VA-003 sample questions

Question 1

A DevOps engineer is configuring a CI/CD pipeline that needs to authenticate to Vault to retrieve database credentials. The pipeline runs in a trusted network zone but creates ephemeral containers for each build. The team wants to avoid managing long-lived static credentials like tokens. Which authentication method is BEST suited for this machine-to-machine scenario to enforce the principle of least privilege and utilize role-based restrictions?

Accepted Answer

AppRole Auth Method

Answer

LDAP Auth Method

Answer

Userpass Auth Method

Answer

GitHub Auth Method

Question 2

You are integrating an external identity provider using OIDC for your developer team. You have successfully enabled the auth method at `auth/oidc`. You now need to configure the role that maps the OIDC provider's claims to Vault policies. Which CLI command should you use to register this role configuration?

Accepted Answer

vault write auth/oidc/role/dev-role user_claim="email" allowed_redirect_uris="http://localhost:8250/oidc/callback" policies="default"

Answer

vault write sys/auth/oidc/role/dev-role claim="email" policy="default"

Answer

vault auth enable oidc -role=dev-role user_claim="email"

Answer

vault update auth/oidc/config/dev-role allowed_redirect_uris="http://localhost:8250/oidc/callback"

Question 3

A security architect is designing an access model where users can log in via GitHub or LDAP. Regardless of the authentication method used, the user should be recognized as the same unique identity within Vault to maintain consistent policy application and audit trails. Which Vault component facilitates this requirement?

Accepted Answer

Identity Entities and Aliases

Answer

AppRole SecretID

Answer

Cubbyhole Secrets Engine

Answer

Response Wrapping

Question 4

While troubleshooting a Kubernetes authentication issue, you notice that the application pod is receiving a 403 Permission Denied error when attempting to login. You verify the role exists. Which API endpoint would you check to confirm the Kubernetes auth method configuration, specifically the `kubernetes_host` and `kubernetes_ca_cert`?

Accepted Answer

GET /auth/kubernetes/config

Answer

LIST /sys/mounts/auth

Answer

GET /sys/auth/kubernetes

Answer

POST /auth/kubernetes/login

Question 5

A developer needs to authenticate to Vault using the Userpass method via the API. The Vault server is located at `https://vault.example.com:8200`. Which of the following `curl` commands correctly performs the login operation?

Accepted Answer

curl --request POST --data '{"password": "my-password"}' https://vault.example.com:8200/v1/auth/userpass/login/my-username

Answer

curl --request GET --user my-username:my-password https://vault.example.com:8200/v1/auth/userpass/login

Answer

curl --request PUT --data '{"username": "my-username", "password": "my-password"}' https://vault.example.com:8200/v1/sys/auth/login

Answer

curl --request POST --header "X-Vault-Token: my-password" https://vault.example.com:8200/v1/auth/login

Question 6

You are consulting for a company that wants to standardize their Vault authentication. They need to separate human users from automated workloads. Which of the following authentication methods are primarily designed for **Machine/System** authentication? (Select TWO)

Accepted Answer

AppRole

Accepted Answer

Kubernetes

Answer

OIDC

Answer

LDAP

HashiCorp Certified: Vault Associate (003) Free Sample Questions

Description

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Register free for 6 more questions

VA-003 Sample Questions

Register free for 6 more questions

Related practice tests