Vault Enterprise Practice Test 3 — 25 Questions

Question 1

Which TWO of the following are valid parameters for configuring the 'sink' in Vault Agent?

Accepted Answer

type. The 'sink' block requires a 'type' and a 'config' map to define the file path.

Answer

ttl

Answer

auth_method

Answer

mode

Question 2

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

Accepted Answer

Only keys created or rotated after the configuration change will be wrapped by the HSM.. Seal Wrap with an HSM does not retroactively wrap existing data keys; it applies to new keys or keys that are rotated after the configuration is applied.

Answer

The transit engine is disabled until the 're-wrap' command is issued.

Answer

Vault automatically re-wraps all existing keys upon service startup.

Answer

Vault will return an error until all transit keys are manually deleted.

Question 3

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

Accepted Answer

Response Wrapping.. Vault's 'Response Wrapping' allows for a secure, one-time introduction of a token to a client, which is essential for dynamic infrastructure.

Answer

LDAP bind credentials.

Answer

Cubbyhole storage.

Answer

Transit Secret Engine.

Question 4

You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?

Accepted Answer

Set 'num_uses' to 1.. The 'num_uses' parameter allows you to restrict a SecretID to a specific number of authentication attempts (in this case, 1).

Answer

Set 'secret_id_ttl' to 0.

Answer

Set 'token_bound_cidrs' to the client IP.

Answer

Set 'secret_id_no_store' to true.

Question 5

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

Accepted Answer

The policy is inaccessible in the child namespace.. Policies are namespace-scoped. A policy created in the root namespace is not automatically visible or effective in a child namespace unless explicitly managed via cross-namespace access patterns.

Answer

The policy is automatically moved to the child namespace.

Answer

The policy overwrites child namespace policies.

Answer

The policy causes a naming collision error.

Answer

The policy is inherited by all child namespaces.

Question 6

What is the effect of setting 'token_ttl' on a Role?

Accepted Answer

It sets the initial duration for the token.. Token TTL defines the lifespan of the token generated by that role.

Answer

It restricts the number of uses.

Answer

It forces the token to be renewable.

Answer

It changes the token type.

Answer

It prevents the token from being revoked.

Question 7

Which THREE factors influence the effective permissions of a user in Vault?

Accepted Answer

Active Sentinel policies.. Effective permissions are the result of policies attached to the token, policies attached to the identity entity, and potentially Sentinel policies that filter the request.

Answer

The user's password strength.

Answer

The number of active mounts.

Question 8

Which TWO of the following are valid ways to assign policies to a token?

Accepted Answer

Inheritance from an Identity Entity.. Policies can be assigned during token creation via the CLI or API, or they can be associated with an identity entity which then inherits them.

Answer

Mapping to a file path.

Answer

Via the system clock.

Answer

Automatic assignment via Vault UI.

Question 9

Which THREE parameters are available in the 'vault' (top-level) block?

Accepted Answer

tls_skip_verify. The top-level configuration defines connectivity to the Vault server.

Answer

method

Answer

role

Question 10

Which THREE functions are available for use within Vault Agent templates?

Accepted Answer

scratch. The 'secret', 'metadata', and 'scratch' functions are valid Vault template helpers.

Answer

encrypt

Answer

rotate

Question 11

Which tool is commonly used to view Vault metrics in a graphical format?

Accepted Answer

Grafana. Grafana is the standard tool used to visualize Prometheus metrics, which Vault exports.

Answer

Vault Audit Viewer

Answer

Vault UI

Answer

Logstash

Question 12

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Accepted Answer

The storage backend (e.g., Consul).. The storage backend (e.g., Consul, Raft) provides a distributed locking mechanism that Vault uses to ensure only one leader exists.

Answer

The load balancer.

Answer

The Vault server process configuration file.

Answer

The Vault CLI.

Question 13

What is the benefit of using Performance Replication over standard DR Replication?

Accepted Answer

Performance replication allows the secondary to serve read requests.. Performance replication allows the secondary to serve read requests, unlike DR replication which is strictly for failover.

Answer

Performance replication supports write operations.

Answer

Performance replication provides disaster recovery capabilities.

Answer

Performance replication is cheaper to license.

Question 14

Which THREE features are part of Vault Enterprise performance scaling?

Accepted Answer

Namespace support.. Performance replication, performance standby, and seal wrapping/HSM support are key enterprise scaling features.

Answer

Dynamic secrets.

Answer

Integrated storage (Raft).

Question 15

Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?

Accepted Answer

Incompatibility between the library version and the HSM firmware.. Common causes include incorrect PIN credentials, library incompatibility, or the HSM partition being inaccessible.

Answer

The Vault token has expired.

Answer

The storage backend is full.

Answer

The network is blocked by a local firewall.

Question 16

What does the 'vault_core_seal_setup_duration' metric represent?

Accepted Answer

The duration of the unseal process.. This metric measures the time taken for Vault to perform the seal setup process during initialization or unsealing.

Answer

The time taken to initialize the storage backend.

Answer

The time between audit log rotations.

Answer

The time spent waiting for a lease to expire.

Question 17

How can an administrator ensure that a secret is only accessible if the requester has a specific identity group membership?

Accepted Answer

By using a Sentinel policy to validate the entity's group membership.. By using path-level ACLs that leverage the identity information or by integrating Sentinel policies to check group membership.

Answer

By adding the group name to the path.

Answer

By modifying the auth method.

Answer

By setting a TTL on the group.

Answer

By creating a new namespace.

Question 18

When configuring DR replication, what is the purpose of the 'primary_token' used on the secondary cluster?

Accepted Answer

It is used by the secondary to authenticate with the primary cluster.. The primary token is used by the secondary cluster to authenticate with the primary and establish the replication link.

Answer

It is used to authorize the secondary to unseal itself.

Answer

It is used to allow the secondary to perform write operations.

Answer

It is used to encrypt data transferred over the network.

Question 19

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

Accepted Answer

The library must be PKCS#11 compliant.. Vault requires the HSM vendor's shared object library (.so or .dll) to support the PKCS#11 interface standard.

Answer

The library must be statically linked into the Vault binary.

Answer

The library must be written in Go.

Answer

The library must support the KMIP protocol.

Question 20

What is the primary difference between HA replication and DR replication in Vault?

Accepted Answer

HA replication is for performance, DR is for data durability.. HA is about local node availability, while DR is about replicating data across clusters for geographic or systemic failure recovery.

Answer

HA replication requires Enterprise, DR does not.

Answer

DR replication uses a different storage backend.

Answer

DR replication is faster than HA replication.