You are troubleshooting a policy that is not granting the expected permissions. Which tool can help you simulate the policy evaluation for a given path?
An administrator wants to prevent users from listing secrets in a specific path but allow them to read individual secrets. How should the policy be structured?
A Vault Enterprise cluster uses namespaces to isolate tenants. A security team wants to enforce that any token issued to the 'payments' namespace can only access secrets under the path 'payments/data/*' and must have a maximum TTL of 1 hour. They also want to prevent any child namespace from overriding these restrictions. Which two configurations must be applied to achieve this? (Choose two.)
An administrator is configuring access control for a Vault Enterprise cluster. They need to grant a team of developers read-only access to all secrets under the 'kv/' secrets engine, but they must also ensure that the developers cannot list the contents of the 'kv/' path itself. Which policy configuration achieves this?
A Vault Enterprise administrator is configuring a Sentinel RGP policy to enforce that only tokens with a metadata field "department" set to "finance" can read secrets at the path "secret/data/finance/*". The policy must be applied globally across all namespaces. Where should the administrator upload this policy?
A Vault Enterprise administrator needs to delegate the ability to create and manage namespaces to a team of operators, but only within a specific parent namespace called "team-a". The operators should not be able to create namespaces at the root level. Which policy should be attached to the operators' tokens?
An organization uses Vault Enterprise with Performance Replication. A developer in the secondary cluster has an entity with a specific alias in the primary cluster's identity store. The developer authenticates to the secondary cluster using an auth method that is local to the secondary. The developer must be able to read a secret at 'secret/data/app' that is governed by an ACL policy attached to the entity's group in the primary cluster. However, after authentication, the developer receives a permission denied error. What is the most likely cause?
An administrator needs to grant a development team read-only access to all secrets under the 'secret/data/dev' path in a Vault Enterprise cluster. The team should also be able to list the contents of that path to discover available secrets. Which policy snippet correctly implements this requirement?
An administrator is configuring a new auth method in Vault Enterprise. They want to ensure that when a user authenticates, the resulting token is automatically associated with an existing entity in the identity store, based on the user's email address. Which configuration is required to achieve this?
A Vault Enterprise administrator is designing an access control strategy for a multi-namespace environment. They need to ensure that a group of auditors can only read audit logs and cannot perform any write operations, even if they have other policies that grant broader access. Which two mechanisms can be used to achieve this? (Choose two.)
A Vault Enterprise administrator is designing a control group to enforce additional authorization for accessing a highly sensitive secrets engine. The control group should require approval from two members of the security team before a secret can be read. The security team is defined as an identity group named 'security-team'. Which two steps are necessary to configure this control group? (Choose two.)
An organization uses Vault Enterprise with Performance Replication. A team manages secrets in a primary cluster and needs to allow a group of users to read secrets from a secondary cluster. The users authenticate to the secondary cluster using an auth method that is local to that cluster. The security team wants the users' permissions to be managed centrally from the primary cluster. Which Vault Enterprise feature should be used to meet these requirements?
A Vault Enterprise cluster is configured with a performance secondary. An administrator creates a new auth method role in the primary cluster and attaches a policy that allows reading secrets at 'secret/data/finance'. A user authenticates against the secondary cluster using that auth method. However, the user receives a permission denied error when trying to read the secret. The administrator verifies that the policy exists in the secondary and the role is replicated. What is the most likely reason for the failure?
A security administrator is configuring a Vault Enterprise cluster with multiple namespaces. They need to ensure that a policy defined in the root namespace grants read access to a secrets engine mounted in a child namespace, but only when the request originates from a token that has an entity alias from a specific auth method in that child namespace. Which Vault feature should be used to enforce this conditional access?
A Vault administrator needs to verify that a newly created policy named 'app-readonly' is correctly defined and does not contain syntax errors. Which command should the administrator use to validate the policy before applying it?
An administrator needs to grant a set of users the ability to create and manage tokens, but they must not be able to create tokens with a longer TTL than the default. The users authenticate via an auth method that assigns them an entity with a specific alias. Which Vault feature should be used to enforce this restriction?
An administrator is configuring a Vault Enterprise cluster to use the Kubernetes auth method. They need to ensure that only pods with specific service account annotations can authenticate and receive a token with a policy that allows reading secrets from 'secret/data/app'. Which two steps are required to achieve this? (Choose two.)
A Vault administrator needs to allow a user to read secrets at 'secret/data/team1' but prevent the user from listing the contents of 'secret/metadata/team1'. The user is authenticated via the userpass auth method. Which policy should the administrator create?
An operations team manages a Vault Enterprise cluster with multiple namespaces. A compliance mandate requires that every token issued by the Kubernetes auth method in the 'payments' namespace must be able to read a KV v2 secret at 'secret/data/transactions' and must not have any permissions on 'secret/data/audit'. The team wants to achieve this without manually attaching policies each time a token is generated. Which approach should they take?
A Vault Enterprise administrator is configuring an LDAP auth method in a namespace. The organization uses nested groups in Active Directory, and the administrator needs to ensure that a user who is a member of a nested group (e.g., 'Engineering' which is a member of 'AllEmployees') receives the policies attached to both groups when logging in. The LDAP auth method is configured with a group DN of 'ou=groups,dc=example,dc=com' and user DN of 'ou=users,dc=example,dc=com'. Which configuration change is required to achieve this?
An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?
You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?
In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?
An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?
A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?
A Vault Enterprise administrator is configuring an external group mapping using the LDAP auth method. They want to ensure that members of the LDAP group 'vault-admins' automatically receive the 'admin' policy when they authenticate. Which configuration is required to achieve this?
A Vault Enterprise cluster uses a Control Group to require approval for reading secrets at "secret/data/prod/*". A user with a token that has a policy granting read on that path attempts to read a secret but is blocked pending approval. Which statement accurately describes the token's capabilities during the pending approval?
A Vault Enterprise administrator is configuring a new namespace for a subsidiary company. The subsidiary requires that only users authenticated via their corporate LDAP can access secrets in the namespace. Additionally, the subsidiary's security team must be able to manage policies and auth methods within the namespace but should not have access to the root namespace. Which combination of Vault Enterprise features should the administrator use to meet these requirements?
A security engineer is configuring Vault Enterprise to allow an application to authenticate using AppRole. The application will run on a server that has a unique role ID and secret ID. The engineer wants to ensure that the secret ID can be used only once and expires after 24 hours. Which AppRole role configuration parameters should be set to achieve this?
A Vault Enterprise administrator needs to delegate the management of a specific secrets engine to a team. The team should be able to create, update, and delete roles within the 'database' secrets engine but should not be able to modify the secrets engine's configuration or access other secrets engines. Which policy should the administrator create?