Pass the HashiCorp Security Automation Certification HCVA0-003 Questions and answers with Dumpstech

When looking at Vault token details, the policies key helps you find the paths the token is able to access. Policies are a declarative way to grant or forbid access to certain paths and operations in Vault. Policies are written in HCL or JSON and are attached to tokens by name. Policies are deny by default, so an empty policy grants no permission in the system. A token can have one or more policies associated with it, and the effective policy is the union of all the individual policies. You can view the token details by using the vault token lookup command or the auth/token/lookup API endpoint. The output will show the policies key with a list of policy names that are attached to the token. You can also view the contents of a policy by using the vault policy read command or the sys/policy API endpoint. The output will show the rules key with the HCL or JSON representation of the policy.  The rules will specify the paths and the capabilities (such as create, read, update, delete, list, etc.) that the policy allows or denies. References: https://developer.hashicorp.com/vault/docs/concepts/policies 4 , https://developer.hashicorp.com/vault/docs/commands/token/lookup 5 , https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token 6 , https://developer.hashicorp.com/vault/docs/commands/policy/read 7 , https://developer.hashicorp.com/vault/api-docs/system/policy 8

An authentication method should be selected for a use case based on the auth method that best establishes the identity of the client. The identity of the client is the basis for assigning a set of policies and permissions to the client in Vault. Different auth methods have different ways of verifying the identity of the client, such as using passwords, tokens, certificates, cloud credentials, etc. Depending on the use case, some auth methods may be more suitable or convenient than others. For example, for human users, the userpass or ldap auth methods may be easy to use, while for machines or applications, the approle or aws auth methods may be more secure and scalable. The choice of the auth method should also consider the trade-offs between security, performance, and usability. References:  Auth Methods | Vault | HashiCorp Developer ,  Authentication - Concepts | Vault | HashiCorp Developer

An identity group is a collection of entities that share some common attributes. An identity group can have one or more policies attached to it, which are inherited by all the members of the group. An identity group can also have subgroups, which can further refine the policies and attributes for a subset of entities.

One of the use cases of an identity group is to consistently apply the same set of policies to a collection of entities. For example, an organization may have different teams or departments, such as engineering, sales, or marketing. Each team may have its own identity group, with policies that grant access to the secrets and resources that are relevant to their work. By creating an identity group for each team, the organization can ensure that the entities belonging to each team have the same level of access and permissions, regardless of which authentication method they use to log in to Vault. References:  Identity: entities and groups | Vault | HashiCorp Developer ,  vault_identity_group | Resources | hashicorp/vault | Terraform | Terraform Registry

Vault policies are path-based, meaning access is granted or denied against Vault API paths and the operations allowed on those paths. This gives administrators granular control over what a user, application, or machine can do. For example, one policy can allow reading secrets under one path, while another allows managing configuration under a different path. This model also supports simple policy syntax and wildcard matching, making it scalable without requiring one completely separate rule for every object. Option A is too absolute because permissions are not automatically unique for every path; they are defined by policy. Option C is wrong because Vault paths are API paths, not a mounted operating-system file system. Therefore, option B correctly describes the real policy benefit. HashiCorp confirms that Vault policies are path-based and declarative.

================

The maximum time-to-live (TTL) for a token is defined by the lowest value among the following factors:

The authentication method that issued the token. Each auth method can have a default and a maximum TTL for the tokens it generates. These values can be configured by the auth method’s mount options or by the auth method’s specific endpoints.

The mount endpoint configuration that the token is accessing. Each secrets engine can have a default and a maximum TTL for the leases it grants. These values can be configured by the secrets engine’s mount options or by the secrets engine’s specific endpoints.

A parent token TTL. If a token is created by another token, it inherits the remaining TTL of its parent token, unless the parent token has an infinite TTL (such as the root token). A child token cannot outlive its parent token.

System max TTL. This is a global limit for all tokens and leases in Vault. It can be configured by the system backend’s max_lease_ttl option.

The client system that uses the token cannot define the maximum TTL for the token, as this is determined by Vault’s configuration and policies. The client system can only request a specific TTL for the token, but this request is subject to the limits imposed by the factors above.

The requirement is to enable a versioned Key/Value secrets engine at a custom mount path named my-secrets. KV version 2 can be enabled either by specifying kv-v2 as the plugin type or by enabling kv with the -version=2 flag and a path. Among the provided options, only vault secrets enable -path= " my-secrets " kv-v2 both enables the correct versioned KV engine and places it at the requested path. Option A enables an authentication method, not a secrets engine. Option C enables the KV engine but does not explicitly select KV version 2. Option D selects version 2 but does not set the required custom path. HashiCorp’s KV v2 setup documentation confirms that kv-v2 can be used directly with vault secrets enable -path < mount_path > .

================

Vault lease renewal uses an increment value, and the underlying unit used in the common lease-renewal example is seconds. HashiCorp explains that vault lease renew -increment=3600 my-lease-id requests the TTL to be adjusted to one hour, meaning 3600 seconds. This does not mean Vault only understands human-readable durations in daily administration; Vault commands often accept duration strings such as 1h or 30m. However, the exam question is asking for the base increment unit used for lease renewal, and the correct option is seconds. Minutes, hours, and days are higher-level expressions of time, but Vault’s lease renewal increment is fundamentally represented as a duration value that can be expressed in seconds.

================

Sealing Vault is an administrative operation performed against the /sys/seal endpoint or by using the equivalent operator command. It does not require Shamir unseal keys, because those are used to unseal Vault, not to seal it. It also does not require the root key to be manually supplied. A quorum or threshold of key holders is needed for unsealing in Shamir mode, but sealing is a different action. The best answer is a single operator with sufficient root-level privilege, meaning a token with the root policy or the required sudo capability on the seal path. HashiCorp’s /sys/seal API documentation states that sealing requires a token with the root policy or sudo capability on the path.

================

A lease ID is a unique identifier that is assigned by Vault to every dynamic secret and service type authentication token. A lease ID contains information such as the secret path, the secret version, the secret type, etc. A lease ID can be used to track and revoke access granted to a job by Vault at completion, as it allows the scheduler to perform the following operations:

Lookup the lease information by using the vault lease lookup command or the sys/leases/lookup API endpoint. This will return the metadata of the lease, such as the expire time, the issue time, the renewable status, and the TTL.

Renew the lease if needed by using the vault lease renew command or the sys/leases/renew API endpoint. This will extend the validity of the secret or the token for a specified increment, or reset the TTL to the original value if no increment is given.

Revoke the lease when the job is completed by using the vault lease revoke command or the sys/leases/revoke API endpoint. This will invalidate the secret or the token immediately and prevent any further renewals. For example, with the AWS secrets engine, the access keys will be deleted from AWS the moment a lease is revoked.

A lease ID is different from a token ID or a token accessor. A token ID is the actual value of the token that is used to authenticate to Vault and perform requests. A token ID should be treated as a secret and protected from unauthorized access. A token accessor is a secondary identifier of the token that is used for token management without revealing the token ID. A token accessor can be used to lookup, renew, or revoke a token, but not to authenticate to Vault or access secrets. A token ID or a token accessor can be used to revoke the token itself, but not the leases associated with the token. To revoke the leases, a lease ID is required.

An authentication method is a way to verify the identity of a user or a machine and issue a token with appropriate policies and metadata. An authentication method is not an object that can be tracked or revoked, but a configuration that can be enabled, disabled, tuned, or customized by using the vault auth commands or the sys/auth API endpoints.

A token accessor is deliberately designed as a limited reference to a token, not as a way to recover the real token value. Vault lets operators use an accessor to look up token properties, check token capabilities, renew the token, or revoke the token, but the actual token ID is not returned. This protects the sensitive token value while still allowing administrative workflows such as revoking a token issued to a workload. If the accessor could reveal the token ID, it would defeat its security purpose because anyone with the accessor and lookup permission could obtain usable credentials. Therefore, the statement is false. HashiCorp’s token documentation explicitly states that accessor lookup excludes the actual token ID.

================