Vault Enterprise Practice Exam 3 — 20 Questions

Question 1

You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?

Accepted Answer

Port 8200 and port 8201.. Vault replication typically requires the API port (default 8200) and the cluster port (default 8201) to be reachable between nodes for cross-cluster communication.

Answer

Only port 8200.

Answer

Port 443 and port 80.

Answer

Only port 8201.

Question 2

What is the function of an Identity Alias in Vault?

Accepted Answer

To link an external identity to a Vault entity.. An identity alias maps an external auth method identity to a single internal Vault identity entity.

Answer

To create a duplicate entity.

Answer

To generate new tokens.

Answer

To mask the real username.

Answer

To bypass ACLs.

Question 3

Which THREE features are specific to Vault Enterprise when managing access control?

Accepted Answer

Namespaces. Namespaces, Replication, and Sentinel are all exclusive to the Enterprise version of Vault.

Answer

Token Auth Method

Answer

KV v2 Secrets Engine

Question 4

Which THREE components are involved in a standard high availability (HA) Vault architecture?

Accepted Answer

A load balancer.. HA requires storage for state, a server for processing, and a mechanism to direct traffic.

Answer

A secondary Vault cluster.

Answer

An external monitoring tool.

Question 5

You are using Batch tokens in your environment to improve performance. A developer asks why their Batch token cannot be revoked individually. What is the primary reason?

Accepted Answer

Batch tokens are stateless and not persisted in the storage backend.. Batch tokens are not stored in Vault storage, so they cannot be tracked or revoked individually.

Answer

The performance standby nodes do not support Batch token revocation.

Answer

Batch tokens are only supported for transit engine operations.

Answer

Batch tokens have a hard-coded TTL that cannot be overridden.

Question 6

You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?

Accepted Answer

Vault automatically detects the HSM and attempts to unseal.. Vault periodically retries the seal initialization process. Once the HSM becomes reachable, Vault attempts to use the provided credentials to unseal itself automatically.

Answer

Vault will transition to a 'permanently sealed' state and require a re-install.

Answer

The unseal process requires a restart of the Vault service.

Answer

Vault requires a manual 'vault operator unseal' command to trigger a retry.

Question 7

In the event of a total primary cluster failure, what is the status of the secrets stored in the DR secondary cluster before promotion?

Accepted Answer

They are available for reading if the secondary is unsealed.. Secrets are replicated to the DR secondary; however, the secondary is in a read-only state and cannot serve them until it is promoted to primary.

Answer

They are automatically synced back to a new primary.

Answer

They are encrypted and cannot be accessed.

Answer

They are unavailable and must be restored from backup.

Question 8

When using Vault with an external storage backend like Consul, what is the effect of changing the 'api_addr' in the Vault configuration file?

Accepted Answer

It updates the address clients and peers use to communicate with the node.. The 'api_addr' is used by the leader to tell other nodes how to reach it. Changing it affects cluster communication and how clients connect.

Answer

It forces a cluster leader election.

Answer

It disables high availability mode.

Answer

It changes the storage backend connection string.

Question 9

Which TWO of the following must be true for Seal Wrap to function correctly?

Accepted Answer

The 'seal_wrap' parameter must be set to 'true' in the configuration.. Seal Wrap requires a supported HSM and that the feature is enabled in the configuration before the keys are created or rotated.

Answer

The HSM must use the RSA algorithm for all keys.

Answer

The transit engine must be the only engine enabled.

Answer

All audit logs must be sent to the HSM.

Question 10

An auditor notices that audit logs are missing entries for a specific mount point. What is the most likely cause?

Accepted Answer

The audit device is not enabled for the specific path prefix.. Audit devices must be enabled separately, and if a path is not covered by an enabled audit device, activity will not be recorded.

Answer

The audit device is in a blocked state.

Answer

Vault is running in dev mode.

Answer

The audit log rotation policy is set to delete logs immediately.

Question 11

Which TWO of the following are valid parameters for configuring the 'sink' in Vault Agent?

Accepted Answer

type. The 'sink' block requires a 'type' and a 'config' map to define the file path.

Answer

ttl

Answer

auth_method

Answer

mode

Question 12

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

Accepted Answer

Only keys created or rotated after the configuration change will be wrapped by the HSM.. Seal Wrap with an HSM does not retroactively wrap existing data keys; it applies to new keys or keys that are rotated after the configuration is applied.

Answer

The transit engine is disabled until the 're-wrap' command is issued.

Answer

Vault automatically re-wraps all existing keys upon service startup.

Answer

Vault will return an error until all transit keys are manually deleted.

Question 13

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

Accepted Answer

Response Wrapping.. Vault's 'Response Wrapping' allows for a secure, one-time introduction of a token to a client, which is essential for dynamic infrastructure.

Answer

LDAP bind credentials.

Answer

Cubbyhole storage.

Answer

Transit Secret Engine.

Question 14

You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?

Accepted Answer

Set 'num_uses' to 1.. The 'num_uses' parameter allows you to restrict a SecretID to a specific number of authentication attempts (in this case, 1).

Answer

Set 'secret_id_ttl' to 0.

Answer

Set 'token_bound_cidrs' to the client IP.

Answer

Set 'secret_id_no_store' to true.

Question 15

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

Accepted Answer

The policy is inaccessible in the child namespace.. Policies are namespace-scoped. A policy created in the root namespace is not automatically visible or effective in a child namespace unless explicitly managed via cross-namespace access patterns.

Answer

The policy is automatically moved to the child namespace.

Answer

The policy overwrites child namespace policies.

Answer

The policy causes a naming collision error.

Answer

The policy is inherited by all child namespaces.

Question 16

What is the effect of setting 'token_ttl' on a Role?

Accepted Answer

It sets the initial duration for the token.. Token TTL defines the lifespan of the token generated by that role.

Answer

It restricts the number of uses.

Answer

It forces the token to be renewable.

Answer

It changes the token type.

Answer

It prevents the token from being revoked.

Question 17

Which THREE factors influence the effective permissions of a user in Vault?

Accepted Answer

Active Sentinel policies.. Effective permissions are the result of policies attached to the token, policies attached to the identity entity, and potentially Sentinel policies that filter the request.

Answer

The user's password strength.

Answer

The number of active mounts.

Question 18

Which TWO of the following are valid ways to assign policies to a token?

Accepted Answer

Inheritance from an Identity Entity.. Policies can be assigned during token creation via the CLI or API, or they can be associated with an identity entity which then inherits them.

Answer

Mapping to a file path.

Answer

Via the system clock.

Answer

Automatic assignment via Vault UI.

Question 19

Which THREE parameters are available in the 'vault' (top-level) block?

Accepted Answer

tls_skip_verify. The top-level configuration defines connectivity to the Vault server.

Answer

method

Answer

role

Question 20

Which THREE functions are available for use within Vault Agent templates?

Accepted Answer

scratch. The 'secret', 'metadata', and 'scratch' functions are valid Vault template helpers.

Answer

encrypt

Answer

rotate