VA-003 Compare and configure secrets engines Practice Question
Which THREE steps are required to configure the database secrets engine for generating dynamic credentials?
⚠ Common exam trap
HashiCorp often tests the distinction between required configuration steps and optional or subsequent steps, so the trap here is that candidates mistakenly include tuning TTL or writing policies as mandatory steps when they are not part of the core three-step configuration sequence (enable, configure connection, create role).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a role that maps to the database user and permissions
Creating a role is the step that maps a named role in Vault to a database user template and its associated permissions (e.g., SQL statements for creation and revocation). This role definition is what Vault uses to dynamically generate a unique username and password when credentials are requested, ensuring each lease gets a dedicated database account with the specified privileges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a role that maps to the database user and permissions
Why this is correct
A role defines the generated credential attributes (e.g., username template, default TTL).
- ✗
Configure a policy to allow users to read credentials from the role
Why it's wrong here
While important for access control, it is not required for the engine to function; the engine itself works without policies.
- ✓
Configure the database connection with connection details and credentials
Why this is correct
Vault needs connection parameters to communicate with the database.
- ✗
Tune the engine's default TTL
Why it's wrong here
Tuning is optional and can be done later; not a required step.
- ✓
Enable the database secrets engine
Why this is correct
First step is to mount the engine.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.