Vault Enterprise Practice Test 1 — 10 Questions

Question 1

Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?

Accepted Answer

Response wrapping.. Response wrapping returns a single-use wrapping token that the client unwraps to retrieve the actual secret or token, so the sensitive credential is never exposed in transit or at rest in the client environment. This is the recommended pattern for securely delivering tokens to automated clients during the Secure Client Introduction phase. It limits exposure because the wrapping token is short-lived and can be unwrapped only once.

Answer

Using a long-lived root token.

Answer

Passing the token as an environment variable.

Answer

Storing the token in a public configuration repo.

Question 2

What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?

Accepted Answer

To define the duration of the authentication session.. The 'token_ttl' setting in an AppRole role definition controls the Time-To-Live (TTL) of the authentication token issued when a client successfully authenticates using that role. It defines how long the resulting Vault token remains valid before expiring, effectively setting the duration of the authentication session. This is distinct from SecretID TTL, RoleID TTL, or master key rotation, which are separate configuration parameters.

Answer

To limit the number of uses for the SecretID.

Answer

To set the expiration of the RoleID.

Answer

To set the rotation period for the Vault master key.

Question 3

What is the primary difference between HA replication and DR replication in Vault?

Accepted Answer

HA replication is for performance, DR is for data durability.. HA replication in Vault Enterprise is designed to improve read scalability and reduce latency by allowing secondary clusters to serve reads from replicated data, while writes still go to the primary. DR replication is designed for disaster recovery: it maintains a copy of data on a secondary that can be promoted to primary if the primary fails, prioritizing data durability and recovery over performance.

Answer

HA replication requires Enterprise, DR does not.

Answer

DR replication uses a different storage backend.

Answer

DR replication is faster than HA replication.

Question 4

A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)

Accepted Answer

tls_key_file. To enable TLS in a Vault listener stanza, you must provide the server certificate and its corresponding private key using tls_cert_file and tls_key_file. These are the only required parameters for TLS. The CA file is only needed for client certificate verification, and tls_min_version is optional. The other options are either not required or invalid parameter names.

Answer

tls_client_ca_file

Answer

tls_min_version

Answer

tls_ca_file

Question 5

In the context of the Vault Kubernetes Auth Method, what is the role of the 'reviewer_service_account'?

Accepted Answer

It is the account Vault uses to verify client tokens.. The reviewer_service_account is a Kubernetes service account that Vault uses to call the TokenReview API to validate client tokens presented during login. Vault needs permissions to create TokenReview requests, which are granted to this service account.

Answer

It is the account that logs in to Vault.

Answer

It is the account that manages K8s secrets.

Answer

It is an administrative account used to manage Vault roles.

Question 6

What is the effect of setting 'token_ttl' on a Role?

Accepted Answer

It sets the initial duration for the token.. Setting 'token_ttl' on a Vault role defines the initial Time-To-Live (TTL) for tokens issued under that role. This TTL is the starting lease duration before any renewal occurs. It does not affect the token's type, renewability, or number of uses; those are controlled by separate parameters like 'token_type', 'token_num_uses', and 'token_explicit_max_ttl'.

Answer

It restricts the number of uses.

Answer

It forces the token to be renewable.

Answer

It changes the token type.

Answer

It prevents the token from being revoked.

Question 7

A Vault Enterprise cluster uses a PKCS#11 HSM for seal wrap and auto-unseal. The security team rotates the HSM partition PIN. Vault nodes are still running with the old PIN in their configuration files. What is the most likely operational impact?

Accepted Answer

Vault nodes will fail to unseal after a restart because they cannot authenticate to the HSM with the old PIN.. The PKCS#11 PIN is used to authenticate to the HSM partition whenever Vault needs to open a session, including during unseal. Rotating the PIN without updating Vault's seal configuration means the old PIN is rejected, so nodes cannot unseal after a restart. The correct remediation is to update the pin value in the seal stanza and restart Vault.

Answer

Vault will automatically fall back to Shamir unseal and prompt for unseal keys.

Answer

Vault continues to operate normally because the PIN is only used during initial unseal and is cached in memory.

Answer

Seal wrap operations will continue using the old PIN until the next key rotation, then fail.

Question 8

A Vault Enterprise administrator needs to delegate the management of a specific secrets engine to a team. The team should be able to create, update, and delete roles within the 'database' secrets engine but should not be able to modify the secrets engine's configuration or access other secrets engines. Which policy should the administrator create?

Accepted Answer

A policy with path 'database/roles/*' and capabilities 'create', 'read', 'update', 'delete', 'list'.. The policy must grant the necessary capabilities on the role management path without including the configuration path. Using 'database/roles/*' with 'create', 'read', 'update', 'delete', and 'list' allows the team to manage roles. The 'list' capability is needed to enumerate roles. This scoped policy ensures the team cannot modify the secrets engine's configuration or access other engines, adhering to least privilege.

Answer

A policy with path 'database/*' and capabilities 'create', 'read', 'update', 'delete', 'list'.

Answer

A policy with path 'sys/mounts/database' and capabilities 'create', 'read', 'update', 'delete'.

Answer

A policy with path 'database/creds/*' and capabilities 'read'.

Question 9

Which TWO of the following are true about AppRole 'SecretID' management?

Accepted Answer

SecretIDs can be constrained by 'num_uses'.. Option B is correct because a SecretID can be created with a 'num_uses' constraint, meaning it is invalidated after a set number of authentication uses, which limits the blast radius if the SecretID leaks. Option D is correct because SecretIDs are issued with a TTL (via 'secret_id_ttl' on the role or an explicit TTL at generation), after which they expire and can no longer be used to authenticate. Option A is wrong because RoleID and SecretID are distinct AppRole credentials: the RoleID identifies the role and is not secret, while the SecretID is the sensitive half of the pair. Option C is wrong because SecretIDs are sensitive credentials and must never be committed in cleartext to version control. Option E is wrong because each SecretID is uniquely generated per application/instance, not shared across all applications in a namespace.

Answer

SecretIDs are synonymous with RoleIDs.

Answer

SecretIDs should be stored in cleartext in version control.

Answer

SecretIDs are the same for all applications in a namespace.

Question 10

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Accepted Answer

The storage backend (e.g., Consul).. In a Vault HA cluster, the storage backend (typically Consul or Vault's integrated Raft storage) is responsible for leader election. Vault nodes compete for a lock in the storage backend, and whichever node acquires the lock becomes the active leader while the others become standbys. This lock-based mechanism guarantees only one active node at a time.

Answer

The load balancer.

Answer

The Vault server process configuration file.

Answer

The Vault CLI.