Vault Enterprise Access Control Configuration — 25 Questions

Question 1

Which command is used to assign an ACL policy to an existing Identity Entity?

Accepted Answer

vault write identity/entity/name/my-entity policies=my-policy. The 'vault write identity/entity-alias' command is used to link an alias to an entity, and policies are typically mapped via 'vault write identity/entity'.

Answer

vault policy write entity my-entity

Answer

vault write identity/entity policies=my-policy

Answer

vault write auth/token/create policies=my-policy

Answer

vault map entity-policy

Question 2

You are troubleshooting a policy that is not granting the expected permissions. Which tool can help you simulate the policy evaluation for a given path?

Accepted Answer

vault policy test. The 'vault policy test' command is used to simulate authorization checks against a policy for a specific path and capability.

Answer

vault audit-log

Answer

vault server --debug

Answer

vault read sys/policies/acl

Answer

vault token lookup

Question 3

An administrator wants to prevent users from listing secrets in a specific path but allow them to read individual secrets. How should the policy be structured?

Accepted Answer

path "secret/*" { capabilities = ["read"] }. By explicitly granting 'read' and omitting 'list', or specifically denying 'list'.

Answer

path "secret/*" { capabilities = ["list" = "false"] }

Answer

path "secret/*" { capabilities = ["no-list"] }

Answer

path "secret/*" { capabilities = ["deny"] }

Answer

path "secret/*" { capabilities = ["read", "list"] }

Question 4

What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?

Accepted Answer

The user is denied access.. In Vault's policy evaluation, 'deny' always takes precedence over 'allow'.

Answer

The policy is considered invalid.

Answer

The user is allowed access.

Answer

The user receives a 403 Forbidden error.

Answer

Access is determined by the order of policy assignment.

Question 5

An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?

Accepted Answer

Control Group Policy. Control Groups require an 'accessor' or an identity-based wrapping mechanism, but the configuration relies on defining the 'request_entity' and the required 'approver' in the policy or configuration.

Answer

Sentinel Policy

Answer

Identity Group

Answer

Auth Method

Answer

ACL Namespace

Question 6

When using Namespace-based multi-tenancy, which statement is true regarding the root namespace?

Accepted Answer

The root namespace is where all child namespaces derive their identity entities.. The root namespace acts as the parent and manages the configuration of auth methods and secrets engines that are globally applicable if desired, and it owns the identity store.

Answer

The root namespace can only be managed by the root token.

Answer

Namespaces are not supported in Vault Enterprise.

Answer

The root namespace is invisible to child namespaces.

Answer

You cannot create secrets in the root namespace.

Question 7

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

Accepted Answer

request. The 'request' object in Sentinel for Vault contains metadata about the API request, including 'path' and 'operation'.

Answer

vault.metadata

Answer

token

Answer

input

Answer

policy

Question 8

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

Accepted Answer

The policy is inaccessible in the child namespace.. Policies are namespace-scoped. A policy created in the root namespace is not automatically visible or effective in a child namespace unless explicitly managed via cross-namespace access patterns.

Answer

The policy is automatically moved to the child namespace.

Answer

The policy overwrites child namespace policies.

Answer

The policy causes a naming collision error.

Answer

The policy is inherited by all child namespaces.

Question 9

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

Accepted Answer

In the AppRole Role definition. Token restrictions like 'bound_cidrs' are configured on the 'role' within the AppRole auth method.

Answer

In the Namespace configuration

Answer

In the Identity Entity

Answer

In the Token Auth Method

Answer

Inside the ACL policy

Question 10

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

Accepted Answer

read. The 'read' capability is required for reading data from a path, while 'list' is for listing keys and 'create'/'update' for writing.

Answer

create

Answer

patch

Answer

list

Answer

sudo

Question 11

Which API endpoint should you use to check if a specific policy exists in the system?

Accepted Answer

GET /sys/policies/acl. The 'sys/policies/acl' endpoint allows for listing and reading ACL policies.

Answer

POST /sys/policy

Answer

GET /identity/entity

Answer

GET /sys/auth

Answer

GET /sys/mounts

Question 12

What is the function of an Identity Alias in Vault?

Accepted Answer

To link an external identity to a Vault entity.. An identity alias maps an external auth method identity to a single internal Vault identity entity.

Answer

To create a duplicate entity.

Answer

To generate new tokens.

Answer

To mask the real username.

Answer

To bypass ACLs.

Question 13

What does the 'root' policy in Vault provide?

Accepted Answer

Full administrative access.. The 'root' policy provides full administrative access to all paths and operations.

Answer

Access to write policies only.

Answer

Access to view audit logs only.

Answer

Access limited to the namespace.

Answer

Read-only access to all paths.

Question 14

If you need to grant a group of developers access to all paths starting with 'secret/data/developers/', which HCL syntax is correct?

Accepted Answer

path "secret/data/developers/*" { capabilities = ["read"] }. The path should be defined with a trailing wildcard (/*) to cover sub-paths.

Answer

path "secret/data/developers/**" { capabilities = ["read"] }

Answer

path "secret/data/developers/" { capabilities = ["read"] }

Answer

path "secret/developers/*" { capabilities = ["read"] }

Answer

path "secret/data/developers" { capabilities = ["read"] }

Question 15

When configuring Sentinel policies for Vault, what is the 'EGP' policy type?

Accepted Answer

Endpoint Governing Policy. Endpoint Governing Policies (EGP) are scoped to specific paths and evaluated on every request to those paths.

Answer

Encryption Gateway Policy

Answer

Enterprise Group Policy

Answer

External Governance Policy

Answer

Entity Governing Policy

Question 16

What is the effect of setting 'token_ttl' on a Role?

Accepted Answer

It sets the initial duration for the token.. Token TTL defines the lifespan of the token generated by that role.

Answer

It restricts the number of uses.

Answer

It forces the token to be renewable.

Answer

It changes the token type.

Answer

It prevents the token from being revoked.

Question 17

Which THREE items are required to configure an AppRole auth method?

Accepted Answer

ACL Policy. AppRole requires a Role ID, a Secret ID (for added security), and a Policy assignment.

Answer

Root Token

Answer

LDAP Password

Question 18

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

Accepted Answer

create. Create, Read, and Update are standard operations for secrets engines, while Delete and List are also common.

Answer

sudo

Answer

control-group

Question 19

How can an administrator ensure that a secret is only accessible if the requester has a specific identity group membership?

Accepted Answer

By using a Sentinel policy to validate the entity's group membership.. By using path-level ACLs that leverage the identity information or by integrating Sentinel policies to check group membership.

Answer

By adding the group name to the path.

Answer

By modifying the auth method.

Answer

By setting a TTL on the group.

Answer

By creating a new namespace.

Question 20

Which TWO fields are essential in an ACL policy defined in HCL?

Accepted Answer

capabilities. The path to be restricted and the capabilities allowed for that path are the core components of an ACL policy.

Answer

ttl

Answer

entity

Answer

description