VA-003 sample questions

Question 1

While troubleshooting a Kubernetes authentication issue, you notice that the application pod is receiving a 403 Permission Denied error when attempting to login. You verify the role exists. Which API endpoint would you check to confirm the Kubernetes auth method configuration, specifically the `kubernetes_host` and `kubernetes_ca_cert`?

Accepted Answer

GET /auth/kubernetes/config

Answer

LIST /sys/mounts/auth

Answer

GET /sys/auth/kubernetes

Answer

POST /auth/kubernetes/login

Question 2

A developer needs to authenticate to Vault using the Userpass method via the API. The Vault server is located at `https://vault.example.com:8200`. Which of the following `curl` commands correctly performs the login operation?

Accepted Answer

curl --request POST --data '{"password": "my-password"}' https://vault.example.com:8200/v1/auth/userpass/login/my-username

Answer

curl --request GET --user my-username:my-password https://vault.example.com:8200/v1/auth/userpass/login

Answer

curl --request PUT --data '{"username": "my-username", "password": "my-password"}' https://vault.example.com:8200/v1/sys/auth/login

Answer

curl --request POST --header "X-Vault-Token: my-password" https://vault.example.com:8200/v1/auth/login

Question 3

You are consulting for a company that wants to standardize their Vault authentication. They need to separate human users from automated workloads. Which of the following authentication methods are primarily designed for **Machine/System** authentication? (Select TWO)

Accepted Answer

AppRole

Accepted Answer

Kubernetes

Answer

OIDC

Answer

LDAP

Question 4

A developer needs to authenticate to Vault using a newly created token auth method. They have been provided with a token `s.12345`. Which CLI command should they use to authenticate and set this token for subsequent commands?

Accepted Answer

vault login s.12345

Answer

vault token authenticate s.12345

Answer

vault auth login -token=s.12345

Answer

vault write auth/token/login token=s.12345

Question 5

You are writing a policy to grant read access to all secrets under `secret/data/project-a/` recursively. You also need to ensure that the user can list the keys at the root `secret/metadata/` but NOT see any secrets in `secret/data/project-b/`. Which of the following policy path definitions uses the correct wildcard syntax?

Accepted Answer

path "secret/data/project-a/*" { capabilities = ["read"] }

Answer

path "secret/data/project-a/..." { capabilities = ["read"] }

Answer

path "secret/data/project-a/%" { capabilities = ["read"] }

Answer

path "secret/data/project-a/+" { capabilities = ["read"] }

Question 6

A user has two policies attached to their token: policy-a and policy-b.
policy-a grants ["read", "list"] on secret/data/finance.
policy-b grants ["update"] on secret/data/finance.
However, the administrator adds a new policy-c that grants ["deny"] on secret/data/finance and attaches it to the user.

What is the effective capability of the user on secret/data/finance?

Accepted Answer

No access (Deny)

Answer

Read, List, Update

Answer

Update only

Answer

Read and List only

VA-003 Sample Questions & Answers

Ready for the real thing?

VA-003 Sample Questions & Answers

Related practice tests

Ready for the real thing?