault lease lookup database/creds/readonly/abc123
Key                 Value
---                 -----
id                  database/creds/readonly/abc123
issue_time          2023-10-05T14:30:00Z
renewable           true
ttl                 30m
max_ttl             1h
```
Question 9hardmultiple choice
Full question →

An administrator runs the commands shown in the exhibit. Later, they run 'vault kv delete kv-v2/secret' and then 'vault kv undelete -versions=1 kv-v2/secret' to recover the secret. Which command must the administrator run to verify that the secret is now readable?

Exhibit

Refer to the exhibit.
```
$ vault secrets enable -path=kv-v2 kv-v2
$ vault kv put kv-v2/secret username=admin password=s3cret
$ vault kv get kv-v2/secret
====== Metadata ======
Key              Value
---              -----
created_time     2023-01-01T00:00:00Z
deletion_time    n/a
destroyed        false
version          1

====== Data ======
Key         Value
---         -----
password    s3cret
username    admin

$ vault kv metadata get kv-v2/secret
Key                 Value
---                 -----
cas_required        false
created_time        2023-01-01T00:00:00Z
current_version     1
custom_metadata     map[]
delete_version_after    0s
max_versions        0
oldest_version      0
updated_time        2023-01-01T00:00:00Z
```
Question 10easymultiple choice
Full question →

Refer to the exhibit. A developer receives this error when attempting to decrypt data. What is the most likely cause?

Exhibit

Error making API request.

URL: POST http://vault.example.com/v1/transit/decrypt/mykey
Code: 400. Errors:

* invalid ciphertext: invalid base64 string
Question 11mediummultiple choice
Full question →

Refer to the exhibit. What is the purpose of the -field=ciphertext flag in this command?

Exhibit

$ vault write -address=https://vault.example.com -field=ciphertext transit/encrypt/my-key plaintext=$(base64 <<< "secret data")
Question 12mediummultiple choice
Full question →

Refer to the exhibit. A developer issues a Vault CLI command to write a secret to path 'secret/data/team/billing'. What will be the outcome?

Exhibit

path "secret/data/team/*" {
  capabilities = ["create", "update", "read", "delete"]
}

path "secret/data/team/billing" {
  capabilities = ["read"]
}
Question 13hardmultiple choice
Full question →

Refer to the exhibit. A Vault policy is defined as shown. A user presents a token with this policy. Which operation will be permitted?

Exhibit

path "secret/data/engineering" {
  capabilities = ["read", "list"]
}
path "secret/data/finance" {
  capabilities = ["deny"]
}
path "secret/data/engineering/*" {
  capabilities = ["create", "update", "delete"]
}
path "secret/data/finance/*" {
  capabilities = ["deny"]
}
Question 14mediummultiple choice
Full question →

Refer to the exhibit. What seal mechanism is configured for this Vault instance?

Exhibit

storage "file" {
  path = "/vault/data"
}

seal "awskms" {
  region     = "us-west-2"
  kms_key_id = "1234abcd-12ab-34cd-56ef-1234567890ab"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = "false"
  tls_cert_file = "/etc/vault/vault.crt"
  tls_key_file  = "/etc/vault/vault.key"
}

api_addr = "https://vault.example.com:8200"
cluster_addr = "https://vault.example.com:8201"
Question 15hardmultiple choice
Full question →

Refer to the exhibit. An application uses this policy to access Vault. The application is able to read database credentials from `database/creds/my-role`. However, attempts to list all roles at `database/roles/` fail. What is the most likely cause?

Exhibit

path "database/creds/my-role" {
  capabilities = ["read"]
}
path "database/roles/*" {
  capabilities = ["list"]
}
path "sys/mounts" {
  capabilities = ["read"]
}

These VA-003 practice questions are part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style VA-003 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.