Vault Enterprise Access Control Configuration Practice Test 2 — 15 Questions

Question 1

An organization uses Vault Enterprise with Performance Replication. A developer in the secondary cluster has an entity with a specific alias in the primary cluster's identity store. The developer authenticates to the secondary cluster using an auth method that is local to the secondary. The developer must be able to read a secret at 'secret/data/app' that is governed by an ACL policy attached to the entity's group in the primary cluster. However, after authentication, the developer receives a permission denied error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The developer's token was issued by a local auth method in the secondary, but the entity and its group memberships are only in the primary cluster and not replicated to the secondary.. In Vault Enterprise Performance Replication, identity data (entities, groups, aliases) replicates from primary to secondary, but only for auth methods that are replicated. When a secondary cluster has a local auth method, entities authenticated through it are not linked to primary entities unless aliases are manually mapped or the auth method is replicated. Therefore, policies attached to primary groups are not applied to tokens from local auth methods.

Answer

The ACL policy that grants read on 'secret/data/app' is not replicated to the secondary cluster, so the policy cannot be evaluated.

Answer

The auth method used by the developer is not replicated to the primary cluster, so the entity alias is not associated with the entity.

Answer

The entity alias in the primary cluster is not associated with the entity in the secondary cluster because the alias metadata is not replicated in Performance Replication.

Question 2

An administrator needs to grant a development team read-only access to all secrets under the 'secret/data/dev' path in a Vault Enterprise cluster. The team should also be able to list the contents of that path to discover available secrets. Which policy snippet correctly implements this requirement?

Accepted Answer

path "secret/data/dev/*" { capabilities = ["read", "list"] }. The policy must grant read and list capabilities on the wildcard path to allow reading individual secrets and listing the directory contents. The correct snippet uses path "secret/data/dev/*" with capabilities = ["read", "list"]. Other options either miss the list capability, omit the wildcard, or add unnecessary permissions like sudo or create, which violate the read-only requirement.

Answer

path "secret/data/dev/*" { capabilities = ["read", "sudo"] }

Answer

path "secret/data/dev/*" { capabilities = ["read", "list", "create"] }

Answer

path "secret/data/dev" { capabilities = ["read", "list"] }

Question 3

An administrator is configuring a new auth method in Vault Enterprise. They want to ensure that when a user authenticates, the resulting token is automatically associated with an existing entity in the identity store, based on the user's email address. Which configuration is required to achieve this?

Accepted Answer

Create an identity alias in the entity that maps to the auth method's mount accessor and the user's email as the alias name.. In Vault's identity system, an entity is a representation of a user or system, and aliases are the links between entities and auth methods. To associate a token with an existing entity, an alias must exist that matches the auth method's mount accessor and the user's identifier (e.g., email). When the user authenticates, Vault searches for an alias with that name under the auth method; if found, the token is bound to the entity. Without the alias, a new entity is created.

Answer

Set the 'alias_name_source' parameter on the auth method role to 'email'.

Answer

Configure the auth method to use the 'entity_id' parameter in its role, pointing to the desired entity ID.

Answer

Attach a policy to the auth method role that includes the 'identity/entity/id/<entity_id>' path with read capabilities.

Question 4

A Vault Enterprise administrator is designing an access control strategy for a multi-namespace environment. They need to ensure that a group of auditors can only read audit logs and cannot perform any write operations, even if they have other policies that grant broader access. Which two mechanisms can be used to achieve this? (Choose two.)

Accepted Answer

Create an ACL policy that includes 'deny' capabilities on all write paths and attach it to the auditors' entity group.. To enforce read-only access for auditors, you can use ACL deny rules or Sentinel EGP policies. ACL deny rules explicitly deny write capabilities and override any allow rules, ensuring that even with other policies, write operations are blocked. Sentinel EGP policies can deny requests based on HTTP method, providing a centralized enforcement that cannot be bypassed by ACLs. Both mechanisms effectively prevent write operations while allowing reads.

Answer

Configure a Control Group on all write paths that requires approval from a security team.

Answer

Assign the auditors a token with the 'default' policy and no other policies.

Answer

Use a Sentinel RGP policy that checks the token's policies and denies if the token has any policy other than 'auditor-read'.

Question 5

A Vault Enterprise administrator is designing a control group to enforce additional authorization for accessing a highly sensitive secrets engine. The control group should require approval from two members of the security team before a secret can be read. The security team is defined as an identity group named 'security-team'. Which two steps are necessary to configure this control group? (Choose two.)

Accepted Answer

Create a control group policy that references the identity group 'security-team' and requires two approvals.. To configure a control group, you must create a control group policy that defines the approvers (such as the security-team identity group) and the number of approvals required. Then, you must attach that policy to the target path or role so that requests trigger the control group workflow. The other options are either unnecessary (license enablement, Sentinel policy) or belong to prior identity setup (aliases).

Answer

Create a Sentinel EGP policy that denies access unless two approvals are present.

Answer

Enable the control group feature in the Vault Enterprise license.

Answer

Configure an identity alias for each member of the security team to map to the 'security-team' group.

Question 6

An organization uses Vault Enterprise with Performance Replication. A developer in the secondary cluster has an entity with a specific alias in the primary cluster's identity store. The developer authenticates to the secondary cluster using an auth method that is local to the secondary. The developer must be able to read a secret at 'secret/data/app' that is governed by an ACL policy attached to the entity's group in the primary cluster. However, after authentication, the developer receives a permission denied error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the local auth method on the secondary cluster to create entity aliases, then create an internal group on the primary cluster and add those entities as members using the entity aliases. Attach the necessary policy to the internal group.. Internal identity groups in Vault Enterprise are replicated from the primary cluster to secondary clusters in performance replication. By creating an internal group on the primary and adding entities that correspond to users from the secondary's local auth method, the group membership and any attached policies are replicated. This enables centralized policy management while allowing users to authenticate locally to the secondary cluster.

Answer

Enable the local auth method on the primary cluster, have users authenticate there, and then use performance replication to replicate their tokens to the secondary cluster.

Answer

Create a group in the primary cluster's identity store, add the users as members, and attach a policy granting read access to the secrets. Configure the local auth method on the secondary cluster to map its entities to the primary group via a group alias.

Answer

Create an external group in the secondary cluster that maps to the local auth method's group, and attach a policy to that external group. Then, on the primary cluster, create an internal group with the same name and attach the same policy.

Question 7

A Vault Enterprise cluster is configured with a performance secondary. An administrator creates a new auth method role in the primary cluster and attaches a policy that allows reading secrets at 'secret/data/finance'. A user authenticates against the secondary cluster using that auth method. However, the user receives a permission denied error when trying to read the secret. The administrator verifies that the policy exists in the secondary and the role is replicated. What is the most likely reason for the failure?

Accepted Answer

The user's token in the secondary does not have the policy attached because token policies are determined at authentication time and the auth method's mount accessor differs between clusters.. In Performance Replication, auth method roles are replicated, but the mount accessor of the auth method is unique per cluster. If an entity alias in the primary references the primary's auth mount accessor, that alias will not match the secondary's auth method when the user authenticates there. Consequently, the token is not associated with the entity, and policies attached to the entity (or its groups) are not applied. The role's policies are attached at token creation, but if the role itself has the policy, it should work. However, if the policy is attached via entity group, the alias mismatch causes failure.

Answer

The policy is not effective because the secret engine at 'secret/data/finance' is not replicated to the secondary.

Answer

The auth method role in the secondary is not associated with the correct policy because role configurations are not replicated.

Answer

The policy was created in the primary but not replicated to the secondary because policies are not replicated in Performance Replication.

Question 8

A security administrator is configuring a Vault Enterprise cluster with multiple namespaces. They need to ensure that a policy defined in the root namespace grants read access to a secrets engine mounted in a child namespace, but only when the request originates from a token that has an entity alias from a specific auth method in that child namespace. Which Vault feature should be used to enforce this conditional access?

Accepted Answer

Sentinel EGP (Endpoint Governing Policy) attached to the child namespace's secrets engine path.. Sentinel Endpoint Governing Policies (EGPs) are evaluated for each request to a specific endpoint or path. By attaching an EGP to the secrets engine path in the child namespace, you can enforce conditions on the request, such as requiring the token to have a specific entity alias from an auth method. This allows fine-grained, path-specific access control that cannot be achieved with standard ACL policies or role-based policies.

Answer

Sentinel RGP (Role Governing Policy) attached to the auth method's role in the child namespace.

Answer

A policy in the root namespace that uses the 'path' parameter with a wildcard to match the child namespace's secrets engine, combined with a condition on the entity alias.

Answer

Identity groups in the root namespace that include entities from the child namespace's auth method, with a policy attached that grants access to the child namespace's secrets engine.

Question 9

A Vault administrator needs to verify that a newly created policy named 'app-readonly' is correctly defined and does not contain syntax errors. Which command should the administrator use to validate the policy before applying it?

Accepted Answer

vault policy fmt policy.hcl. The vault policy fmt command is used to format and validate a policy file. It checks for syntax errors and ensures proper HCL formatting without applying the policy. This allows the administrator to catch mistakes before writing the policy to Vault. The other options either do not perform validation, apply the policy directly, or are invalid commands.

Answer

vault policy write -dry-run app-readonly policy.hcl

Answer

vault policy read app-readonly

Answer

vault write sys/policies/acl/app-readonly policy=@policy.hcl

Question 10

An administrator needs to grant a set of users the ability to create and manage tokens, but they must not be able to create tokens with a longer TTL than the default. The users authenticate via an auth method that assigns them an entity with a specific alias. Which Vault feature should be used to enforce this restriction?

Accepted Answer

Create a policy that allows 'create' on 'auth/token/create' and use a Sentinel EGP to reject requests where the requested TTL exceeds the default.. Sentinel EGPs can inspect the request payload and enforce conditions on specific parameters like TTL. By attaching an EGP to the token creation endpoint, you can reject any request that attempts to set a TTL longer than allowed. This provides a centralized, enforceable restriction that cannot be bypassed by users with token creation capabilities.

Answer

Create an ACL policy that allows 'create' on 'auth/token/create' with a condition that the requested TTL must not exceed the default.

Answer

Use a token role that sets a maximum TTL, and assign that role to the users via their entity alias.

Answer

Attach a policy to the users' entity that denies 'create' on 'auth/token/create' if the TTL parameter is present and exceeds the default.

Question 11

An administrator is configuring a Vault Enterprise cluster to use the Kubernetes auth method. They need to ensure that only pods with specific service account annotations can authenticate and receive a token with a policy that allows reading secrets from 'secret/data/app'. Which two steps are required to achieve this? (Choose two.)

Accepted Answer

Configure the Kubernetes auth method with a token reviewer service account that has the necessary RBAC permissions to validate service account tokens.. To configure Kubernetes auth, you must set up the auth method with a token reviewer service account that can validate service account tokens. Then, you create a role that specifies the allowed service accounts and namespaces, and attaches the necessary policies. These two steps ensure that only pods with the correct service account can authenticate and receive a token with the desired permissions.

Answer

Create an identity entity for each pod and attach the policy directly to the entity.

Answer

Attach a Sentinel EGP to the Kubernetes auth method's login path to check the service account annotations.

Answer

Use a token role to limit the TTL of tokens issued to pods based on their service account annotations.

Question 12

A Vault administrator needs to allow a user to read secrets at 'secret/data/team1' but prevent the user from listing the contents of 'secret/metadata/team1'. The user is authenticated via the userpass auth method. Which policy should the administrator create?

Accepted Answer

path "secret/data/team1" { capabilities = ["read"] } path "secret/metadata/team1" { capabilities = ["read"] } path "secret/metadata/team1/*" { capabilities = ["deny"] }. To allow reading a secret but prevent listing, you must grant 'read' on the data path and on the metadata path for the specific secret, while denying the 'list' capability on the metadata path with a wildcard. In Vault, listing is performed on the metadata path with a trailing slash, so denying capabilities on 'secret/metadata/team1/*' prevents listing without blocking read access to individual secrets.

Answer

path "secret/data/team1" { capabilities = ["read"] } path "secret/metadata/team1" { capabilities = ["read"] }

Answer

path "secret/data/team1" { capabilities = ["read"] } path "secret/metadata/team1" { capabilities = ["deny"] }

Answer

path "secret/data/team1" { capabilities = ["read"] } path "secret/metadata/team1" { capabilities = ["read", "deny"] }

Question 13

An operations team manages a Vault Enterprise cluster with multiple namespaces. A compliance mandate requires that every token issued by the Kubernetes auth method in the 'payments' namespace must be able to read a KV v2 secret at 'secret/data/transactions' and must not have any permissions on 'secret/data/audit'. The team wants to achieve this without manually attaching policies each time a token is generated. Which approach should they take?

Accepted Answer

Create a Vault policy named 'payments-read' with path 'secret/data/transactions' and capability 'read', then bind this policy to the Kubernetes auth role via the 'token_policies' parameter.. The correct approach is to bind the policy to the Kubernetes auth role via 'token_policies'. This ensures that every token issued by that role inherits the policy, providing read access to the specified secret while denying access to the audit path. Because policies are namespace-scoped, the policy must be created in the 'payments' namespace and reference the secret path relative to that namespace. This method is automated and aligns with Vault Enterprise's namespace isolation.

Answer

Configure a Sentinel EGP policy in the 'payments' namespace that allows read access to 'secret/data/transactions' and denies access to 'secret/data/audit' for all tokens.

Answer

Attach the policy directly to the Kubernetes service account used by the application, and configure Vault to inherit policies from the service account annotations.

Answer

Create a Vault policy in the root namespace with a path that includes the namespace prefix, and attach it to a group that includes all Kubernetes service accounts.

Question 14

A Vault Enterprise administrator is configuring an LDAP auth method in a namespace. The organization uses nested groups in Active Directory, and the administrator needs to ensure that a user who is a member of a nested group (e.g., 'Engineering' which is a member of 'AllEmployees') receives the policies attached to both groups when logging in. The LDAP auth method is configured with a group DN of 'ou=groups,dc=example,dc=com' and user DN of 'ou=users,dc=example,dc=com'. Which configuration change is required to achieve this?

Accepted Answer

Set the 'groupattr' parameter to 'memberOf' and enable 'use_token_groups=true', and ensure the LDAP bind account has read access to the tokenGroups attribute.. To resolve nested groups in Active Directory, Vault's LDAP auth method can use the tokenGroups attribute by setting 'use_token_groups=true' along with 'groupattr=memberOf'. The tokenGroups attribute contains all security groups the user belongs to, including nested ones. The bind account must have read access to this attribute. This approach is supported and avoids non-existent parameters, ensuring that users receive policies from both direct and nested groups.

Answer

Set the 'groupattr' parameter to 'memberOf' and configure the LDAP auth method with 'use_token_groups=true' and 'transitive_groups=true'.

Answer

Configure the LDAP auth method with 'discoverdn=true' and 'groupfilter' set to '(memberOf=cn=Engineering,ou=groups,dc=example,dc=com)'.

Answer

Set the 'groupattr' parameter to 'memberOf' and enable 'use_token_groups' to true.

Question 15

What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?

Accepted Answer

The user is denied access.. Vault evaluates all policies attached to a token and applies a strict precedence order where 'deny' always wins over any other capability, regardless of which policy or path it appears in. Even if another policy grants 'read', 'create', or 'sudo' on the same path, the presence of a 'deny' capability in any attached policy overrides all allows. This is a deliberate security design so that a single restrictive policy cannot be silently bypassed by a permissive one.

Answer

The policy is considered invalid.

Answer

The user is allowed access.

Answer

The user receives a 403 Forbidden error.

Answer

Access is determined by the order of policy assignment.