Vault Enterprise Practice Test 13 — 15 Questions

Question 1

An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?

Accepted Answer

Update the 'secret_id_bound_cidrs' field in the role.. The 'secret_id_bound_cidrs' parameter allows you to restrict where a SecretID can be used.

Answer

Configure the CIDR block in the 'token_policies'.

Answer

Create a custom sentinel policy for the auth method.

Answer

Update the 'token_bound_cidrs' field in the role.

Question 2

You are using the Vault Agent Sinks to persist tokens. If the sink file is deleted manually, what is the default behavior of the Vault Agent?

Accepted Answer

The agent will re-create the sink file automatically.. The Vault Agent manages its own sink lifecycle and will automatically recreate the token file based on its internal state.

Answer

The agent will attempt to re-authenticate immediately.

Answer

The agent will disable template rendering.

Answer

The agent will stop and exit with an error.

Question 3

When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?

Accepted Answer

Restricts the generated Vault token to specific IP ranges.. This restricts the resulting token to only be usable from the specified CIDR ranges, providing an additional layer of security after authentication.

Answer

Restricts the Kubernetes API server access.

Answer

Binds the login process to a specific pod IP.

Answer

Limits the number of simultaneous logins from an IP.

Question 4

Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?

Accepted Answer

Provide the 'kubernetes_ca_cert' of the K8s API server.. You must provide the 'kubernetes_ca_cert' that the Kubernetes API server uses to sign its tokens, so Vault can verify them.

Answer

Map the load balancer IP to the Vault 'cluster_addr'.

Answer

Disable TLS verification in the auth method.

Answer

Import the load balancer's CA into Vault's trust store.

Question 5

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

Accepted Answer

vault operator rekey -init. The 'vault operator rekey -init' command is used to start the process of changing the master key configuration.

Answer

vault operator unseal

Answer

vault secrets tune

Answer

vault operator rotate

Question 6

When using 'template_config' to set the 'static_secret_render_interval', what is the minimum value you can set?

Accepted Answer

5s. Vault enforces a minimum rendering interval to prevent excessive resource consumption; it is 5s.

Answer

1s

Answer

0s

Answer

10s

Question 7

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

Accepted Answer

Use the Vault Agent injector for automatic sidecar management.. Short TTLs, CIDR binding, and using the agent injector all minimize the risk and blast radius of token theft.

Answer

Disable audit logging to increase performance.

Answer

Use the 'root' token for the application.

Question 8

Which command is used to check the health status of a Vault node?

Accepted Answer

vault status. The 'vault status' command provides the current health, seal status, and active/standby role of the node.

Answer

vault monitor

Answer

vault health

Answer

vault inspect

Question 9

Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?

Accepted Answer

Response wrapping.. Response wrapping ensures that the token is not visible in cleartext in logs or process lists during delivery.

Answer

Using a long-lived root token.

Answer

Passing the token as an environment variable.

Answer

Storing the token in a public configuration repo.

Question 10

You are configuring a production Vault cluster using Integrated Storage. What is the most critical configuration parameter that must be set in the 'storage' stanza to ensure the node can correctly identify and join the existing Raft cluster during a bootstrap operation?

Accepted Answer

node_id. The 'node_id' is required for every node in a Raft cluster to uniquely identify itself to other peers in the integrated storage configuration.

Answer

path

Answer

api_addr

Answer

retry_join

Question 11

When configuring an audit device, which configuration parameter is essential for high-availability auditing?

Accepted Answer

There is no specific parameter; use multiple devices.. For high-availability, you should configure multiple audit devices. If one fails, Vault stops processing requests if 'log_raw' is not configured correctly or if the audit device is not robust.

Answer

file_path

Answer

audit_non_blocking

Answer

tcp_addr

Question 12

Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?

Accepted Answer

Performance Replication.. Performance replication and HSM support are key enterprise features that require specific configuration blocks in the Vault HCL file.

Answer

Audit logging.

Answer

KV Secret Engine.

Answer

Token management.

Question 13

Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?

Accepted Answer

It allows wildcards to match multiple service accounts.. It restricts authentication to specific service accounts and prevents unauthorized service accounts from assuming the role.

Answer

It can only be applied to cluster-admin accounts.

Answer

It replaces the need for Vault policies.

Answer

It is optional if 'bound_namespaces' is set.

Question 14

What is the primary function of the 'ui = true' configuration setting?

Accepted Answer

Enable the web-based graphical interface.. Setting 'ui = true' enables the Vault Web UI, allowing users to interact with Vault via a browser.

Answer

Enable command-line interface tools.

Answer

Enable auto-unseal.

Answer

Increase API throughput.

Question 15

When configuring the Kubernetes Auth Method, which THREE of the following are required to ensure secure communication between Vault and the Kubernetes API server?

Accepted Answer

The 'kubernetes_host' address.. The host address, the CA certificate, and the token for the reviewer account are mandatory for the TokenReview API communication.

Answer

The Kubernetes node's SSH private key.

Answer

A list of all pod IP addresses.