When configuring Vault Agent caching, you notice that the cache is not effectively reducing requests. Which configuration parameter controls the lifespan of cached items?
Your Vault Agent is configured to render a template. If you need to ensure the template is updated immediately when the secret changes in Vault, which configuration parameter should be set within the template block?
You are configuring a Vault Agent to authenticate via the AppRole method. Which configuration block is required to define the role ID and secret ID path for the agent?
You are using Vault Agent templates to generate a configuration file. You need the template to include a secret from a KV v2 engine. What is the correct syntax within the template file?
You have multiple Vault Agent instances running in a cluster. You want to ensure they all use the same cache configuration. How can you share the cache configuration between them?
You have configured the Vault Agent to authenticate using the Kubernetes auth method. Which parameter is used to point to the service account token file?
If you are using Vault Agent templates to render a file, and the secret contains a newline, how can you ensure the output is correctly formatted in your template?
You are running Vault Agent on a hardened Linux host that has no writable filesystem locations except /var/run/vault-agent. Auto-auth uses AppRole with a wrapped secret_id delivered by your orchestrator. The agent must renew its token and run a child process that consumes the token from a file. Which combination of listener and auto_auth sink configuration is required for the child process to read the token?
You are deploying Vault Agent on a VM to render a database credential into an application config file. The application reads the file only at startup, and you want the agent to write the file once and not rewrite it on every secret rotation to avoid triggering unnecessary reloads. Which template stanza setting accomplishes this?
You are running Vault Agent on a set of application servers behind an Auto Scaling group. Each agent uses auto-auth with the AWS auth method and writes its token to a sink file. During an autoscaling event, new instances start, but the agent on the new instances fails to obtain a token because the IAM role attached to the instance is not yet recognized by Vault. You need the agent to retry authentication automatically without restarting the agent process. Which configuration parameter in the auto_auth stanza should you adjust?
You are configuring Vault Agent with a template that renders a database connection string from a KV v2 secret. The secret contains a password with special characters. The rendered file is consumed by an application that requires the password to be URL-encoded. Which template function should you use to ensure the password is properly encoded?
An operations team runs Vault Agent on a fleet of web servers. They want the agent to keep a rendered TLS certificate file updated as the secret rotates, and they want the agent to restart the web service only when the certificate content actually changes. Which template stanza parameter should they configure to achieve the restart behavior?
You are deploying Vault Agent on a set of application servers behind a load balancer. The applications must obtain a database credential from a dynamic secrets engine, and you want the credential to be proactively renewed before it expires so the application never sees a stale credential. Which Vault Agent configuration block should you use to achieve this?
You are deploying a Vault Agent on a set of application servers that must authenticate to Vault Enterprise using the AWS auth method. The servers have IAM roles attached. You need to ensure the agent auto-authenticates without embedding static credentials. Which configuration block should you use?
A security engineer is configuring a Vault Agent sink block to persist the auto-auth token for use by an external logging daemon. The daemon expects the token in a specific file format and location. Which two parameters are valid within a sink block to control how the token is written? (Choose two.)
You are deploying Vault Agent on a Windows server to manage secrets for a legacy application. The agent is configured with auto-auth and a file sink. After the agent starts, you notice that the token file is created but the application cannot read it because the file permissions are too restrictive. Which configuration parameter in the sink block should you adjust to change the file permissions?
A Vault Agent runs on a host and auto-auths using the AWS auth method. The agent is configured with a template that renders a database password into /etc/app/db.conf. The operations team notices that after the secret's lease is renewed, the rendered file is not updated. Which Vault Agent configuration element is most likely missing or misconfigured to cause this behavior?
You are using Vault Agent to render a PKI certificate to a file on a web server. The certificate must be updated automatically when it is close to expiration, and the web server should reload its configuration without a restart. Which Vault Agent template configuration should you use to achieve this?
You are configuring a Vault Agent cache for a high-traffic application. You need to ensure that the cache does not serve stale secrets and that it respects per-request TTLs. Which TWO configuration parameters in the 'cache' block are required to achieve this? (Choose two.)
A Vault Agent is configured with two template stanzas. The first renders a secret to /etc/app/secret1.txt, and the second renders a different secret to /etc/app/secret2.txt. Both templates use the same Vault token from auto-auth. The operations team wants to ensure that if the Vault token is renewed, both templates are re-rendered immediately. Which Vault Agent configuration parameter must be set to achieve this?
A Vault Agent is configured with auto-auth using the AppRole auth method. The security team requires that the agent's token be renewed automatically and that the token's TTL be extended without manual intervention. Which two configuration parameters in the auto_auth block are necessary to achieve this? (Choose two.)
A Vault Agent is configured to use the 'file' sink to write the auto-auth token to /var/run/vault/token. The application that consumes this token needs to know when the token changes so it can reload its configuration. Which Vault Agent feature can be used to notify the application of token changes?
Your team runs Vault Agent with auto_auth using the AWS auth method on EC2 instances. The agent's token is about to expire, and you must ensure the agent continues to serve requests without manual intervention. Which TWO behaviors does Vault Agent perform to maintain a valid token? (Choose two.)
A platform engineer is configuring a Vault Agent on a database server. The agent must use the AppRole auth method and write the resulting token to a file so that a local backup script can read it. Which top-level configuration block should the engineer populate to define the AppRole role ID and secret ID?
Your security team requires that Vault Agent use a specific namespace in Vault Enterprise for all auto-auth and secret retrieval operations. The agent is configured with AppRole auto-auth. Which configuration parameter must you set to ensure the agent operates within the required namespace?
A Vault Agent is configured with auto_auth using the AWS auth method and a cache block with use_auto_auth_token = true. A client application connects to the agent's listener and sends a request to read a secret at secret/data/app. The agent's cached token lacks permission for that path, but the client also provides its own Vault token in the X-Vault-Token header. How does the agent handle the request?
You are configuring Vault Agent with a cache stanza to cache responses from a Vault Enterprise cluster. The cache is enabled, and you want to ensure that the agent can continue to serve cached secrets even if the Vault cluster becomes temporarily unavailable. Which cache parameter should you configure to control how long the agent will serve stale data?
A DevOps engineer is using Vault Agent templates to render a database password from a KV v2 secrets engine. The secret is stored at secret/data/db with a key named password. The engineer wants to ensure the rendered file contains only the password value and no extra whitespace or newlines. Which template function should be used to trim whitespace from the secret value?
You are configuring Vault Agent auto-auth with the AppRole auth method on a set of servers. You need to ensure that the agent can authenticate securely using role_id and secret_id. Which two configuration parameters are required within the auto_auth method block for AppRole? (Choose two.)
You are configuring Vault Agent auto-auth with the AWS auth method. The agent must authenticate using an IAM role attached to an EC2 instance. Which two parameters are required in the auto_auth block's method configuration to enable this? (Choose two.)
You are configuring a Vault Agent to use the AppRole auth method. The agent must retrieve a secret from a KV v2 secrets engine and render it into a configuration file. The secret path is 'secret/data/myapp/config'. Which template function should you use to access the secret's data?