Vault Enterprise Access Control Configuration Practice Test 3 — 15 Questions

Question 1

An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Control Group Policy. To enforce that a specific group of users can only request secrets if a manager approves via a Control Group, you must create a Control Group Policy. This policy defines the approval workflow, including the required number of approvals and the authorized approvers. Control Groups are a Vault Enterprise feature that adds an additional authorization step for sensitive operations.

Answer

Sentinel Policy

Answer

Identity Group

Answer

Auth Method

Answer

ACL Namespace

Question 2

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

Accepted Answer

request. In Vault Sentinel policies, the 'request' object exposes metadata about the current request, including 'request.path', 'request.operation', 'request.data', and 'request.auth'. Policies use these fields to make allow/deny decisions based on what is being requested and by whom.

Answer

vault.metadata

Answer

token

Answer

input

Answer

policy

Question 3

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

Accepted Answer

The policy is inaccessible in the child namespace.. Vault Namespaces provide strict isolation: policies, secrets engines, auth methods, and tokens created in one namespace are not visible or usable in another. A policy created in the root namespace exists only in the root namespace's policy store; child namespaces have their own independent policy stores and cannot see or reference root-namespace policies. Therefore the policy is simply inaccessible in the child namespace where it was intended.

Answer

The policy is automatically moved to the child namespace.

Answer

The policy overwrites child namespace policies.

Answer

The policy causes a naming collision error.

Answer

The policy is inherited by all child namespaces.

Question 4

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

Accepted Answer

In the AppRole Role definition. Token restrictions like 'bound_cidrs' are configured on the 'role' within the AppRole auth method.

Answer

In the Namespace configuration

Answer

In the Identity Entity

Answer

In the Token Auth Method

Answer

Inside the ACL policy

Question 5

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

Accepted Answer

read. The correct capability is read. In Vault's policy system, the read capability grants permission to read data at a given path. For KV v2 secrets engines, reading a secret at path secret/data/my-secret requires the read capability on that exact path. This is the minimal privilege needed for an application to retrieve secret values.

Answer

create

Answer

patch

Answer

list

Answer

sudo

Question 6

What is the function of an Identity Alias in Vault?

Accepted Answer

To link an external identity to a Vault entity.. An Identity Alias in Vault links an external identity (from an auth method like LDAP, OIDC, or GitHub) to a Vault entity. This allows multiple auth methods to map to the same Vault entity, enabling unified identity and policy assignment across different authentication sources. The alias is the binding between the external identity's unique identifier and the internal entity.

Answer

To create a duplicate entity.

Answer

To generate new tokens.

Answer

To mask the real username.

Answer

To bypass ACLs.

Question 7

What does the 'root' policy in Vault provide?

Accepted Answer

Full administrative access.. The root policy in Vault is a built-in policy that grants full administrative access to all paths and operations. It is not a policy that can be modified or deleted, and it is automatically attached to the root token created during initialization. This policy allows the holder to perform any action within Vault, including managing policies, auth methods, secrets engines, and more.

Answer

Access to write policies only.

Answer

Access to view audit logs only.

Answer

Access limited to the namespace.

Answer

Read-only access to all paths.

Question 8

What is the effect of setting 'token_ttl' on a Role?

Accepted Answer

It sets the initial duration for the token.. Setting 'token_ttl' on a Vault role defines the initial Time-To-Live (TTL) for tokens issued under that role. This TTL is the starting lease duration before any renewal occurs. It does not affect the token's type, renewability, or number of uses; those are controlled by separate parameters like 'token_type', 'token_num_uses', and 'token_explicit_max_ttl'.

Answer

It restricts the number of uses.

Answer

It forces the token to be renewable.

Answer

It changes the token type.

Answer

It prevents the token from being revoked.

Question 9

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

Accepted Answer

create. In Vault ACL policies, the capabilities that govern access to secrets engines are the standard path capabilities, and create, read, and list are three of them: create allows writing new data at a path (for example, generating a new credential or writing a secret), read allows retrieving data from a path (such as reading a secret or credential), and list allows enumerating keys at a path (such as listing existing secrets or roles). These capabilities are directly attached to policy stanzas that target secrets engine paths, so they are the common building blocks for managing secrets engines. By contrast, sudo is a special capability that grants privileged access to paths that require root-protected operations, not a general secrets-engine management capability, and control-group is a policy parameter that enforces control-group authorization on a path rather than a capability used to manage secrets engines.

Answer

sudo

Answer

control-group

Question 10

Which TWO fields are essential in an ACL policy defined in HCL?

Accepted Answer

capabilities. In HCL-based ACL policies, the capabilities field (A) is essential because it specifies the exact permissions granted, such as read, list, create, update, delete, or sudo, on the given path. The path field (D) is also essential because it defines the resource or API endpoint to which those capabilities apply, forming the core path-and-capabilities rule pair. Together, capabilities and path make up the minimum required structure of an ACL policy rule in HCL. The ttl option (B) is not a standard ACL policy field, as TTL values belong to authentication tokens rather than policy definitions. The entity option (C) is not required in a policy rule, since policies attach to tokens or entities externally rather than being defined by an entity field inside the rule. The description option (E) is optional metadata used for documentation and does not affect policy enforcement.

Answer

ttl

Answer

entity

Answer

description

Question 11

Which THREE features are specific to Vault Enterprise when managing access control?

Accepted Answer

Namespaces. Namespaces (A) are a Vault Enterprise-only feature that lets you create isolated tenants within a single Vault cluster, each with its own auth methods, secrets engines, policies, and tokens, which is why it is correct for enterprise access control. Sentinel Policies (C) are also Enterprise-only; Sentinel is HashiCorp's policy-as-code framework that adds fine-grained, condition-based governance (e.g., time-of-day, MFA, CIDR checks) on top of standard Vault ACL policies. Replication (E) is Enterprise-only as well, providing Performance Replication and Disaster Recovery Replication to distribute and protect Vault data across clusters, a capability tied to enterprise access and availability management. Token Auth Method (B) is a built-in, open-source auth method available in all Vault editions, and KV v2 Secrets Engine (D) is likewise an open-source secrets engine, so neither is specific to Vault Enterprise.

Answer

Token Auth Method

Answer

KV v2 Secrets Engine

Question 12

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

Accepted Answer

Sentinel policies support EGP and RGP types.. Option D is correct because Vault Enterprise Sentinel policies come in two enforcement types: Endpoint Governing Policies (EGP), which are attached to specific paths and evaluated on requests to those endpoints, and Role Governing Policies (RGP), which are attached to tokens/roles and evaluated based on the identity making the request. Option E is correct because Sentinel is a full policy-as-code language with constructs like rules, functions, conditionals, and imports, allowing administrators to encode rich, context-aware business logic (for example, requiring MFA, time-of-day restrictions, or specific metadata) that goes well beyond simple path-based allow/deny. Option A is not correct because Sentinel policies are written in Sentinel, a purpose-built language, not HCL (HCL is used for Vault ACL policies and configuration). Option B is not correct because Sentinel does not replace ACLs; ACLs remain the primary authorization mechanism and Sentinel adds an additional layer of control. Option C is not correct because Sentinel policies are evaluated after ACLs, not before — a request must first pass the ACL check before Sentinel policies are applied.

Answer

Sentinel policies are written in HCL.

Answer

Sentinel policies replace ACLs.

Answer

Sentinel policies are evaluated before ACLs.

Question 13

Which TWO of the following are valid ways to assign policies to a token?

Accepted Answer

Inheritance from an Identity Entity.. Option A (Inheritance from an Identity Entity) is correct because Vault tokens created through an identity entity (e.g., via an entity alias or a token role tied to an entity) automatically inherit the policies attached to that entity, making entity-based policy inheritance a valid assignment mechanism. Option D (Direct assignment during token creation) is correct because policies can be explicitly passed at token creation time, for example with the `vault token create -policy=<name>` command or the `policies` parameter in the token create API, which directly binds policies to the new token. Option B is incorrect because Vault policies are not assigned by mapping to a file path; file paths are only where policy documents (HCL) are stored on disk, not a token-to-policy binding method. Option C is incorrect because the system clock has no role in policy assignment; it only affects token TTLs, expiration, and lease durations. Option E is incorrect because there is no automatic policy assignment feature in the Vault UI — policies must be explicitly specified or inherited, not auto-assigned by the interface.

Answer

Mapping to a file path.

Answer

Via the system clock.

Answer

Automatic assignment via Vault UI.

Question 14

A Vault Enterprise administrator is configuring an external group mapping using the LDAP auth method. They want to ensure that members of the LDAP group 'vault-admins' automatically receive the 'admin' policy when they authenticate. Which configuration is required to achieve this?

Accepted Answer

Create an external group in Vault with the name 'vault-admins' and attach the 'admin' policy to it.. To automatically grant the 'admin' policy to LDAP users in the 'vault-admins' group, you must create an external group in Vault with the same name and attach the policy. Vault's identity system then maps the external group membership from LDAP to the Vault external group, and the policy is applied to the token upon authentication.

Answer

Configure the LDAP auth method with a group filter that maps the 'vault-admins' group to the 'admin' policy directly in the auth method configuration.

Answer

Create an internal group in Vault named 'vault-admins' and add each LDAP user as a member.

Answer

Use a Sentinel EGP to inspect the LDAP group membership and attach the 'admin' policy during token creation.

Question 15

A Vault Enterprise cluster uses a Control Group to require approval for reading secrets at "secret/data/prod/*". A user with a token that has a policy granting read on that path attempts to read a secret but is blocked pending approval. Which statement accurately describes the token's capabilities during the pending approval?

Accepted Answer

The token can still read other secrets not under the Control Group's path.. Control Groups restrict only the protected paths, leaving the token's other capabilities intact. The token is not revoked, its TTL is not paused, and no privilege level bypasses the approval requirement. This design allows granular control without disrupting other operations.

Answer

The token can bypass the Control Group if it has a higher privilege level.

Answer

The token is immediately revoked and must be reissued after approval.

Answer

The token's TTL is paused until approval is granted or denied.