Vault Enterprise Vault Agent Configuration — Timed 20 Questions

Question 1

When configuring Vault Agent caching, you notice that the cache is not effectively reducing requests. Which configuration parameter controls the lifespan of cached items?

Accepted Answer

max_ttl. In Vault Agent caching, the max_ttl parameter controls the maximum lifespan of cached items. It defines the upper bound for how long a cached token or secret can be used before it must be re-fetched from Vault. This ensures that even if the backend secret has a longer TTL, the cache does not serve stale data beyond max_ttl.

Answer

ttl

Answer

expiry

Answer

cache_timeout

Question 2

Your Vault Agent is configured to render a template. If you need to ensure the template is updated immediately when the secret changes in Vault, which configuration parameter should be set within the template block?

Accepted Answer

change_mode. The 'static_secret_render_interval' or 'reload_signal' handles updates, but the 'change_mode' parameter with 'signal' or 'restart' is essential for process integration.

Answer

render_interval

Answer

dynamic_update

Answer

force_refresh

Question 3

You are configuring a Vault Agent to authenticate via the AppRole method. Which configuration block is required to define the role ID and secret ID path for the agent?

Accepted Answer

auto_auth. The auto_auth block is specifically used to configure the method by which the Vault Agent authenticates to the Vault server.

Answer

auth_method

Answer

vault_agent

Answer

secrets

Question 4

You are using Vault Agent templates to generate a configuration file. You need the template to include a secret from a KV v2 engine. What is the correct syntax within the template file?

Accepted Answer

{{ secret "kv/data/config" }}. Vault Agent templates use Consul Template syntax, and the built-in `secret` function is the correct way to read a secret from Vault. For KV v2, the API path must include the `/data/` segment (e.g., `kv/data/config`), so `{{ secret "kv/data/config" }}` is the correct invocation. The `secret` function returns the full secret object, allowing access to fields like `.Data.data.key`.

Answer

Answer

Answer

$vault.read("kv/config")

Question 5

You have multiple Vault Agent instances running in a cluster. You want to ensure they all use the same cache configuration. How can you share the cache configuration between them?

Accepted Answer

It is not possible to share the cache.. Vault Agent's cache is process-local and cannot be shared between multiple Agent instances. Each Agent maintains its own in-memory cache of tokens and secrets, and there is no built-in mechanism to share that cache across instances. Therefore, it is not possible to share the cache configuration between multiple Vault Agent instances.

Answer

By setting 'shared_cache = true' in the configuration.

Answer

By mounting a shared volume.

Answer

By configuring a shared Redis backend.

Question 6

You are using the Vault Agent Sinks to persist tokens. If the sink file is deleted manually, what is the default behavior of the Vault Agent?

Accepted Answer

The agent will re-create the sink file automatically.. Vault Agent's sink configuration includes a default behavior where it monitors the sink file and recreates it if deleted. This ensures that the token remains available for other processes that rely on the file. The agent does not treat the deletion as a fatal error; instead, it automatically restores the file with the current token, maintaining continuity.

Answer

The agent will attempt to re-authenticate immediately.

Answer

The agent will disable template rendering.

Answer

The agent will stop and exit with an error.

Question 7

You have configured the Vault Agent to authenticate using the Kubernetes auth method. Which parameter is used to point to the service account token file?

Accepted Answer

token_path. In the Vault Agent auto-auth stanza for the Kubernetes auth method, 'token_path' specifies the filesystem path to the service account token that the agent reads and presents to Vault. The default is /var/run/secrets/kubernetes.io/serviceaccount/token, but it can be overridden for projected tokens or custom mounts. This is the parameter the agent uses to locate the JWT for authentication.

Answer

service_account_token

Answer

jwt_path

Answer

token_file

Question 8

If you are using Vault Agent templates to render a file, and the secret contains a newline, how can you ensure the output is correctly formatted in your template?

Accepted Answer

Use the 'indent' function.. The 'indent' function in Consul Template (used by Vault Agent templates) prepends a specified number of spaces to every line of a multi-line string, which is essential when embedding a multi-line secret into an indented YAML, JSON, or config file structure. Without it, subsequent lines of a newline-containing secret would break the surrounding indentation and produce invalid output. Using 'indent N' ensures each line of the secret is properly aligned within the target document.

Answer

Use the 'raw' function.

Answer

Use the 'base64' function.

Answer

It is not possible to render multiline secrets.

Question 9

Which THREE features does the Vault Agent 'cache' block provide?

Accepted Answer

Load balancing. Vault Agent caching provides request response caching, token caching, and allows for improved performance.

Answer

Secret rotation

Answer

Data encryption

Question 10

Which THREE configuration options are valid within the 'template' block?

Accepted Answer

destination. In a Consul Template `template` block, the `source` option (D) specifies the path to the template file on disk that will be rendered, and it is a valid and commonly required setting. The `destination` option (B) specifies the file path where the rendered output is written, which is also a valid key inside the `template` block. The `perms` option (E) sets the Unix file permissions (e.g., 0644) applied to the rendered destination file, and it is likewise a valid configuration option. The unmarked options do not belong: `command` (A) is specified at the top level or in a `command` block rather than inside `template`, and `version` (C) is not a recognized key within the `template` block.

Answer

command

Answer

version

Question 11

When configuring Vault Agent auto-auth with TLS, where should you place the CA certificate file?

Accepted Answer

In the 'tls_ca_cert' parameter.. When configuring Vault Agent auto-auth with TLS, the CA certificate file is specified in the tls_ca_cert parameter within the auto_auth stanza's method or the vault stanza. This parameter tells Vault Agent which CA certificate to use when verifying the Vault server's TLS certificate during the auto-auth login process. Placing it in tls_ca_cert ensures the agent trusts the server's certificate chain before sending authentication credentials.

Answer

As an environment variable.

Answer

In the 'cache' block.

Answer

In the 'listener' block.

Question 12

Which THREE parameters are available in the 'vault' (top-level) block?

Accepted Answer

tls_skip_verify. The top-level 'vault' block in the Vault provider configuration accepts connection-related arguments, and tls_skip_verify (A) is valid there because it disables TLS certificate verification for the Vault endpoint, which is a provider-level setting. address (D) is correct because it specifies the URI of the Vault server (e.g., https://vault.example.com:8200) and is the primary top-level connection parameter. ca_cert (E) is also correct since it provides the path to a PEM-encoded CA certificate file used to verify the Vault server's TLS certificate, another top-level connection argument. Options B (method) and C (role) are not top-level 'vault' block parameters; they belong to authentication-related blocks such as 'auth_login' (e.g., method and namespace) or 'auth_backend'/'approle' configurations where role_id and secret_id are used, so they do not belong in the top-level block.

Answer

method

Answer

role

Question 13

Which THREE functions are available for use within Vault Agent templates?

Accepted Answer

scratch. In Vault Agent templates, the `scratch` function (A) is available to create and pass temporary variables between templates without persisting them to Vault, which is useful for intermediate computation. The `secret` function (D) is the core function that retrieves a secret from a Vault path (e.g., `{{ with secret "secret/data/foo" }}`) and exposes its data for rendering. The `metadata` function (E) is also available and returns metadata about a secret, such as its lease duration, renewal status, and version, which templates can use for conditional logic. Options B (`encrypt`) and C (`rotate`) are not template functions; encryption and key rotation are Vault operations performed via the API, CLI, or transit secrets engine, not Consul Template functions available inside Vault Agent templates.

Answer

encrypt

Answer

rotate

Question 14

You are running Vault Agent on a hardened Linux host that has no writable filesystem locations except /var/run/vault-agent. Auto-auth uses AppRole with a wrapped secret_id delivered by your orchestrator. The agent must renew its token and run a child process that consumes the token from a file. Which combination of listener and auto_auth sink configuration is required for the child process to read the token?

Accepted Answer

Configure a listener block of type unix with address "/var/run/vault-agent/agent.sock" and an auto_auth sink of type file with config { path = "/var/run/vault-agent/token" }.. The child process needs a token file, which only an auto_auth sink of type file produces, and the agent API needs a local endpoint, which a unix listener provides. Both must be placed under the sole writable directory. The unix listener avoids opening a network port, and the file sink writes the token with restrictive permissions by default.

Answer

Configure a listener block of type tcp with address "127.0.0.1:8200" and no sink, relying on the default token file written to the agent's working directory.

Answer

Configure a listener block of type unix with address "/var/run/vault-agent/agent.sock" and an auto_auth sink of type file with config { path = "/var/run/vault-agent/token", mode = "0644" }.

Answer

Configure a listener block of type unix with address "/var/run/vault-agent/agent.sock" and set the auto_auth method's config to write the token directly to /var/run/vault-agent/token.

Question 15

You are deploying Vault Agent on a VM to render a database credential into an application config file. The application reads the file only at startup, and you want the agent to write the file once and not rewrite it on every secret rotation to avoid triggering unnecessary reloads. Which template stanza setting accomplishes this?

Accepted Answer

Set static_secret_render_interval = "0s" in the template_config stanza so the agent renders static secrets once and does not re-render them.. The template_config stanza governs template rendering behavior globally. Setting static_secret_render_interval to 0s tells the agent not to periodically re-render static secrets, so the destination file is written once. This suits applications that read configuration only at startup and would otherwise be disrupted by repeated file rewrites on every rotation cycle.

Answer

Set exit_after_auth = true in the template stanza so the agent stops after rendering the first secret.

Answer

Set error_on_missing_key = true in the template stanza so rendering fails if the secret key is absent.

Answer

Set change_mode = "noop" in the template stanza so the agent does not execute any command when the rendered file changes.

Question 16

You are running Vault Agent on a set of application servers behind an Auto Scaling group. Each agent uses auto-auth with the AWS auth method and writes its token to a sink file. During an autoscaling event, new instances start, but the agent on the new instances fails to obtain a token because the IAM role attached to the instance is not yet recognized by Vault. You need the agent to retry authentication automatically without restarting the agent process. Which configuration parameter in the auto_auth stanza should you adjust?

Accepted Answer

configure the 'retry' stanza with 'num_retries' and 'backoff' settings. The auto_auth stanza's retry block allows the agent to handle transient authentication failures by retrying with a backoff. In this scenario, the IAM role propagation delay causes the initial auth to fail; configuring retries ensures the agent eventually succeeds without manual restarts. Other parameters like exit_after_auth, token_ttl, or cache backoff do not influence the auto-auth retry logic.

Answer

set 'max_backoff' in the cache stanza to a higher value

Answer

increase the 'token_ttl' in the auto_auth method configuration

Answer

set the 'exit_after_auth' parameter to false

Question 17

You are configuring Vault Agent with a template that renders a database connection string from a KV v2 secret. The secret contains a password with special characters. The rendered file is consumed by an application that requires the password to be URL-encoded. Which template function should you use to ensure the password is properly encoded?

Accepted Answer

urlencode. The urlencode function in Vault Agent templates applies percent-encoding, which is the standard for embedding special characters in URLs. A database connection string often requires the password to be URL-encoded to avoid parsing errors. Other functions like urlquery, base64Encode, or toJSON either use a different encoding scheme or transform the data in ways that are incompatible with the application's expectations.

Answer

urlquery

Answer

base64Encode

Answer

toJSON

Question 18

An operations team runs Vault Agent on a fleet of web servers. They want the agent to keep a rendered TLS certificate file updated as the secret rotates, and they want the agent to restart the web service only when the certificate content actually changes. Which template stanza parameter should they configure to achieve the restart behavior?

Accepted Answer

change_mode = "restart". Template stanzas use change_mode to decide the action taken when the rendered file content changes. The "restart" value restarts the process defined in the exec block, and the agent only triggers this when the content differs from the previous render. Other parameters like change_signal or error_on_missing_key do not initiate restarts, and exec alone does not define the trigger.

Answer

exec { command = "systemctl restart web" }

Answer

change_signal = "SIGUSR1"

Answer

error_on_missing_key = true

Question 19

You are deploying Vault Agent on a set of application servers behind a load balancer. The applications must obtain a database credential from a dynamic secrets engine, and you want the credential to be proactively renewed before it expires so the application never sees a stale credential. Which Vault Agent configuration block should you use to achieve this?

Accepted Answer

template with a renew loop. The template block supports a renewal loop that periodically renews the secret and re-renders the output, so the application always has a valid credential. Other blocks handle authentication or caching but do not actively renew dynamic secrets. Using a template with a renewal loop is the correct way to keep a dynamic database credential fresh for the application.

Answer

template

Answer

cache

Answer

auto_auth

Question 20

You are deploying a Vault Agent on a set of application servers that must authenticate to Vault Enterprise using the AWS auth method. The servers have IAM roles attached. You need to ensure the agent auto-authenticates without embedding static credentials. Which configuration block should you use?

Accepted Answer

auto_auth { method { type = "aws" config { role = "app-role" type = "iam" } } }. The AWS auth method in Vault Agent requires specifying the Vault role and the credential type. For servers with IAM roles, the 'iam' type instructs the agent to use the IAM credentials to sign the login request. This avoids static secrets and leverages the existing IAM role.

Answer

auto_auth { method { type = "aws" config { role = "app-role" } } }

Answer

auto_auth { method { type = "aws" config { role_id = "app-role" secret_id = "..." } } }

Answer

auto_auth { method { type = "aws" config { role = "app-role" type = "ec2" } } }