VAULT-003 Practice Test

VAULT-003 practice test: what's covered

• Auth methods
• secrets engines
• policies
• tokens
• seal/unseal
• audit

Free VAULT-003 sample questions

1. A newly installed Vault server is started in production mode and an operator runs 'vault status'. The output reports Sealed: true. What does this state mean for the cluster?

   • A. The encryption key is not yet in memory, so Vault cannot decrypt the storage barrier and refuses all read or write operations until it is unsealed
   • B. Vault has crashed and the storage backend must be rebuilt from a snapshot before the server can be restarted again
   • C. The root token has expired and a new one must be generated before any secrets engine can be mounted on the cluster
   • D. TLS certificates are missing, so client connections are rejected even though secrets remain fully readable internally
   Show answer

   Correct: A. Vault always starts sealed because the encryption key that protects the storage barrier is not in memory. Unsealing reconstructs the master key and decrypts the barrier. The crash answer is incorrect because sealing is the normal startup state, not corruption. The root-token answer is wrong because token expiry does not seal Vault, and the TLS answer is wrong because a sealed Vault blocks all data operations, not just client TLS.

2. Your team wants to eliminate the manual operator step of submitting Shamir key shares every time Vault restarts in production. Which auto-unseal mechanisms can Vault use to wrap and unwrap the root key automatically? (Choose THREE)

   • A. A cloud KMS service such as AWS KMS, Azure Key Vault, or GCP Cloud KMS that wraps and unwraps the root key on startup
   • B. Transit auto-unseal, where a separate Vault cluster's transit engine performs the wrapping operation for this cluster
   • C. A hardware security module accessed over the PKCS#11 interface that stores and protects the wrapping key
   • D. Distributing additional Shamir key shares to more operators so fewer people are needed to reach the threshold
   • E. Caching the plaintext root key in the integrated storage backend so it loads automatically at boot time
   Show answer

   Correct: A and B and C. Auto-unseal delegates root-key wrapping to cloud KMS, another Vault's transit engine, or an HSM via PKCS#11, removing the manual share step. Distributing more Shamir shares is incorrect because it is still manual unsealing, not automation. Caching the plaintext root key in storage is wrong and dangerous because Vault never stores the unencrypted root key on disk.

3. You are designing a brand-new highly available Vault cluster and want to avoid running a separate datastore. Which storage backend does HashiCorp recommend for this deployment?

   • A. Integrated Storage using the Raft protocol, which is built into Vault, supports HA, and needs no external dependency
   • B. The Consul storage backend, which is now the only supported choice for any production high availability deployment
   • C. The filesystem storage backend, which supports HA when the directory is shared over NFS across all nodes
   • D. The in-memory storage backend, which persists data to disk between restarts and replicates across the cluster
   Show answer

   Correct: A. Integrated Storage (Raft) is HashiCorp's recommended backend for new clusters because it is embedded, replicates data across nodes, and supports HA without external systems. Consul is wrong because it is no longer required and adds operational overhead. The filesystem backend does not support HA, and the in-memory backend is non-persistent and meant only for development, so both are incorrect.

4. An application running on an EC2 instance must authenticate to Vault without any long-lived credential baked into its image. Which auth method best fits this requirement?

   • A. The AWS auth method, which validates either the signed EC2 instance identity document or an IAM STS GetCallerIdentity request
   • B. The userpass auth method, where each instance ships with a shared username and password stored in its configuration
   • C. The token auth method, where a long-lived root token is embedded into the application configuration at build time
   • D. The TLS certificate auth method using a single wildcard certificate copied onto every instance in the fleet
   Show answer

   Correct: A. The AWS auth method lets an instance prove its identity through the signed instance document (EC2 mode) or a signed STS request (IAM mode) with no stored secret. Userpass is incorrect because it requires distributing static passwords. The token answer is wrong and insecure because it embeds a long-lived root token. A shared wildcard certificate defeats per-instance identity, so it is also incorrect.

5. A pod scheduled in a Kubernetes cluster needs to log in to Vault using only the service account token mounted by the platform. Which auth method enables this workflow?

   • A. The Kubernetes auth method, which validates the service account JWT against the cluster's TokenReview API and maps it to a role
   • B. The AppRole auth method, where the pod must first fetch a role_id and secret_id from an external secret store
   • C. The LDAP auth method, where the pod binds to a corporate directory server using the namespace administrator credentials
   • D. The userpass auth method, which reads a static password from a Kubernetes ConfigMap mounted into the pod
   Show answer

   Correct: A. The Kubernetes auth method validates the pod's service account JWT through the TokenReview API and binds the role to a service account and namespace, so no secret is stored in the container. AppRole is incorrect because it needs a separately delivered secret_id. LDAP is wrong because pods do not bind to a directory, and userpass is wrong because storing a password in a ConfigMap is insecure and unnecessary here.

Last updated: 2026-10-19

VAULT-003 practice test FAQ