Candidates must configure Vault Agent auto-auth, cache, and template blocks correctly. The most important thing is knowing that the auto-auth component manages token lifecycle, including renewal, and that cache behavior is controlled per request or listener, not globally.
Start practicing
Vault Agent Configuration — choose a session length
Free · No account required
Domain overview
This domain covers configuring Vault Agent for auto-auth, caching, and templating on Vault Enterprise. It tests your ability to write agent HCL blocks, choose auth method parameters, control cache behavior, and manage token and secret lifecycles. Expect scenario-based items requiring precise knowledge of agent configuration syntax and runtime behavior.
Exam objectives
Configuring Vault Agent auto-auth method blocks for AWS, AppRole, and other auth methods using HCL
Using the cache block to enable or disable caching for specific requests via cache directives
Defining template blocks with change_mode actions such as signal, restart, and exec
Understanding how the auto-auth component manages token lifecycle and renewal for Vault Agent
Assuming cache disable is a global toggle rather than a per-request or per-listener setting within the cache block.
Forgetting that AWS auth method requires the role parameter to identify the IAM role, not the role_arn or similar.
Confusing change_mode actions: signal sends a signal, restart restarts the agent, and exec runs a command; not all are valid together.
Click any question to see the full explanation and answer options, or start a focused practice session above.
Where does the Vault Agent store the token it retrieves via auto-auth by default if a sink is not defined?
2When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?
3What is the benefit of using a Vault Agent sink?
4Which signal is commonly used with 'change_mode = signal' in Vault Agent templates to reload a service without stopping it?
5You want the Vault Agent to run as a sidecar. Which configuration block allows you to specify the listener address for the Vault Agent's internal API?
6When using 'template_config' to set the 'static_secret_render_interval', what is the minimum value you can set?
7Which component of the Vault Agent is responsible for managing the lifecycle of the vault token retrieved via auto-auth?
8Which configuration parameter in the Vault Agent 'cache' block allows you to disable caching for specific requests?
9Which TWO of the following are valid sink types in Vault Agent?
10Which TWO authentication methods are commonly configured in the 'auto_auth' block?
11Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?
12Which TWO of the following are valid parameters for configuring the 'sink' in Vault Agent?
13Your team runs Vault Agent with auto_auth using the AWS auth method on EC2 instances. The agent's token is about to expire, and you must ensure the agent continues to serve requests without manual intervention. Which TWO behaviors does Vault Agent perform to maintain a valid token? (Choose two.)
14A platform engineer is configuring a Vault Agent on a database server. The agent must use the AppRole auth method and write the resulting token to a file so that a local backup script can read it. Which top-level configuration block should the engineer populate to define the AppRole role ID and secret ID?
15Your security team requires that Vault Agent use a specific namespace in Vault Enterprise for all auto-auth and secret retrieval operations. The agent is configured with AppRole auto-auth. Which configuration parameter must you set to ensure the agent operates within the required namespace?
16A Vault Agent is configured with auto_auth using the AWS auth method and a cache block with use_auto_auth_token = true. A client application connects to the agent's listener and sends a request to read a secret at secret/data/app. The agent's cached token lacks permission for that path, but the client also provides its own Vault token in the X-Vault-Token header. How does the agent handle the request?
17You are configuring Vault Agent with a cache stanza to cache responses from a Vault Enterprise cluster. The cache is enabled, and you want to ensure that the agent can continue to serve cached secrets even if the Vault cluster becomes temporarily unavailable. Which cache parameter should you configure to control how long the agent will serve stale data?
18A DevOps engineer is using Vault Agent templates to render a database password from a KV v2 secrets engine. The secret is stored at secret/data/db with a key named password. The engineer wants to ensure the rendered file contains only the password value and no extra whitespace or newlines. Which template function should be used to trim whitespace from the secret value?
19You are configuring Vault Agent auto-auth with the AppRole auth method on a set of servers. You need to ensure that the agent can authenticate securely using role_id and secret_id. Which two configuration parameters are required within the auto_auth method block for AppRole? (Choose two.)
20You are configuring Vault Agent auto-auth with the AWS auth method. The agent must authenticate using an IAM role attached to an EC2 instance. Which two parameters are required in the auto_auth block's method configuration to enable this? (Choose two.)
21You are configuring a Vault Agent to use the AppRole auth method. The agent must retrieve a secret from a KV v2 secrets engine and render it into a configuration file. The secret path is 'secret/data/myapp/config'. Which template function should you use to access the secret's data?
Candidates must configure Vault Agent auto-auth, cache, and template blocks correctly. The most important thing is knowing that the auto-auth component manages token lifecycle, including renewal, and that cache behavior is controlled per request or listener, not globally.
The Courseiva Vault Enterprise question bank contains 21 questions in the Vault Agent Configuration domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Vault Agent Configuration domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included