HashiCorp Vault Associate VA-003 practice test

Refer to the exhibit. A developer reports that a token they created using `vault token create -policy=my-policy -ttl=2h` is no longer working after 1 hour. The token lookup output shows the token details. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
$ vault token lookup s.abc123
Key                 Value
---                 -----
accessor            a.xyz789
creation_time       1712345678
expiration_time     1712355678
creation_ttl        2h
display_name        mytoken
entity_id           entity-uuid-123
meta                map[team:dev]
num_uses            0
orphan              true
path                auth/token/create
policies            [default my-policy]
renewable           true
type                service
```

Trap 1: The token has num_uses set to 0, meaning it can only be used once.

num_uses=0 means unlimited use, not a single use.

Trap 2: The token is a service token and cannot be renewed.

Service tokens can be renewed; this is not the issue.

Trap 3: The token is an orphan token and requires the parent token to be…

Orphan tokens have no parent; they are independent.

A
The token's max_ttl was set to 1h when created, and the token reached its max_ttl.
If max_ttl is less than the requested TTL, the token will expire at max_ttl, causing it to stop working after 1 hour.
B
The token has num_uses set to 0, meaning it can only be used once.
Why wrong: num_uses=0 means unlimited use, not a single use.
C
The token is a service token and cannot be renewed.
Why wrong: Service tokens can be renewed; this is not the issue.
D
The token is an orphan token and requires the parent token to be valid.
Why wrong: Orphan tokens have no parent; they are independent.

Question 2mediummultiple choice

A company uses Vault to manage database credentials for a production PostgreSQL cluster. The application team reports that dynamic credentials generated from the database secrets engine are being revoked before the application has finished using them. The Vault lease TTL is set to 1 hour, but the application workload sometimes runs for up to 2 hours. What is the MOST efficient way to ensure credentials remain valid for the full workload duration?

Trap 1: Set max_ttl to 2 hours on the database role.

max_ttl only sets an upper bound; the default TTL remains 1 hour unless the application explicitly requests a longer TTL.

Trap 2: Set the Vault server's default_lease_ttl to 2 hours in the server…

This changes the global default for all secrets, which could weaken security for other secrets and is not targeted.

Trap 3: Have the application manually renew the lease every 30 minutes.

Manual renewal is operationally complex and risks interruption if renewal fails; it is less efficient than adjusting the TTL.

A
Set max_ttl to 2 hours on the database role.
Why wrong: max_ttl only sets an upper bound; the default TTL remains 1 hour unless the application explicitly requests a longer TTL.
B
Set the Vault server's default_lease_ttl to 2 hours in the server configuration.
Why wrong: This changes the global default for all secrets, which could weaken security for other secrets and is not targeted.
C
Increase the default_lease_ttl on the database secrets engine mount to 2 hours.
This raises the default TTL for all credentials created by this engine, matching the workload's maximum duration without code changes.
D
Have the application manually renew the lease every 30 minutes.
Why wrong: Manual renewal is operationally complex and risks interruption if renewal fails; it is less efficient than adjusting the TTL.

Question 3hardmultiple choice

An administrator runs the commands shown in the exhibit. Later, they run 'vault kv delete kv-v2/secret' and then 'vault kv undelete -versions=1 kv-v2/secret' to recover the secret. Which command must the administrator run to verify that the secret is now readable?

Exhibit

Refer to the exhibit.
```
$ vault secrets enable -path=kv-v2 kv-v2
$ vault kv put kv-v2/secret username=admin password=s3cret
$ vault kv get kv-v2/secret
====== Metadata ======
Key              Value
---              -----
created_time     2023-01-01T00:00:00Z
deletion_time    n/a
destroyed        false
version          1

====== Data ======
Key         Value
---         -----
password    s3cret
username    admin

$ vault kv metadata get kv-v2/secret
Key                 Value
---                 -----
cas_required        false
created_time        2023-01-01T00:00:00Z
current_version     1
custom_metadata     map[]
delete_version_after    0s
max_versions        0
oldest_version      0
updated_time        2023-01-01T00:00:00Z
```

Trap 1: vault kv list kv-v2/secret

This lists keys under the path, but not the secret content.

Trap 2: vault read kv-v2/data/secret

The correct path is 'kv-v2/data/secret' but the command syntax is 'vault kv get', not 'vault read' directly for KV v2.

Trap 3: vault kv metadata get kv-v2/secret

This shows metadata, not the secret data.

A
vault kv list kv-v2/secret
Why wrong: This lists keys under the path, but not the secret content.
B
vault read kv-v2/data/secret
Why wrong: The correct path is 'kv-v2/data/secret' but the command syntax is 'vault kv get', not 'vault read' directly for KV v2.
C
vault kv get kv-v2/secret
After undelete, the secret is readable; this command retrieves the data.
D
vault kv metadata get kv-v2/secret
Why wrong: This shows metadata, not the secret data.

Question 4mediummultiple choice

A security administrator notices that a Vault client using AppRole authentication is generating a very large number of tokens, causing performance issues. The administrator finds that the same AppRole role is used by multiple applications. What should the administrator do to reduce the number of tokens while maintaining security?

Trap 1: Decrease the token TTL on the AppRole role

Shorter TTL means tokens expire faster but doesn't limit the rate of token generation.

Trap 2: Periodically rotate the secret ID

Rotation does not limit the number of active tokens.

Trap 3: Set secret_id_num_uses to 1 on the AppRole role

This limits the number of uses of each secret ID, not the number of tokens issued.

A
Decrease the token TTL on the AppRole role
Why wrong: Shorter TTL means tokens expire faster but doesn't limit the rate of token generation.
B
Periodically rotate the secret ID
Why wrong: Rotation does not limit the number of active tokens.
C
Create separate AppRole roles for each application
This allows distinct secret IDs and token limits per application.
D
Set secret_id_num_uses to 1 on the AppRole role
Why wrong: This limits the number of uses of each secret ID, not the number of tokens issued.

Question 5hardmulti select

Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?

Trap 1: Kubernetes auth requires the secret_id to be specified in a…

Kubernetes auth uses a token, not a secret_id.

Trap 2: Both AppRole and Kubernetes support response wrapping for initial…

Only AppRole supports secret_id wrapping; Kubernetes token is already short-lived.

Trap 3: AppRole tokens are always batch tokens, while Kubernetes tokens are…

Both methods can generate service tokens by default.

A
AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.
AppRole uses two components; Kubernetes uses a single token.
B
Kubernetes auth requires the secret_id to be specified in a configuration file.
Why wrong: Kubernetes auth uses a token, not a secret_id.
C
Kubernetes authentication uses JWT tokens that are signed by the Kubernetes API server.
The service account token is a JWT signed by the cluster.
D
Both AppRole and Kubernetes support response wrapping for initial credentials.
Why wrong: Only AppRole supports secret_id wrapping; Kubernetes token is already short-lived.
E
AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.
Why wrong: Both methods can generate service tokens by default.

Question 6mediummultiple choice

An administrator wants to use Vault's authentication method that allows users to log in with their corporate credentials via a federated identity system. The credentials are stored in an external identity provider (IdP) and Vault should not store any passwords. Which authentication method should be configured?

Trap 1: LDAP authentication

Vault must have access to the LDAP directory and stores bind credentials.

Trap 2: Userpass authentication

Vault stores hashed passwords internally.

Trap 3: Token authentication

Token is not user authentication, it's a pre-existing credential.

A
LDAP authentication
Why wrong: Vault must have access to the LDAP directory and stores bind credentials.
B
OIDC authentication
Uses external IdP for authentication, no password stored in Vault.
C
Userpass authentication
Why wrong: Vault stores hashed passwords internally.
D
Token authentication
Why wrong: Token is not user authentication, it's a pre-existing credential.