Vault Enterprise Quick Quiz — 10 Questions

Question 1

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

Accepted Answer

request. The 'request' object in Sentinel for Vault contains metadata about the API request, including 'path' and 'operation'.

Answer

vault.metadata

Answer

token

Answer

input

Answer

policy

Question 2

When using Namespace-based multi-tenancy, which statement is true regarding the root namespace?

Accepted Answer

The root namespace is where all child namespaces derive their identity entities.. The root namespace acts as the parent and manages the configuration of auth methods and secrets engines that are globally applicable if desired, and it owns the identity store.

Answer

The root namespace can only be managed by the root token.

Answer

Namespaces are not supported in Vault Enterprise.

Answer

The root namespace is invisible to child namespaces.

Answer

You cannot create secrets in the root namespace.

Question 3

When configuring Sentinel policies for Vault, what is the 'EGP' policy type?

Accepted Answer

Endpoint Governing Policy. Endpoint Governing Policies (EGP) are scoped to specific paths and evaluated on every request to those paths.

Answer

Encryption Gateway Policy

Answer

Enterprise Group Policy

Answer

External Governance Policy

Answer

Entity Governing Policy

Question 4

An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?

Accepted Answer

Renewing the token.. Batch tokens are stateless; they cannot be renewed because they cannot be tracked in the storage backend.

Answer

Performing a Transit engine encryption.

Answer

Authenticating with a configured auth method.

Answer

Reading a secret from the KV engine.

Question 5

Which TWO configurations are required to effectively monitor Vault in a production environment?

Accepted Answer

Enabled telemetry endpoint.. Production environments require robust monitoring of metrics and thorough audit logging for compliance and troubleshooting.

Answer

Manual log rotation cron job.

Answer

UI access restricted to local IP only.

Answer

Debug mode enabled on all nodes.

Question 6

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

Accepted Answer

read. The 'read' capability is required for reading data from a path, while 'list' is for listing keys and 'create'/'update' for writing.

Answer

create

Answer

patch

Answer

list

Answer

sudo

Question 7

You have a Performance Replication setup. A client sends a write request to a performance standby node. What happens to this request?

Accepted Answer

The request is forwarded to the primary cluster.. Performance standby nodes are read-only. Any write requests sent to them must be forwarded to the primary cluster.

Answer

The standby node attempts to become the leader and process the write.

Answer

The request is cached locally until the primary is available.

Answer

The request is rejected with a 403 Forbidden.

Question 8

Which API endpoint should you use to check if a specific policy exists in the system?

Accepted Answer

GET /sys/policies/acl. The 'sys/policies/acl' endpoint allows for listing and reading ACL policies.

Answer

POST /sys/policy

Answer

GET /identity/entity

Answer

GET /sys/auth

Answer

GET /sys/mounts

Question 9

Which TWO fields are essential in an ACL policy defined in HCL?

Accepted Answer

capabilities. The path to be restricted and the capabilities allowed for that path are the core components of an ACL policy.

Answer

ttl

Answer

entity

Answer

description

Question 10

You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?

Accepted Answer

The secondary requires its own unseal process to function.. If a DR secondary is sealed, it cannot participate in replication. It must be unsealed separately from the primary.

Answer

The replication token has expired.

Answer

The primary is also sealed.

Answer

The primary has failed.