Vault Enterprise Practice Test 13 — 15 Questions

Question 1

You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?

Accepted Answer

Set 'num_uses' to 1.. The 'num_uses' parameter on an AppRole SecretID controls how many times the SecretID can be used to authenticate and retrieve a token. Setting num_uses=1 means the SecretID is consumed on first successful login and cannot be reused, providing single-use semantics. This is the standard way to enforce one-time SecretID usage in AppRole workflows.

Answer

Set 'secret_id_ttl' to 0.

Answer

Set 'token_bound_cidrs' to the client IP.

Answer

Set 'secret_id_no_store' to true.

Question 2

Which TWO of the following statements about the 'vault-agent' injector in Kubernetes are correct?

Accepted Answer

It runs as a Kubernetes Mutating Admission Webhook.. Option B is correct because the Vault Agent Injector is implemented as a Kubernetes Mutating Admission Webhook that intercepts pod creation requests and mutates the pod spec to add the vault-agent and vault-agent-init containers along with the necessary annotations. Option C is correct because the injector configures Vault Agent to render secrets into files inside a shared in-memory volume (typically /vault/secrets) mounted into the application container, allowing secrets to be consumed directly as files. Option A is incorrect because the injector is available in both Vault Enterprise and Vault Community (non-Enterprise) editions. Option D is incorrect because injected secrets are still fetched using the pod's Kubernetes service account token via Vault's Kubernetes auth method, so all Vault policies and auth boundaries apply. Option E is incorrect because Vault Agent can run continuously and re-render secrets when they are renewed or rotated, so manual pod restarts are not required for updates.

Answer

It is only available for non-Enterprise versions.

Answer

It bypasses all Vault policies.

Answer

It requires manual pod restarts to update secrets.

Question 3

Which component of the Vault Agent is responsible for managing the lifecycle of the vault token retrieved via auto-auth?

Accepted Answer

Auto-auth. The auto-auth component of Vault Agent is responsible for authenticating to Vault and managing the lifecycle of the resulting token, including renewal and re-authentication when the token expires. It obtains the token via the configured auth method (e.g., AppRole, AWS, Kubernetes) and keeps it valid for other components like the template engine and cache.

Answer

Sink

Answer

Template engine

Answer

Cache

Question 4

An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?

Accepted Answer

Control Group Policy. To enforce that a specific group of users can only request secrets if a manager approves via a Control Group, you must create a Control Group Policy. This policy defines the approval workflow, including the required number of approvals and the authorized approvers. Control Groups are a Vault Enterprise feature that adds an additional authorization step for sensitive operations.

Answer

Sentinel Policy

Answer

Identity Group

Answer

Auth Method

Answer

ACL Namespace

Question 5

Which tool is commonly used to view Vault metrics in a graphical format?

Accepted Answer

Grafana. Grafana is a widely adopted open-source visualization and dashboarding tool that integrates with time-series databases like Prometheus, InfluxDB, and Graphite. Vault exposes metrics in these formats (e.g., Prometheus endpoint at /v1/sys/metrics), and Grafana can query and display them as graphs, gauges, and alerts. This makes Grafana the standard choice for graphically monitoring Vault's performance and health metrics.

Answer

Vault Audit Viewer

Answer

Vault UI

Answer

Logstash

Question 6

Which component is responsible for receiving and responding to read requests in a Performance Standby configuration?

Accepted Answer

The Performance Standby node.. In a Vault Enterprise Performance Standby configuration, the Performance Standby node itself is responsible for receiving and responding to read requests. Performance standbys can service read-only operations locally (using their replicated state) while forwarding writes to the active node, which is the entire point of the feature — it scales read throughput horizontally.

Answer

The Active Vault node.

Answer

The Consul agent.

Answer

The Vault API Gateway.

Question 7

Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?

Accepted Answer

Provide the 'kubernetes_ca_cert' of the K8s API server.. When Vault's Kubernetes auth method validates a service account JWT, it calls the Kubernetes TokenReview API on the configured 'kubernetes_host'. If a TLS-terminating load balancer sits in front of the K8s API server, Vault must trust the certificate chain presented by that endpoint. Supplying 'kubernetes_ca_cert' (the CA that signed the API server / LB certificate) allows Vault to verify the TLS connection to 'kubernetes_host' without disabling verification.

Answer

Map the load balancer IP to the Vault 'cluster_addr'.

Answer

Disable TLS verification in the auth method.

Answer

Import the load balancer's CA into Vault's trust store.

Question 8

An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?

Accepted Answer

Update the 'secret_id_bound_cidrs' field in the role.. The AppRole role has a dedicated 'secret_id_bound_cidrs' field that restricts which source IP ranges may present a SecretID during login. Setting it to a CIDR list enforces that the SecretID is only usable from those networks, which is precisely the requirement. This is separate from 'token_bound_cidrs', which restricts where the resulting token can be used after login.

Answer

Configure the CIDR block in the 'token_policies'.

Answer

Create a custom sentinel policy for the auth method.

Answer

Update the 'token_bound_cidrs' field in the role.

Question 9

Which TWO of the following are valid ways to improve the security of the AppRole authentication process?

Accepted Answer

Enable 'secret_id_bound_cidrs' on the role.. Option B is correct because 'secret_id_bound_cidrs' restricts the CIDR blocks from which a SecretID can be used, so even if a SecretID leaks, it cannot be redeemed from an unauthorized network location, adding a strong network-based constraint to the AppRole login. Option C is correct because Response Wrapping delivers the SecretID as a single-use wrapped token that the application unwraps exactly once, limiting exposure in logs, CI systems, or transit and reducing the window for theft or replay. Option A is wrong because disabling TLS on the Vault listener exposes all traffic, including AppRole credentials, to interception and is never a security improvement. Option D is wrong because an infinite SecretID TTL means a leaked SecretID remains valid forever, increasing rather than reducing risk. Option E is wrong because sharing one SecretID across replicas removes per-instance attribution and blast-radius control, so compromise of one replica compromises them all.

Answer

Disable TLS on the Vault listener.

Answer

Increase the SecretID TTL to infinity.

Answer

Share the same SecretID across all application replicas.

Question 10

When using 'template_config' to set the 'static_secret_render_interval', what is the minimum value you can set?

Accepted Answer

5s. The 'static_secret_render_interval' in Vault Agent's 'template_config' controls how often static secrets are re-rendered, and the minimum allowed value is 5 seconds. Setting it lower than 5s is rejected by Vault Agent to prevent excessive API calls and resource churn.

Answer

1s

Answer

0s

Answer

10s

Question 11

What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?

Accepted Answer

The user is denied access.. Vault evaluates all policies attached to a token and applies a strict precedence order where 'deny' always wins over any other capability, regardless of which policy or path it appears in. Even if another policy grants 'read', 'create', or 'sudo' on the same path, the presence of a 'deny' capability in any attached policy overrides all allows. This is a deliberate security design so that a single restrictive policy cannot be silently bypassed by a permissive one.

Answer

The policy is considered invalid.

Answer

The user is allowed access.

Answer

The user receives a 403 Forbidden error.

Answer

Access is determined by the order of policy assignment.

Question 12

You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?

Accepted Answer

All incoming requests will be rejected until the audit device is restored.. When Vault cannot write to an audit device, it fails closed: all incoming client requests are rejected until the audit device is restored. This is a deliberate security design — Vault will not process requests it cannot audit, because unaudited operations would violate compliance and security guarantees. The 'audit_failure' log entry signals this blocked state.

Answer

Vault automatically switches to the secondary audit device.

Answer

Requests are permitted for read-only operations.

Answer

All requests are allowed but a warning is logged.

Question 13

To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?

Accepted Answer

/sys/health. The /sys/health endpoint is purpose-built for external monitoring tools: it returns HTTP status codes (200 active, 429 standby, 472 DR secondary, 473 performance standby, 501 not initialized, 503 sealed) that load balancers and monitoring systems can act on directly. It also exposes fields like initialized, sealed, standby, and replication state. This makes it the canonical endpoint for health checks.

Answer

/sys/leader

Answer

/sys/metrics

Answer

/sys/monitor

Question 14

When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?

Accepted Answer

Use a secure management system to populate config values.. The best practice for storing Vault configuration files in the cloud is to use a secure management system (e.g., AWS Secrets Manager, HashiCorp Consul, or encrypted S3 with restricted access) to populate configuration values dynamically. This avoids embedding sensitive data like tokens or keys in plaintext and supports rotation and auditability. Hardcoding secrets or storing plaintext files exposes credentials and violates security best practices.

Answer

Store it as a plaintext file in the root directory.

Answer

Hardcode the root token in the config file.

Answer

Use the 'vault write' command to update the config file.

Question 15

Where does the Vault Agent store the token it retrieves via auto-auth by default if a sink is not defined?

Accepted Answer

In-memory. When no sink is configured, Vault Agent auto-auth keeps the acquired token in memory only. The token is not written to disk or exported to an environment variable by default; it is held by the agent process and used for cache requests or template rendering. Persisting it requires explicitly defining a sink.

Answer

/tmp/vault.token

Answer

/var/run/vault/token

Answer

Environment variable VAULT_TOKEN