Vault Enterprise Vault Agent Configuration Practice Test 3 — 15 Questions

Question 1

What is the benefit of using a Vault Agent sink?

Accepted Answer

It persists the token to disk for other processes.. A Vault Agent sink is a configuration block that writes the agent's auto-auth token (and optionally wrapped data) to a file on disk so that other local processes — not just the agent's own templates — can consume it. This is the documented purpose of the 'sink' stanza in the agent config, which supports file sinks with configurable mode, owner, and group. It decouples token acquisition from token consumption for legacy or non-Vault-aware applications.

Answer

It automates the Vault server backup.

Answer

It encrypts the vault server traffic.

Answer

It compresses the template output.

Question 2

Which signal is commonly used with 'change_mode = signal' in Vault Agent templates to reload a service without stopping it?

Accepted Answer

SIGHUP. SIGHUP (Signal Hang Up) is the conventional Unix signal used to tell a long-running daemon to reload its configuration files without terminating the process. In Vault Agent templates, setting change_mode = signal with signal = "SIGHUP" causes the agent to send SIGHUP to the configured process whenever the rendered template changes, prompting the service to re-read its config in place. This preserves the running process, its PID, and any in-memory state while picking up new secrets or certificates.

Answer

SIGKILL

Answer

SIGINT

Answer

SIGTERM

Question 3

You want the Vault Agent to run as a sidecar. Which configuration block allows you to specify the listener address for the Vault Agent's internal API?

Accepted Answer

listener. The Vault Agent configuration uses a top-level 'listener' block (not 'tcp_listener' or 'api_listener') to define the address and port where the Agent's internal API/cache proxy listens. This stanza accepts 'type = "tcp"' along with 'address' and optional 'tls_disable' settings. It is the same stanza name used in the Vault server config, which is why candidates sometimes confuse the two.

Answer

tcp_listener

Answer

server

Answer

api_listener

Question 4

When using 'template_config' to set the 'static_secret_render_interval', what is the minimum value you can set?

Accepted Answer

5s. The 'static_secret_render_interval' in Vault Agent's 'template_config' controls how often static secrets are re-rendered, and the minimum allowed value is 5 seconds. Setting it lower than 5s is rejected by Vault Agent to prevent excessive API calls and resource churn.

Answer

1s

Answer

0s

Answer

10s

Question 5

Which component of the Vault Agent is responsible for managing the lifecycle of the vault token retrieved via auto-auth?

Accepted Answer

Auto-auth. The auto-auth component of Vault Agent is responsible for authenticating to Vault and managing the lifecycle of the resulting token, including renewal and re-authentication when the token expires. It obtains the token via the configured auth method (e.g., AppRole, AWS, Kubernetes) and keeps it valid for other components like the template engine and cache.

Answer

Sink

Answer

Template engine

Answer

Cache

Question 6

Which configuration parameter in the Vault Agent 'cache' block allows you to disable caching for specific requests?

Accepted Answer

There is no per-request bypass in the configuration.. The Vault Agent cache block does not expose a configuration parameter to bypass caching for specific requests. Caching behavior is controlled globally (for example, via the cache listener and persist settings), and there is no per-request or per-path bypass option in the agent configuration. Therefore the correct answer is that no such parameter exists.

Answer

ignore_requests

Answer

exclude_paths

Answer

disable_cache

Question 7

Which TWO of the following are valid sink types in Vault Agent?

Accepted Answer

file. In Vault Agent's template stanza, a sink is the destination where the rendered secrets are written, and the two supported sink types are 'file' and 'stdout'. Option B (file) is correct because Vault Agent can write rendered templates to a file sink, configured with a path and optional permissions such as 'perms = "0644"'. Option D (stdout) is correct because Vault Agent supports a stdout sink that writes the rendered output to standard output, which is useful for piping secrets into processes or containers. Option A (vault) is not a sink type; it is the source of secrets, not a destination for rendered templates. Option C (s3) is not a supported sink type in Vault Agent, as it does not natively write rendered templates to S3. Option E (memory) is also not a valid sink type, since Vault Agent does not expose an in-memory sink for rendered templates.

Answer

vault

Answer

s3

Answer

memory

Question 8

Which TWO authentication methods are commonly configured in the 'auto_auth' block?

Accepted Answer

AppRole. In HashiCorp Vault's agent configuration, the auto_auth block is designed for machine-to-machine authentication, and AppRole (option B) is the canonical method because it issues a role_id and secret_id that a service can supply non-interactively to obtain a Vault token. Kubernetes (option D) is equally common in the auto_auth block because pods can authenticate using their service account JWT via the Kubernetes auth method, again without human interaction. Both AppRole and Kubernetes are explicitly documented as typical auto_auth methods for workloads and CI/CD pipelines. By contrast, Userpass (A), LDAP (C), and GitHub (E) are human-oriented or interactive auth methods that require credentials such as a username/password or an OAuth flow, so they are not the standard choices configured inside auto_auth.

Answer

Userpass

Answer

LDAP

Answer

GitHub

Question 9

Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?

Accepted Answer

signal. In the Vault Agent template stanza, the change_mode parameter controls what happens when the rendered secret changes, and its valid values are signal, restart, and noop. Option A (signal) is correct because it sends the configured signal (default SIGHUP, or the value of signal) to the process specified by the exec block, allowing the application to reload its configuration without a full restart. Option B (restart) is correct because it instructs Vault Agent to stop and restart the child process defined in the exec block so it picks up the new secret. Option D (noop) is correct because it tells Vault Agent to take no action on the process when the template output changes, leaving the application to detect the change itself. Option C (delete) is not a valid change_mode value; Vault Agent does not delete the process or file as a change action. Option E (exec) is also not a valid change_mode value; exec is a separate template stanza block that defines the command to run, not a change-triggered action.

Answer

delete

Answer

exec

Question 10

Which TWO of the following are valid parameters for configuring the 'sink' in Vault Agent?

Accepted Answer

type. In Vault Agent's sink stanza, the two valid configuration parameters are 'type' (option A) and 'config' (option C). The 'type' parameter specifies the sink backend, such as 'file' for writing tokens to disk, and is required to determine how the sink behaves. The 'config' parameter supplies a map of backend-specific settings (for example, the file path and permissions when type is 'file'), so it is the mechanism for passing sink-specific options. Options B ('ttl'), D ('auth_method'), and E ('mode') are not sink parameters: 'ttl' and 'auth_method' belong to the auto-auth or token configuration, and 'mode' is a file-permission setting that would be nested inside the sink's config block rather than a top-level sink parameter.

Answer

ttl

Answer

auth_method

Answer

mode

Question 11

Your team runs Vault Agent with auto_auth using the AWS auth method on EC2 instances. The agent's token is about to expire, and you must ensure the agent continues to serve requests without manual intervention. Which TWO behaviors does Vault Agent perform to maintain a valid token? (Choose two.)

Accepted Answer

The agent automatically renews the token using the renew-self endpoint before its TTL expires, as long as the token is renewable.. Vault Agent maintains authentication by first attempting token renewal through the renew-self endpoint while the token remains renewable. If renewal is impossible because the token is non-renewable, has hit its max TTL, or errors, the agent re-executes the auto_auth method to obtain a fresh token. Together these behaviors keep long-running workloads authenticated without manual restarts.

Answer

The agent promotes the token to a periodic token by calling the auth method's tune endpoint with a period parameter.

Answer

The agent writes the token to the sink and then requests a new wrapped secret_id from the orchestrator using the response-wrapping endpoint.

Answer

The agent disables token renewal and instead relies on the Vault server's default lease duration to expire and recreate the token automatically.

Question 12

A platform engineer is configuring a Vault Agent on a database server. The agent must use the AppRole auth method and write the resulting token to a file so that a local backup script can read it. Which top-level configuration block should the engineer populate to define the AppRole role ID and secret ID?

Accepted Answer

auto_auth. Agent authentication is configured in the auto_auth block, where the method type and its parameters are declared. For AppRole, role_id and secret_id belong inside the method block nested under auto_auth. The other blocks handle caching, listeners, and secret rendering, and none of them accept authentication credentials. Without auto_auth, the agent has no token source.

Answer

cache

Answer

listener

Answer

template

Question 13

Your security team requires that Vault Agent use a specific namespace in Vault Enterprise for all auto-auth and secret retrieval operations. The agent is configured with AppRole auto-auth. Which configuration parameter must you set to ensure the agent operates within the required namespace?

Accepted Answer

namespace in the vault block. In Vault Enterprise, the agent's namespace is configured in the top-level vault block. This setting applies to all agent operations, including auto-auth, templating, and caching. Setting it there ensures the agent interacts with the correct namespace, which is essential for multi-tenant environments and proper access control.

Answer

namespace in the cache block

Answer

namespace in the template block

Answer

namespace in the auto_auth block

Question 14

A Vault Agent is configured with auto_auth using the AWS auth method and a cache block with use_auto_auth_token = true. A client application connects to the agent's listener and sends a request to read a secret at secret/data/app. The agent's cached token lacks permission for that path, but the client also provides its own Vault token in the X-Vault-Token header. How does the agent handle the request?

Accepted Answer

The agent forwards the request to Vault using the client-provided token, because the client token takes precedence when present.. With use_auto_auth_token enabled, the agent uses its auto-auth token only when the client request lacks a token. If the client includes an X-Vault-Token header, the agent forwards that token to Vault. The agent does not evaluate permissions itself; Vault enforces policies. This design lets clients use their own tokens for specific paths while still leveraging the agent's caching and proxying.

Answer

The agent attempts to renew the auto-auth token and retries the request, ignoring the client token until the auto-auth token gains access.

Answer

The agent rejects the request with a 403 error because the auto-auth token is not authorized for the path.

Answer

The agent ignores the client token and uses the auto-auth token, causing Vault to return a permission denied error.

Question 15

You are configuring Vault Agent with a cache stanza to cache responses from a Vault Enterprise cluster. The cache is enabled, and you want to ensure that the agent can continue to serve cached secrets even if the Vault cluster becomes temporarily unavailable. Which cache parameter should you configure to control how long the agent will serve stale data?

Accepted Answer

serve_stale. The serve_stale parameter in the cache stanza allows the agent to serve cached secrets even after their lease has expired if the Vault cluster cannot be reached. This is crucial for high availability during transient outages. Other parameters like persist affect cache durability across restarts, but not stale data serving. lease_duration and max_age are not cache configuration parameters.

Answer

lease_duration

Answer

persist

Answer

max_age