Vault Enterprise Practice Questions 1 — 50 Questions

Question 1

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

Accepted Answer

request. The 'request' object in Sentinel for Vault contains metadata about the API request, including 'path' and 'operation'.

Answer

vault.metadata

Answer

token

Answer

input

Answer

policy

Question 2

When using Namespace-based multi-tenancy, which statement is true regarding the root namespace?

Accepted Answer

The root namespace is where all child namespaces derive their identity entities.. The root namespace acts as the parent and manages the configuration of auth methods and secrets engines that are globally applicable if desired, and it owns the identity store.

Answer

The root namespace can only be managed by the root token.

Answer

Namespaces are not supported in Vault Enterprise.

Answer

The root namespace is invisible to child namespaces.

Answer

You cannot create secrets in the root namespace.

Question 3

When configuring Sentinel policies for Vault, what is the 'EGP' policy type?

Accepted Answer

Endpoint Governing Policy. Endpoint Governing Policies (EGP) are scoped to specific paths and evaluated on every request to those paths.

Answer

Encryption Gateway Policy

Answer

Enterprise Group Policy

Answer

External Governance Policy

Answer

Entity Governing Policy

Question 4

An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?

Accepted Answer

Renewing the token.. Batch tokens are stateless; they cannot be renewed because they cannot be tracked in the storage backend.

Answer

Performing a Transit engine encryption.

Answer

Authenticating with a configured auth method.

Answer

Reading a secret from the KV engine.

Question 5

Which TWO configurations are required to effectively monitor Vault in a production environment?

Accepted Answer

Enabled telemetry endpoint.. Production environments require robust monitoring of metrics and thorough audit logging for compliance and troubleshooting.

Answer

Manual log rotation cron job.

Answer

UI access restricted to local IP only.

Answer

Debug mode enabled on all nodes.

Question 6

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

Accepted Answer

read. The 'read' capability is required for reading data from a path, while 'list' is for listing keys and 'create'/'update' for writing.

Answer

create

Answer

patch

Answer

list

Answer

sudo

Question 7

You have a Performance Replication setup. A client sends a write request to a performance standby node. What happens to this request?

Accepted Answer

The request is forwarded to the primary cluster.. Performance standby nodes are read-only. Any write requests sent to them must be forwarded to the primary cluster.

Answer

The standby node attempts to become the leader and process the write.

Answer

The request is cached locally until the primary is available.

Answer

The request is rejected with a 403 Forbidden.

Question 8

Which API endpoint should you use to check if a specific policy exists in the system?

Accepted Answer

GET /sys/policies/acl. The 'sys/policies/acl' endpoint allows for listing and reading ACL policies.

Answer

POST /sys/policy

Answer

GET /identity/entity

Answer

GET /sys/auth

Answer

GET /sys/mounts

Question 9

Which TWO fields are essential in an ACL policy defined in HCL?

Accepted Answer

capabilities. The path to be restricted and the capabilities allowed for that path are the core components of an ACL policy.

Answer

ttl

Answer

entity

Answer

description

Question 10

You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?

Accepted Answer

The secondary requires its own unseal process to function.. If a DR secondary is sealed, it cannot participate in replication. It must be unsealed separately from the primary.

Answer

The replication token has expired.

Answer

The primary is also sealed.

Answer

The primary has failed.

Question 11

Which TWO of the following are valid reasons why a node might fail to join an existing Raft cluster?

Accepted Answer

The 'cluster_addr' is not reachable from the leader.. Configuration errors and network issues are the most common causes for joining failures.

Answer

The node has not been initialized with 'vault operator init'.

Answer

The storage backend is set to 'consul'.

Answer

The node has a different Vault version.

Question 12

When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?

Accepted Answer

slot. The 'slot' parameter in the seal stanza defines which slot within the PKCS#11 library Vault should target.

Answer

token_label

Answer

partition_id

Answer

hsm_id

Question 13

Which THREE of the following are required configuration parameters in the 'seal' stanza when using a PKCS#11 HSM?

Accepted Answer

slot. The 'seal' configuration for PKCS#11 requires the library path, the slot identifier, and the key label to locate the cryptographic material.

Answer

hsm_type

Answer

max_attempts

Question 14

You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?

Accepted Answer

The storage backend is struggling with high frequency read/write operations.. High latency in fetch_token metrics usually indicates database or storage backend contention during token creation or lookup processes.

Answer

The audit file device is too slow.

Answer

The request buffer is full.

Answer

Vault is misconfigured for high availability.

Question 15

Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?

Accepted Answer

Review logs for 'sys/policy' updates.. Analyzing logs involves filtering for unauthorized access, checking for high-risk operations, and verifying administrative actions.

Answer

Sort logs by timestamp.

Answer

Check for successful 'read' operations on all secrets.

Question 16

Which TWO of the following statements are true regarding Performance Standby nodes?

Accepted Answer

They forward all write operations to the primary cluster.. Performance standbys handle reads and improve throughput but cannot perform writes.

Answer

They maintain their own independent master key.

Answer

They can serve requests for secrets written to any cluster.

Answer

They automatically promote themselves if the primary fails.

Question 17

When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?

Accepted Answer

role. The 'role' parameter is mandatory to specify which Vault role the IAM identity should map to.

Answer

identity

Answer

iam_role

Answer

aws_role

Question 18

What does the 'root' policy in Vault provide?

Accepted Answer

Full administrative access.. The 'root' policy provides full administrative access to all paths and operations.

Answer

Access to write policies only.

Answer

Access to view audit logs only.

Answer

Access limited to the namespace.

Answer

Read-only access to all paths.

Question 19

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

Accepted Answer

Sentinel policies support EGP and RGP types.. Sentinel policies are applied at the request level, and they support both RGP (Request Governing Policy) and EGP (Endpoint Governing Policy).

Answer

Sentinel policies are written in HCL.

Answer

Sentinel policies replace ACLs.

Answer

Sentinel policies are evaluated before ACLs.

Question 20

An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?

Accepted Answer

Control Group Policy. Control Groups require an 'accessor' or an identity-based wrapping mechanism, but the configuration relies on defining the 'request_entity' and the required 'approver' in the policy or configuration.

Answer

Sentinel Policy

Answer

Identity Group

Answer

Auth Method

Answer

ACL Namespace