Vault Enterprise Practice Test 3 — 10 Questions

Question 1

If you need to grant a group of developers access to all paths starting with 'secret/data/developers/', which HCL syntax is correct?

Accepted Answer

path "secret/data/developers/*" { capabilities = ["read"] }. The path should be defined with a trailing wildcard (/*) to cover sub-paths.

Answer

path "secret/data/developers/**" { capabilities = ["read"] }

Answer

path "secret/data/developers/" { capabilities = ["read"] }

Answer

path "secret/developers/*" { capabilities = ["read"] }

Answer

path "secret/data/developers" { capabilities = ["read"] }

Question 2

Which TWO factors contribute to the size and performance of Vault audit logs?

Accepted Answer

The size of the request/response payloads.. The request payload size and the frequency of incoming requests directly impact the audit log volume and performance.

Answer

The number of active leases.

Answer

The number of enabled secrets engines.

Answer

The size of the Vault data store.

Question 3

Which TWO of the following are components of a Control Group configuration?

Accepted Answer

Request TTL.. Control groups rely on defining the 'approver' entities and the 'ttl' of the request, which governs the workflow.

Answer

Secret engine path.

Answer

Policy name.

Answer

Auth method name.

Question 4

When migrating from an external storage backend to Raft, which command is used to capture the current state of the cluster for migration?

Accepted Answer

vault operator raft snapshot save. The 'vault operator raft snapshot save' command is used to export the current data state to a file, which can then be restored into a new Raft-based cluster.

Answer

vault operator migrate

Answer

vault write sys/storage/backup

Answer

vault operator seal

Question 5

When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?

Accepted Answer

Checking Vault server audit logs.. The Vault server logs (at 'debug' level) will show the specific error returned by the Kubernetes TokenReview API.

Answer

Checking the Kubernetes events list.

Answer

Running 'kubectl describe pod'.

Answer

Running 'vault read sys/auth/kubernetes'.

Question 6

In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?

Accepted Answer

3 nodes.. A minimum of 3 nodes is standard for Raft to allow for majority consensus (quorum) if one node fails.

Answer

1 node.

Answer

2 nodes.

Answer

10 nodes.

Question 7

Which THREE actions are necessary when preparing to promote a Performance Secondary cluster?

Accepted Answer

Disable the existing replication link from the primary side.. Promotion requires stopping replication, updating configuration, and verifying the new cluster state.

Answer

Restart the secondary cluster.

Answer

Upgrade the secondary's license to Enterprise.

Question 8

Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?

Accepted Answer

signal. The change_mode supports 'noop', 'signal', and 'restart' actions.

Answer

delete

Answer

exec

Question 9

Which TWO of the following are benefits of using Seal Wrap in Vault Enterprise?

Accepted Answer

Compliance with FIPS 140-2/3 requirements.. Seal Wrap adds an extra layer of security by ensuring keys never exist in plaintext memory and allows for easier compliance with regulations requiring HSM-backed key protection.

Answer

Automatic failover to a standby Vault cluster.

Answer

Increased storage backend performance.

Answer

Automatic deletion of audit logs.

Question 10

Where are audit logs physically stored if the 'file' audit device is configured?

Accepted Answer

In the local filesystem at the configured path.. The 'file' audit device writes entries to a specified file path provided in the configuration.

Answer

In standard system syslog.

Answer

In the storage backend database.

Answer

In Vault's memory buffer.