VA-003 Utilize Vault CLI and API Practice Question
Which TWO statements are true when troubleshooting a failed Vault CLI command?
⚠ Common exam trap
HashiCorp often tests the misconception that `vault status` is the first troubleshooting step for any CLI failure, but it only verifies server reachability and seal state, not token or permission issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'vault token lookup' to verify the token is valid and has the expected policies.
`vault token lookup` is the standard diagnostic command to inspect the current token's metadata, including its validity, creation time, TTL, and associated policies. If the token is expired, revoked, or lacks the necessary policies for the failed command, this command will reveal the issue directly without side effects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'vault token lookup' to verify the token is valid and has the expected policies.
Why this is correct
This helps diagnose token-related issues.
- ✗
Run 'vault write' to test if the token can write to a path.
Why it's wrong here
Writing is not a troubleshooting step; reading or looking up is more diagnostic.
- ✓
Run 'vault login' to re-authenticate and obtain a new token if needed.
Why this is correct
If the token is expired or invalid, logging in again is necessary.
- ✗
Run 'vault status' to check if the server is reachable.
Why it's wrong here
While server connectivity is important, the command failure may be due to token issues rather than connectivity.
- ✗
Run 'vault read' to test if any secret is accessible.
Why it's wrong here
While reading may reveal permission issues, it is not a direct troubleshooting step for CLI failures.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.