Vault Enterprise Practice Test 4 — 10 Questions

Question 1

An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Issue a wrapped response for the SecretID with a specific TTL.. Using Response Wrapping with a short TTL provides a single-use token that ensures the SecretID is only accessible by the intended recipient.

Answer

Use a global static token for all AppRole authentications.

Answer

Hardcode the SecretID into the application's configuration file.

Answer

Disable the SecretID requirement and use only the RoleID.

Question 2

An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?

Accepted Answer

Destroy the specific SecretID.. Destroying the SecretID through the API effectively invalidates it, preventing any new tokens from being issued via that specific SecretID.

Answer

Rotate the RoleID.

Answer

Disable the AppRole auth method.

Answer

Delete the entire AppRole.

Question 3

Which TWO of the following statements about the 'vault-agent' injector in Kubernetes are correct?

Accepted Answer

It runs as a Kubernetes Mutating Admission Webhook.. The injector is a controller that modifies pod specs, and it uses sidecars for secret delivery.

Answer

It is only available for non-Enterprise versions.

Answer

It bypasses all Vault policies.

Answer

It requires manual pod restarts to update secrets.

Question 4

You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?

Accepted Answer

tls_disable = false. The 'tls_disable' parameter must be set to 'false' to enforce encrypted communication, which is a production hardening requirement.

Answer

tls_disable = true

Answer

proxy_protocol = true

Answer

tls_prefer_server_cipher_suites = false

Question 5

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

Accepted Answer

create. Create, Read, and Update are standard operations for secrets engines, while Delete and List are also common.

Answer

sudo

Answer

control-group

Question 6

You are configuring a Vault cluster for high availability using Consul as the storage backend. During a network partition, the standby nodes cannot reach the leader node. What must occur for a new leader to be elected?

Accepted Answer

The Consul agent must expire the leader's session, triggering an election among standby nodes.. In an HA cluster using Consul, the leader node holds a session lock. If the leader fails or loses connectivity, the session expires, allowing standby nodes to attempt to acquire the lock and become the new leader.

Answer

The load balancer must perform a health check and restart the standby nodes.

Answer

Vault requires a manual unseal process on all nodes to trigger a new election.

Answer

The Vault administrator must manually promote a standby node via the CLI.

Question 7

When running 'vault operator raft list-peers', you notice one node is listed but its status is 'dead'. What is the correct procedure to remove it from the Raft cluster?

Accepted Answer

Run 'vault operator raft remove-peer'.. Using 'vault operator raft remove-peer' allows you to gracefully remove a stale or dead peer from the consensus list.

Answer

Re-run the join command for the node.

Answer

Restart the leader node.

Answer

Delete the node's data directory manually.

Question 8

What is the primary function of a 'Performance Standby' node in Vault Enterprise?

Accepted Answer

To scale read throughput by processing requests locally.. Performance standby nodes allow local read-only requests to be served, reducing the load on the primary node.

Answer

To act as a warm standby for automatic failover.

Answer

To replicate the vault to a different geographic region.

Answer

To provide high availability for administrative writes.

Question 9

Which THREE items are required to configure an AppRole auth method?

Accepted Answer

ACL Policy. AppRole requires a Role ID, a Secret ID (for added security), and a Policy assignment.

Answer

Root Token

Answer

LDAP Password

Question 10

You are deploying Vault with the integrated Raft storage backend. How is high availability achieved?

Accepted Answer

By configuring nodes to join a Raft cluster and establishing consensus.. Raft storage is integrated into Vault, and the cluster uses the Raft consensus protocol to elect a leader and replicate data across peers.

Answer

By using a shared NFS mount for the data directory.

Answer

By manually mounting the storage partition across all nodes.

Answer

By using an external Consul agent as a lock provider.