VA-003 sample questions

Question 1

You want to create a policy that allows a user to manage their own secrets in a path that includes their entity ID. Which of the following policy path templates correctly uses the interpolation syntax to achieve this?

Accepted Answer

path "secret/data/users/{{identity.entity.id}}/*" { capabilities = ["create", "read", "update", "delete", "list"] }

Answer

path "secret/data/users/[[identity.entity.id]]/*" { capabilities = ["create"] }

Answer

path "secret/data/users/%identity.entity.id%/*" { capabilities = ["create"] }

Answer

path "secret/data/users/${identity.entity.id}/*" { capabilities = ["create"] }

Question 2

True or False: The `sudo` capability is required in a policy to access the `sys/seal` path to seal the Vault.

Accepted Answer

True

Answer

False

Question 3

**Case Study:** GlobalCorp has three engineering teams: Alpha, Beta, and Gamma. You have enabled the KV v2 secrets engine at the path `secret/`. **Requirements:** 1. Team Alpha must be able to read and list secrets under `secret/data/alpha/` but cannot delete them. 2. Team Beta must be able to create and update secrets under `secret/data/beta/` but cannot read them (write-only). 3. Team Gamma needs full control over `secret/data/gamma/`. Which of the following policy sets correctly implements these requirements?

Accepted Answer

Alpha Policy: path "secret/data/alpha/*" { capabilities = ["read", "list"] } Beta Policy: path "secret/data/beta/*" { capabilities = ["create", "update"] } Gamma Policy: path "secret/data/gamma/*" { capabilities = ["create", "read", "update", "delete", "list"] }

Answer

Alpha Policy: path "secret/data/alpha/*" { capabilities = ["read"] } Beta Policy: path "secret/data/beta/*" { capabilities = ["create"] } Gamma Policy: path "secret/data/gamma/*" { capabilities = ["root"] }

Answer

Alpha Policy: path "secret/+/alpha/*" { capabilities = ["read", "list"] } Beta Policy: path "secret/+/beta/*" { capabilities = ["create", "update"] } Gamma Policy: path "secret/+/gamma/*" { capabilities = ["create", "read", "update", "delete", "list"] }

Answer

Alpha Policy: path "secret/alpha/*" { capabilities = ["read", "list"] } Beta Policy: path "secret/beta/*" { capabilities = ["write"] } Gamma Policy: path "secret/gamma/*" { capabilities = ["sudo"] }

Question 4

A DevOps engineer is configuring a CI/CD pipeline that needs to authenticate to Vault to retrieve database credentials. The pipeline runs in a trusted network zone but creates ephemeral containers for each build. The team wants to avoid managing long-lived static credentials like tokens. Which authentication method is BEST suited for this machine-to-machine scenario to enforce the principle of least privilege and utilize role-based restrictions?

Accepted Answer

AppRole Auth Method

Answer

LDAP Auth Method

Answer

Userpass Auth Method

Answer

GitHub Auth Method

Question 5

You are integrating an external identity provider using OIDC for your developer team. You have successfully enabled the auth method at `auth/oidc`. You now need to configure the role that maps the OIDC provider's claims to Vault policies. Which CLI command should you use to register this role configuration?

Accepted Answer

vault write auth/oidc/role/dev-role user_claim="email" allowed_redirect_uris="http://localhost:8250/oidc/callback" policies="default"

Answer

vault write sys/auth/oidc/role/dev-role claim="email" policy="default"

Answer

vault auth enable oidc -role=dev-role user_claim="email"

Answer

vault update auth/oidc/config/dev-role allowed_redirect_uris="http://localhost:8250/oidc/callback"

Question 6

A security architect is designing an access model where users can log in via GitHub or LDAP. Regardless of the authentication method used, the user should be recognized as the same unique identity within Vault to maintain consistent policy application and audit trails. Which Vault component facilitates this requirement?

Accepted Answer

Identity Entities and Aliases

Answer

AppRole SecretID

Answer

Cubbyhole Secrets Engine

Answer

Response Wrapping

VA-003 HashiCorp Certified: Vault Associate (003) Practice Questions

Create an account to continue.

Create an account to continue.

Related exams