Vault Enterprise Vault Agent Configuration Practice Test 2 — 15 Questions

Question 1

You are running Vault Agent on a set of application servers behind an Auto Scaling group. Each agent uses auto-auth with the AWS auth method and writes its token to a sink file. During an autoscaling event, new instances start, but the agent on the new instances fails to obtain a token because the IAM role attached to the instance is not yet recognized by Vault. You need the agent to retry authentication automatically without restarting the agent process. Which configuration parameter in the auto_auth stanza should you adjust?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

configure the 'retry' stanza with 'num_retries' and 'backoff' settings. The auto_auth stanza's retry block allows the agent to handle transient authentication failures by retrying with a backoff. In this scenario, the IAM role propagation delay causes the initial auth to fail; configuring retries ensures the agent eventually succeeds without manual restarts. Other parameters like exit_after_auth, token_ttl, or cache backoff do not influence the auto-auth retry logic.

Answer

set 'max_backoff' in the cache stanza to a higher value

Answer

increase the 'token_ttl' in the auto_auth method configuration

Answer

set the 'exit_after_auth' parameter to false

Question 2

You are configuring Vault Agent with a template that renders a database connection string from a KV v2 secret. The secret contains a password with special characters. The rendered file is consumed by an application that requires the password to be URL-encoded. Which template function should you use to ensure the password is properly encoded?

Accepted Answer

urlencode. The urlencode function in Vault Agent templates applies percent-encoding, which is the standard for embedding special characters in URLs. A database connection string often requires the password to be URL-encoded to avoid parsing errors. Other functions like urlquery, base64Encode, or toJSON either use a different encoding scheme or transform the data in ways that are incompatible with the application's expectations.

Answer

urlquery

Answer

base64Encode

Answer

toJSON

Question 3

An operations team runs Vault Agent on a fleet of web servers. They want the agent to keep a rendered TLS certificate file updated as the secret rotates, and they want the agent to restart the web service only when the certificate content actually changes. Which template stanza parameter should they configure to achieve the restart behavior?

Accepted Answer

change_mode = "restart". Template stanzas use change_mode to decide the action taken when the rendered file content changes. The "restart" value restarts the process defined in the exec block, and the agent only triggers this when the content differs from the previous render. Other parameters like change_signal or error_on_missing_key do not initiate restarts, and exec alone does not define the trigger.

Answer

exec { command = "systemctl restart web" }

Answer

change_signal = "SIGUSR1"

Answer

error_on_missing_key = true

Question 4

You are deploying Vault Agent on a set of application servers behind a load balancer. The applications must obtain a database credential from a dynamic secrets engine, and you want the credential to be proactively renewed before it expires so the application never sees a stale credential. Which Vault Agent configuration block should you use to achieve this?

Accepted Answer

template with a renew loop. The template block supports a renewal loop that periodically renews the secret and re-renders the output, so the application always has a valid credential. Other blocks handle authentication or caching but do not actively renew dynamic secrets. Using a template with a renewal loop is the correct way to keep a dynamic database credential fresh for the application.

Answer

template

Answer

cache

Answer

auto_auth

Question 5

You are deploying a Vault Agent on a set of application servers that must authenticate to Vault Enterprise using the AWS auth method. The servers have IAM roles attached. You need to ensure the agent auto-authenticates without embedding static credentials. Which configuration block should you use?

Accepted Answer

auto_auth { method { type = "aws" config { role = "app-role" type = "iam" } } }. The AWS auth method in Vault Agent requires specifying the Vault role and the credential type. For servers with IAM roles, the 'iam' type instructs the agent to use the IAM credentials to sign the login request. This avoids static secrets and leverages the existing IAM role.

Answer

auto_auth { method { type = "aws" config { role = "app-role" } } }

Answer

auto_auth { method { type = "aws" config { role_id = "app-role" secret_id = "..." } } }

Answer

auto_auth { method { type = "aws" config { role = "app-role" type = "ec2" } } }

Question 6

A security engineer is configuring a Vault Agent sink block to persist the auto-auth token for use by an external logging daemon. The daemon expects the token in a specific file format and location. Which two parameters are valid within a sink block to control how the token is written? (Choose two.)

Accepted Answer

type. Sink blocks require a type to select the sink implementation and a config block to supply sink-specific details like the file path. Parameters such as change_mode, destination, and wrap_ttl belong to other stanzas or API operations. Only type and config are valid within a sink, and they together determine where and how the token is persisted.

Answer

wrap_ttl

Answer

destination

Answer

change_mode

Question 7

You are deploying Vault Agent on a Windows server to manage secrets for a legacy application. The agent is configured with auto-auth and a file sink. After the agent starts, you notice that the token file is created but the application cannot read it because the file permissions are too restrictive. Which configuration parameter in the sink block should you adjust to change the file permissions?

Accepted Answer

set 'mode' to the desired octal permissions. The mode parameter in the sink block defines the file permissions for the sink file. By default, it is 0640, which might prevent the application from reading the token if it runs as a different user. Setting mode to a less restrictive value like 0644 resolves the issue. The sink block does not support owner, group, or umask parameters, so those are not viable solutions.

Answer

set 'owner' to the application's user account

Answer

set 'group' to the application's group

Answer

set 'umask' to control default permissions

Question 8

A Vault Agent runs on a host and auto-auths using the AWS auth method. The agent is configured with a template that renders a database password into /etc/app/db.conf. The operations team notices that after the secret's lease is renewed, the rendered file is not updated. Which Vault Agent configuration element is most likely missing or misconfigured to cause this behavior?

Accepted Answer

The template stanza is missing the 'change_mode' attribute set to 'restart' or 'signal'.. The template's change_mode controls what happens when the rendered secret changes, such as after a lease renewal. If it is omitted, the default 'noop' means the file is updated but no notification or restart occurs, so the application continues using the old secret. Setting change_mode to 'restart' or 'signal' ensures the application picks up the new secret.

Answer

The template stanza is missing the 'error_on_missing_key' attribute.

Answer

The template stanza is missing a 'destination' attribute.

Answer

The auto_auth block is missing the 'remove_secret_id_file_after_reading' parameter.

Question 9

You are using Vault Agent to render a PKI certificate to a file on a web server. The certificate must be updated automatically when it is close to expiration, and the web server should reload its configuration without a restart. Which Vault Agent template configuration should you use to achieve this?

Accepted Answer

Set the template's `command` parameter to a script that reloads the web server.. The `command` parameter in a template block allows you to execute a command after the template is rendered. This is ideal for triggering a web server reload when a certificate is updated. Other options like `change_mode` affect the agent itself, not external services, and setting the destination alone does not trigger a reload.

Answer

Set the template's `change_mode` to `signal` and specify a signal.

Answer

Set the template's `destination` to the web server's configuration directory.

Answer

Set the template's `change_mode` to `restart`.

Question 10

You are configuring a Vault Agent cache for a high-traffic application. You need to ensure that the cache does not serve stale secrets and that it respects per-request TTLs. Which TWO configuration parameters in the 'cache' block are required to achieve this? (Choose two.)

Accepted Answer

use_auto_auth_token. To avoid stale secrets and respect TTLs, the cache must use the auto-auth token for requests and enforce consistency. The 'use_auto_auth_token' ensures the cache operates with the token's lease, while 'enforce_consistency' forces a check for the latest version. Together, they prevent serving outdated data.

Answer

persist

Answer

cache_static_secrets

Answer

max_ttl

Question 11

A Vault Agent is configured with two template stanzas. The first renders a secret to /etc/app/secret1.txt, and the second renders a different secret to /etc/app/secret2.txt. Both templates use the same Vault token from auto-auth. The operations team wants to ensure that if the Vault token is renewed, both templates are re-rendered immediately. Which Vault Agent configuration parameter must be set to achieve this?

Accepted Answer

Ensure that the 'template' stanzas use the 'with secret' function and that the Vault token is renewed via auto-auth.. Vault Agent templates that use the 'with secret' function are automatically re-rendered when the Vault token used for authentication is renewed. The auto-auth process renews the token, and the template engine detects the change and re-renders all templates that depend on that token. Therefore, no special parameter is required; the default behavior ensures immediate re-rendering upon token renewal.

Answer

Set 'exit_after_auth' to true in the auto_auth block.

Answer

Set 'template_config' with 'exit_on_retry_failure' to true.

Answer

Set 'template_config' with 'static_secret_render_interval' to a low value.

Question 12

A Vault Agent is configured with auto-auth using the AppRole auth method. The security team requires that the agent's token be renewed automatically and that the token's TTL be extended without manual intervention. Which two configuration parameters in the auto_auth block are necessary to achieve this? (Choose two.)

Accepted Answer

Enable 'auto_auth' with a method stanza that includes 'role_id' and 'secret_id'.. To achieve automatic token renewal with AppRole, the auto_auth block must include a method stanza with role_id and secret_id so the agent can authenticate and obtain a token. Additionally, exit_after_auth must be false (the default) so the agent continues running and can renew the token. The agent automatically renews tokens when they are renewable, extending their TTL without further configuration.

Answer

Set 'remove_secret_id_file_after_reading' to false.

Answer

Set 'wrap_ttl' to a non-zero value.

Answer

Configure the 'sink' block to store the token.

Question 13

A Vault Agent is configured to use the 'file' sink to write the auto-auth token to /var/run/vault/token. The application that consumes this token needs to know when the token changes so it can reload its configuration. Which Vault Agent feature can be used to notify the application of token changes?

Accepted Answer

Use the 'template' stanza with 'change_mode' set to 'signal' and a command that signals the application.. To notify an application when the auto-auth token changes, you can use a template stanza with change_mode set to 'signal' or 'restart'. The template would render a file that includes the token or a representation of it, and when the token is renewed, the template re-renders, triggering the configured action. This allows the application to reload its configuration with the new token. Sinks alone do not provide change notification.

Answer

Configure the sink with a 'change_mode' parameter.

Answer

Set the 'sink' block's 'wrap_ttl' parameter to a non-zero value.

Answer

Use a template to read the token from the sink and render it to a file with a change_mode.

Question 14

Where does the Vault Agent store the token it retrieves via auto-auth by default if a sink is not defined?

Accepted Answer

In-memory. When no sink is configured, Vault Agent auto-auth keeps the acquired token in memory only. The token is not written to disk or exported to an environment variable by default; it is held by the agent process and used for cache requests or template rendering. Persisting it requires explicitly defining a sink.

Answer

/tmp/vault.token

Answer

/var/run/vault/token

Answer

Environment variable VAULT_TOKEN

Question 15

When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?

Accepted Answer

role. In Vault Agent's auto-auth configuration, the AWS auth method's 'method' block requires the 'role' parameter to specify which Vault role (bound to an IAM principal) the agent should authenticate as. The 'role' parameter maps to the Vault role name, not the IAM role name directly — the binding between IAM role and Vault role is configured server-side. This is consistent across all Vault auth methods, which use 'role' as the standard parameter name.

Answer

identity

Answer

iam_role

Answer

aws_role