Vault Associate 002 practice test

1. Question 1 · 1

   What command creates a secret with the key "my-password" and the value "53cr3t" at path "my-secrets" within the KV secrets engine mounted at "secret"?

   Choose one answer.

   • vault kv put secret/my-secrets/my-password 53cr3t
   • vault kv write secret/my-secrets/my-password 53cr3t
   • vault kv write 53cr3t my-secrets/my-password
   • vault kv put secret/my-secrets my-password-53cr3t

2. Question 2 · 1

   What can be used to limit the scope of a credential breach?

   Choose one answer.

   • Storage of secrets in a distributed ledger
   • Enable audit logging
   • Use of a short-lived dynamic secrets
   • Sharing credentials between applications

3. Question 3 · 1

   What environment variable overrides the CLI’s default Vault server address?

   Choose one answer.

   • VAULT_ADDR
   • VAULT_HTTP_ADDRESS
   • VAULT_ADDRESS
   • VAULT_HTTPS_ADDRESS

4. Question 4 · 1

   Which of the following statements describe the CLI command below? $ vault login -method=ldap username=mitchellh

   Choose one answer.

   • Generates a token which is response wrapped
   • You will be prompted to enter the password
   • By default, the generated token is valid for 24 hours
   • Fails because the password is not provided

5. Question 5 · 1

   The following three policies exist in Vault What do these policies allow an organization to do? app.hcl callcenter.hcl rewrap.hcl

   Choose one answer.

   

   

   

   • Separates permissions allowed on actions associated with the transit secret engine
   • Nothing, as the minimum permissions to perform useful tasks are not present
   • Encrypt decrypt, and rewrap data using the transit engine all in one policy
   • Create a transit encryption key for encrypting, decrypting, and rewrapping encrypted data

6. Question 6 · 1

   Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would you recommend?

   Choose one answer.

   • Google Cloud Secrets Engine
   • Identity secrets engine
   • Key/Value secrets engine version 2
   • SSH secrets engine

7. Question 7 · 1

   Which of these is not a benefit of dynamic secrets?

   Choose one answer.

   • Supports systems which do not natively provide a method of expiring credentials
   • Minimizes damage of credentials leaking
   • Ensures that administrators can see every password used
   • Replaces cumbersome password rotation tools and practices

8. Question 8 · 1

   Which of the following cannot define the maximum time-to-live (TTL) for a token?

   Choose one answer.

   • By the authentication method
   • By the client system
   • By the mount endpoint configuration
   • A parent token TTL
   • System max TTL

9. Question 9 · 1

   What are orphan tokens?

   Choose one answer.

   • Orphan tokens are tokens with a use limit so you can set the number of uses when you create them
   • Orphan tokens are not children of their parent; therefore, orphan tokens do not expire when their parent does
   • Orphan tokens are tokens with no policies attached
   • Orphan tokens do not expire when their own max TTL is reached

10. Question 10 · 1

    To give a role the ability to display or output all of the end points under the /secrets/apps/* end point it would need to have which capability set?

    Choose one answer.

    • update
    • read
    • sudo
    • list
    • None of the above

11. Question 11 · 1

    The vault lease renew command increments the lease time from:

    Choose one answer.

    • The current time
    • The end of the lease

12. Question 12 · 1

    When using Integrated Storage, which of the following should you do to recover from possible data loss?

    Choose one answer.

    • Failover to a standby node
    • Use snapshot
    • Use audit logs
    • Use server logs

13. Question 13 · 1

    How many Shamir’s key shares are required to unseal a Vault instance?

    Choose one answer.

    • All key shares
    • A quorum of key shares
    • One or more keys
    • The threshold number of key shares

14. Question 14 · 1

    Which of these are a benefit of using the Vault Agent?

    Choose one answer.

    • Vault Agent allows for centralized configuration of application secrets engines
    • Vault Agent will auto-discover which authentication mechanism to use
    • Vault Agent will enforce minimum levels of encryption an application can use
    • Vault Agent will manage the lifecycle of cached tokens and leases automatically

15. Question 15 · 1

    Which of the following describes usage of an identity group?

    Choose one answer.

    • Limit the policies that would otherwise apply to an entity in the group
    • When they want to revoke the credentials for a whole set of entities simultaneously
    • Audit token usage
    • Consistently apply the same set of policies to a collection of entities

Paid access to all 82 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.