[Aug 29, 2026] TestBraindump HCVA0-003 Exam Practice Test Questions (Updated 328 Questions) [Q13-Q37]

QUESTION 13
What is the default TTL for tokens in Vault if one is not specified?

QUESTION 14
You have enabled the database secrets engine at the database/ path and created the readonly role. You run vault read, and the output shown in the exhibit is returned.
Which command renews the given lease?
Exhibit:
$ vault read database/creds/readonly
lease_id database/creds/readonly/fyF5xDomnKeCHNZNQgStwBKD
lease_duration 1h
lease_renewable true
password Ala-ckirtymYaXACplHn
username v-token-readonly-6iRIcGv8tLpu816oblPY-1556567086

QUESTION 15
If a role is able to read a secret from Vault, but unable to change the values, what capability is missing in the policy?

QUESTION 16
How long does the Transit secrets engine store the resulting ciphertext by default?

QUESTION 17
True or False? Performing a rekey operation using the vault operator rekey command creates new unseal
/recovery keys as well as a new root key?

QUESTION 18
Which two interfaces automatically assume the token for subsequent requests after successfully authenticating? (Select two)

QUESTION 19
True or False? Your organization currently runs all of its workloads on Google Cloud Platform (GCP).
Recently, Vault has been deployed, and you need to select an auth method to authenticate your workloads with Vault. Based on this information, GCP is the only auth method that can be used in your environment.

QUESTION 20
You are enabling a secrets engine in Vault using the CLI. What subcommands are available when using the vault secrets command? (Select five)

QUESTION 21
You are using the Vault API to test authentication before modifying your CI/CD pipeline to properly authenticate to Vault. You manually authenticate to Vault and receive the response below. Based on the provided options, which of the following are true? (Select four)
* $ curl
* –request POST
* –data @payload.json
* https://vault.krausen.com:8200/v1/auth/userpass/login/bryan.krausen | jq
* *******************************************************************************
* ******* RESPONSE BELOW ********************************************************
* *******************************************************************************
* {
* “request_id”: “f758e8da-11b6-8341-d404-56f0c370a7fa”,
* “lease_id”: “”,
* “renewable”: false,
* “lease_duration”: 0,
* “data”: null,
* “wrap_info”: null,
* “warnings”: null,
* “auth”: {
* “client_token”: “hvs.CbzCNJCVWt63jyzyaJakgDwz”,
* “accessor”: “rffwXzKFcxvaQi6Vgo8tY4Lt”,
* “policies”: [
* “training”,
* “default”
* ],
* “token_policies”: [
* “training”,
* “default”
* ],
* “metadata”: {
* “username”: “bryan.krausen”
* },
* “lease_duration”: 84600,
* “renewable”: true,
* “entity_id”: “f1795f6a-c576-d619-b2d5-74c0aee08edb”,
* “token_type”: “service”,
* “orphan”: true
* }
* }

QUESTION 22
To secure your applications, your organization uses certificates generated by a public CA. However, this strategy has proven expensive and you have to revoke certificates even though they have additional time left.
What Vault plugin can be used to quickly generate X.509 certificates to secure your internal applications?

QUESTION 23
Which of the following is NOT a valid way in which a lease can be revoked in Vault?

QUESTION 24
Which of the following are true about Vault policies?
Pick the 2 correct responses below.

QUESTION 25
Your organization recently suffered a security breach on a specific application, and the security response team believes that MySQL database credentials were likely obtained during the event. The application generated the credentials using the database secrets engine in Vault mounted at the path database/. How can you quickly revoke all of the secrets generated by this secrets engine?

QUESTION 26
A DevOps engineer has set up LDAP and GitHub auth methods. The engineer must ensure user Sarah, who authenticates via either method, has consistent access permissions. Which approach correctly describes how to achieve this in Vault?

QUESTION 27
You need to create a limited-privileged token that isn’t impacted by the TTL of its parent. What type of token should you create?

QUESTION 28
A user is assigned the following policy, and they can successfully retrieve secrets using the CLI. However, the user reports receiving an error message in the UI. Why can’t the user access the secret in the Vault UI?
path “kv/apps/app01” { capabilities = [“read”] }
Successful retrieval using the CLI

(Error: Permission denied in UI)

QUESTION 29
True or False? Once you create a KV v1 secrets engine and place data in it, there is no way to modify the mount to include the features of a KV v2 secrets engine.

QUESTION 30
Which statement best describes the process of sealing a Vault instance?

QUESTION 31
Vault leases can be renewed based on what increment of time?

QUESTION 32
Sara uses the Vault CLI for administrative tasks on the production cluster. However, she encounters permission-denied errors when making changes and needs to check which policies are attached to her token to view and adjust permissions. What command can she run on the Vault node to see the attached policies?

QUESTION 33
What command can be used to update a Vault policy named web-app-1 using the command line?

QUESTION 34
Select the two default policies created in Vault. (Select two)

QUESTION 35
The Vault encryption key is stored in Vault’s backend storage.

QUESTION 36
True or False? The command vault lease revoke -prefix aws/ will revoke all leases associated with the secret engine mounted at /aws.

QUESTION 37
True or False? Once you authenticate to Vault using the API, subsequent requests will automatically be permitted without further interaction.