Vault Enterprise Vault Agent Configuration Practice Test 1 — 15 Questions

Question 1

When configuring Vault Agent caching, you notice that the cache is not effectively reducing requests. Which configuration parameter controls the lifespan of cached items?

Accepted Answer

max_ttl. In Vault Agent caching, the max_ttl parameter controls the maximum lifespan of cached items. It defines the upper bound for how long a cached token or secret can be used before it must be re-fetched from Vault. This ensures that even if the backend secret has a longer TTL, the cache does not serve stale data beyond max_ttl.

Answer

ttl

Answer

expiry

Answer

cache_timeout

Question 2

Your Vault Agent is configured to render a template. If you need to ensure the template is updated immediately when the secret changes in Vault, which configuration parameter should be set within the template block?

Accepted Answer

change_mode. The 'static_secret_render_interval' or 'reload_signal' handles updates, but the 'change_mode' parameter with 'signal' or 'restart' is essential for process integration.

Answer

render_interval

Answer

dynamic_update

Answer

force_refresh

Question 3

You are configuring a Vault Agent to authenticate via the AppRole method. Which configuration block is required to define the role ID and secret ID path for the agent?

Accepted Answer

auto_auth. The auto_auth block is specifically used to configure the method by which the Vault Agent authenticates to the Vault server.

Answer

auth_method

Answer

vault_agent

Answer

secrets

Question 4

You are using Vault Agent templates to generate a configuration file. You need the template to include a secret from a KV v2 engine. What is the correct syntax within the template file?

Accepted Answer

{{ secret "kv/data/config" }}. Vault Agent templates use Consul Template syntax, and the built-in `secret` function is the correct way to read a secret from Vault. For KV v2, the API path must include the `/data/` segment (e.g., `kv/data/config`), so `{{ secret "kv/data/config" }}` is the correct invocation. The `secret` function returns the full secret object, allowing access to fields like `.Data.data.key`.

Answer

Answer

Answer

$vault.read("kv/config")

Question 5

You have multiple Vault Agent instances running in a cluster. You want to ensure they all use the same cache configuration. How can you share the cache configuration between them?

Accepted Answer

It is not possible to share the cache.. Vault Agent's cache is process-local and cannot be shared between multiple Agent instances. Each Agent maintains its own in-memory cache of tokens and secrets, and there is no built-in mechanism to share that cache across instances. Therefore, it is not possible to share the cache configuration between multiple Vault Agent instances.

Answer

By setting 'shared_cache = true' in the configuration.

Answer

By mounting a shared volume.

Answer

By configuring a shared Redis backend.

Question 6

You are using the Vault Agent Sinks to persist tokens. If the sink file is deleted manually, what is the default behavior of the Vault Agent?

Accepted Answer

The agent will re-create the sink file automatically.. Vault Agent's sink configuration includes a default behavior where it monitors the sink file and recreates it if deleted. This ensures that the token remains available for other processes that rely on the file. The agent does not treat the deletion as a fatal error; instead, it automatically restores the file with the current token, maintaining continuity.

Answer

The agent will attempt to re-authenticate immediately.

Answer

The agent will disable template rendering.

Answer

The agent will stop and exit with an error.

Question 7

You have configured the Vault Agent to authenticate using the Kubernetes auth method. Which parameter is used to point to the service account token file?

Accepted Answer

token_path. In the Vault Agent auto-auth stanza for the Kubernetes auth method, 'token_path' specifies the filesystem path to the service account token that the agent reads and presents to Vault. The default is /var/run/secrets/kubernetes.io/serviceaccount/token, but it can be overridden for projected tokens or custom mounts. This is the parameter the agent uses to locate the JWT for authentication.

Answer

service_account_token

Answer

jwt_path

Answer

token_file

Question 8

If you are using Vault Agent templates to render a file, and the secret contains a newline, how can you ensure the output is correctly formatted in your template?

Accepted Answer

Use the 'indent' function.. The 'indent' function in Consul Template (used by Vault Agent templates) prepends a specified number of spaces to every line of a multi-line string, which is essential when embedding a multi-line secret into an indented YAML, JSON, or config file structure. Without it, subsequent lines of a newline-containing secret would break the surrounding indentation and produce invalid output. Using 'indent N' ensures each line of the secret is properly aligned within the target document.

Answer

Use the 'raw' function.

Answer

Use the 'base64' function.

Answer

It is not possible to render multiline secrets.

Question 9

Which THREE features does the Vault Agent 'cache' block provide?

Accepted Answer

Load balancing. Vault Agent caching provides request response caching, token caching, and allows for improved performance.

Answer

Secret rotation

Answer

Data encryption

Question 10

Which THREE configuration options are valid within the 'template' block?

Accepted Answer

destination. In a Consul Template `template` block, the `source` option (D) specifies the path to the template file on disk that will be rendered, and it is a valid and commonly required setting. The `destination` option (B) specifies the file path where the rendered output is written, which is also a valid key inside the `template` block. The `perms` option (E) sets the Unix file permissions (e.g., 0644) applied to the rendered destination file, and it is likewise a valid configuration option. The unmarked options do not belong: `command` (A) is specified at the top level or in a `command` block rather than inside `template`, and `version` (C) is not a recognized key within the `template` block.

Answer

command

Answer

version

Question 11

When configuring Vault Agent auto-auth with TLS, where should you place the CA certificate file?

Accepted Answer

In the 'tls_ca_cert' parameter.. When configuring Vault Agent auto-auth with TLS, the CA certificate file is specified in the tls_ca_cert parameter within the auto_auth stanza's method or the vault stanza. This parameter tells Vault Agent which CA certificate to use when verifying the Vault server's TLS certificate during the auto-auth login process. Placing it in tls_ca_cert ensures the agent trusts the server's certificate chain before sending authentication credentials.

Answer

As an environment variable.

Answer

In the 'cache' block.

Answer

In the 'listener' block.

Question 12

Which THREE parameters are available in the 'vault' (top-level) block?

Accepted Answer

tls_skip_verify. The top-level 'vault' block in the Vault provider configuration accepts connection-related arguments, and tls_skip_verify (A) is valid there because it disables TLS certificate verification for the Vault endpoint, which is a provider-level setting. address (D) is correct because it specifies the URI of the Vault server (e.g., https://vault.example.com:8200) and is the primary top-level connection parameter. ca_cert (E) is also correct since it provides the path to a PEM-encoded CA certificate file used to verify the Vault server's TLS certificate, another top-level connection argument. Options B (method) and C (role) are not top-level 'vault' block parameters; they belong to authentication-related blocks such as 'auth_login' (e.g., method and namespace) or 'auth_backend'/'approle' configurations where role_id and secret_id are used, so they do not belong in the top-level block.

Answer

method

Answer

role

Question 13

Which THREE functions are available for use within Vault Agent templates?

Accepted Answer

scratch. In Vault Agent templates, the `scratch` function (A) is available to create and pass temporary variables between templates without persisting them to Vault, which is useful for intermediate computation. The `secret` function (D) is the core function that retrieves a secret from a Vault path (e.g., `{{ with secret "secret/data/foo" }}`) and exposes its data for rendering. The `metadata` function (E) is also available and returns metadata about a secret, such as its lease duration, renewal status, and version, which templates can use for conditional logic. Options B (`encrypt`) and C (`rotate`) are not template functions; encryption and key rotation are Vault operations performed via the API, CLI, or transit secrets engine, not Consul Template functions available inside Vault Agent templates.

Answer

encrypt

Answer

rotate

Question 14

You are running Vault Agent on a hardened Linux host that has no writable filesystem locations except /var/run/vault-agent. Auto-auth uses AppRole with a wrapped secret_id delivered by your orchestrator. The agent must renew its token and run a child process that consumes the token from a file. Which combination of listener and auto_auth sink configuration is required for the child process to read the token?

Accepted Answer

Configure a listener block of type unix with address "/var/run/vault-agent/agent.sock" and an auto_auth sink of type file with config { path = "/var/run/vault-agent/token" }.. The child process needs a token file, which only an auto_auth sink of type file produces, and the agent API needs a local endpoint, which a unix listener provides. Both must be placed under the sole writable directory. The unix listener avoids opening a network port, and the file sink writes the token with restrictive permissions by default.

Answer

Configure a listener block of type tcp with address "127.0.0.1:8200" and no sink, relying on the default token file written to the agent's working directory.

Answer

Configure a listener block of type unix with address "/var/run/vault-agent/agent.sock" and an auto_auth sink of type file with config { path = "/var/run/vault-agent/token", mode = "0644" }.

Answer

Configure a listener block of type unix with address "/var/run/vault-agent/agent.sock" and set the auto_auth method's config to write the token directly to /var/run/vault-agent/token.

Question 15

You are deploying Vault Agent on a VM to render a database credential into an application config file. The application reads the file only at startup, and you want the agent to write the file once and not rewrite it on every secret rotation to avoid triggering unnecessary reloads. Which template stanza setting accomplishes this?

Accepted Answer

Set static_secret_render_interval = "0s" in the template_config stanza so the agent renders static secrets once and does not re-render them.. The template_config stanza governs template rendering behavior globally. Setting static_secret_render_interval to 0s tells the agent not to periodically re-render static secrets, so the destination file is written once. This suits applications that read configuration only at startup and would otherwise be disrupted by repeated file rewrites on every rotation cycle.

Answer

Set exit_after_auth = true in the template stanza so the agent stops after rendering the first secret.

Answer

Set error_on_missing_key = true in the template stanza so rendering fails if the secret key is absent.

Answer

Set change_mode = "noop" in the template stanza so the agent does not execute any command when the rendered file changes.