Vault Enterprise Vault Security Model — 20 Questions

Question 1

You are using the Kubernetes Auth method and want to restrict a role so that it can only be used by pods in a specific namespace. How do you implement this constraint?

Accepted Answer

Define the 'bound_namespaces' parameter in the Vault role configuration.. When creating a role in the Kubernetes auth method, the 'bound_namespaces' field is used to restrict the role to specific Kubernetes namespaces.

Answer

Set the 'allowed_namespaces' policy on the service account.

Answer

Apply a Vault namespace to the Kubernetes pod manifest.

Answer

Use a regex in the 'token_policies' field to filter by namespace.

Question 2

In a hardened Kubernetes environment, you are using the Vault Agent injector. You want to make sure that the Vault-issued token is automatically renewed by the agent. Which annotation is required in the deployment manifest?

Accepted Answer

vault.hashicorp.com/agent-inject: 'true'. The 'vault.hashicorp.com/agent-inject' annotation is required, and renewal is handled by the agent process running as a sidecar.

Answer

vault.hashicorp.com/auto-renew: 'true'

Answer

vault.hashicorp.com/token-renewal: 'enabled'

Answer

vault.hashicorp.com/k8s-auth: 'true'

Question 3

When configuring the Kubernetes Auth Method, which THREE of the following are required to ensure secure communication between Vault and the Kubernetes API server?

Accepted Answer

The 'kubernetes_host' address.. Option B is correct because the 'kubernetes_host' parameter specifies the Kubernetes API server's address (e.g., https://kubernetes.default.svc or the cluster endpoint) that Vault contacts to perform TokenReview and SubjectAccessReview calls, making it mandatory for the auth method to function. Option D is correct because the 'reviewer_service_account_jwt' is the JWT of a service account with permissions to call the Kubernetes TokenReview API, which Vault uses to validate incoming client JWTs and verify their authenticity. Option E is correct because the 'kubernetes_ca_cert' provides the CA certificate used to validate the TLS certificate presented by the Kubernetes API server, preventing man-in-the-middle attacks and ensuring secure, trusted communication. Option A is incorrect because Vault authenticates to the Kubernetes API using service account tokens and TLS, not SSH keys belonging to nodes. Option C is incorrect because Vault does not require a list of pod IP addresses; it validates tokens via the API server rather than by IP allowlisting.

Answer

The Kubernetes node's SSH private key.

Answer

A list of all pod IP addresses.

Question 4

You are designing a secure Vault Enterprise deployment that uses namespaces to isolate teams. You need to ensure that a token created in one namespace cannot be used to access secrets in another namespace, even if the token has a high privilege level within its own namespace. Which TWO of the following statements are correct regarding namespace isolation and token usage? (Choose two.)

Accepted Answer

Tokens are always scoped to the namespace in which they were created and cannot be used in child namespaces unless explicitly authorized.. Tokens in Vault Enterprise are strictly scoped to their namespace. A token from one namespace cannot be used in another unless it is explicitly authorized through namespace paths or reissued in the target namespace. This design enforces isolation and prevents lateral movement between teams. Understanding these boundaries is crucial for secure multi-tenant deployments.

Answer

A token created in a child namespace can be used to access secrets in the parent namespace if the parent namespace's policies allow it.

Answer

Namespace isolation can be bypassed by using a token with the 'sudo' capability on the 'sys/namespaces' path.

Answer

A root token in a parent namespace can access all child namespaces without additional policies.

Question 5

You are configuring a Vault Enterprise cluster to use Integrated Storage (Raft) and want to enable automatic unsealing using a cloud KMS. After configuring the seal stanza with the appropriate KMS parameters, you restart Vault. Upon startup, Vault logs indicate that it is unable to decrypt the root key. Which of the following is the most likely reason?

Accepted Answer

The Vault cluster was initialized with Shamir seals and then reconfigured for auto-unseal without migrating the root key.. Auto-unseal requires that the seal configuration used during initialization matches the one used for unseal. If a cluster is initialized with Shamir seals and later switched to auto-unseal without migrating the root key, Vault cannot decrypt the root key because it is still protected by Shamir shares. The root key must be migrated using the 'vault operator unseal' migration process.

Answer

The Vault node is not able to reach the KMS endpoint due to network restrictions.

Answer

The KMS key used for auto-unseal was rotated without updating the seal stanza.

Answer

The KMS key policy does not grant the Vault service account the 'encrypt' permission.

Question 6

A Vault Enterprise administrator needs to ensure that a token issued to a batch job expires automatically after 30 minutes of continuous use, even if the job is still running. The token should not be renewable. Which token parameter should be configured when creating the token?

Accepted Answer

ttl. The ttl parameter sets the token's lifetime, and when combined with a non-renewable token, it ensures the token expires after the specified duration. The other parameters either set a hard cap (explicit_max_ttl), allow indefinite renewal (period), or limit usage count (num_uses), none of which fulfill the requirement of expiring after 30 minutes of continuous use.

Answer

explicit_max_ttl

Answer

period

Answer

num_uses

Question 7

A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the 'engineering' namespace and wants to ensure that the token cannot be used to access secrets in the 'finance' namespace. Which statement about token scope in Vault Enterprise namespaces is correct?

Accepted Answer

Tokens are scoped to the namespace where they are created and cannot access other namespaces.. Tokens in Vault Enterprise are strictly scoped to the namespace in which they are created. They cannot be used to access secrets or perform operations in other namespaces, regardless of policies. This isolation is fundamental to the namespace feature, which allows secure multi-tenancy. The other options incorrectly suggest that tokens can cross namespace boundaries under certain conditions.

Answer

Tokens are global and can access any namespace if the policy allows.

Answer

Tokens can access child namespaces but not sibling or parent namespaces.

Answer

Tokens can be used across namespaces only if they have a policy with a wildcard path.

Question 8

A Vault Enterprise administrator is configuring a secrets engine to use response wrapping to securely distribute credentials to a trusted application. The application will unwrap the token to retrieve the secret. Which two statements about response wrapping are true? (Choose two.)

Accepted Answer

The wrapping TTL determines how long the wrapped token remains valid before it expires.. Response wrapping is a secure way to deliver secrets. The wrapped token is single-use by default, and it expires after the wrapping TTL. These properties ensure that the secret is only accessible once and within a limited time. The other statements are false: multiple unwraps are not default, the wrapped token does not grant broader access, and no special policy is required for unwrapping.

Answer

Response wrapping requires the client to have a policy that allows unwrapping.

Answer

The wrapped token can be unwrapped multiple times if the wrapping TTL is long enough.

Answer

The wrapped token can be used to access any secrets that the original token could access.

Question 9

A security team is configuring a Vault Enterprise cluster to use a Hardware Security Module (HSM) for seal wrapping and auto-unseal. During testing, they notice that the HSM is being used for seal wrapping, but the cluster still requires manual unseal after a restart. Which configuration issue is most likely causing this?

Accepted Answer

The HSM is configured for seal wrapping but not for auto-unseal in the seal stanza.. For HSM auto-unseal to work, the seal stanza must be configured to enable auto-unseal. Seal wrapping can be enabled independently, but auto-unseal requires the appropriate configuration. Without it, Vault will still require manual unseal even if seal wrapping is active.

Answer

The HSM's key label does not match the 'key_label' specified in the seal stanza.

Answer

The HSM's seal wrapping key is not marked as exportable.

Answer

The 'disable_mlock' option is set to true in the Vault configuration.

Question 10

A Vault Enterprise administrator is configuring a secrets engine to use a root token for initial setup. After completing the setup, they revoke the root token. Later, they discover that a child token created from the root token still has access to the secrets engine. Why does this occur?

Accepted Answer

The child token was created with the 'orphan' flag, making it independent of the parent.. Orphan tokens are created without a parent and are not revoked when the creating token is revoked. This allows them to persist independently, which can be a security risk if not managed properly. In this scenario, the child token likely had the orphan flag set.

Answer

Child tokens are not automatically revoked when the parent token is revoked.

Answer

The child token was created with a longer TTL than the root token, so it outlives the parent.

Answer

The secrets engine was mounted with the 'delegated' option, granting persistent access.

Question 11

A Vault Enterprise administrator is configuring a new auth method for an application. The application runs on a server that has a fixed IP address. The security policy requires that the authentication token issued to the application be limited to a maximum of 10 uses and must be renewable up to a maximum TTL of 24 hours. Which combination of role parameters should be set to enforce these requirements?

Accepted Answer

token_num_uses=10, token_ttl=1h, and token_max_ttl=24h. To enforce a maximum of 10 uses, set token_num_uses=10. To allow renewal up to a maximum TTL of 24 hours, set token_ttl to a value less than 24h (e.g., 1h) and token_max_ttl to 24h. The token_ttl determines the initial lease duration and renewal increment, while token_max_ttl caps the total lifetime. This ensures the token can be renewed but not beyond 24 hours. Other options either omit token_max_ttl or use token_period, which allows indefinite renewal.

Answer

token_num_uses=10 and token_max_ttl=24h

Answer

token_num_uses=10 and token_ttl=24h

Answer

token_num_uses=10 and token_period=24h

Question 12

A security engineer is reviewing the configuration of a Vault Enterprise cluster that uses the Transit secrets engine to encrypt data. The engineer needs to ensure that the encryption keys are protected against unauthorized access and that cryptographic operations are audited. Which two actions should the engineer take to enhance the security of the Transit secrets engine? (Choose two.)

Accepted Answer

Restrict access to the Transit secrets engine by using Vault policies that limit which tokens can perform encrypt and decrypt operations.. The two actions that enhance security are enabling audit logging and restricting access with Vault policies. Audit logging provides a record of all cryptographic operations, which is essential for detecting unauthorized use. Restricting access ensures that only authorized tokens can perform encryption and decryption, following the principle of least privilege. The other options either are not supported (BYOK), may weaken security (convergent encryption), or do not directly address the stated requirements (key length).

Answer

Enable the Transit secrets engine's 'convergent encryption' mode to ensure that identical plaintexts produce the same ciphertext.

Answer

Configure the Transit secrets engine to use a customer-supplied encryption key (BYOK) stored in an HSM.

Answer

Set the Transit secrets engine to use a longer key length, such as 4096-bit RSA keys, for all encryption operations.

Question 13

A Vault administrator is configuring a new auth method and wants to ensure that tokens issued by this method have a maximum lifetime of 24 hours, regardless of the token's requested TTL. Which parameter should be set on the auth method's role?

Accepted Answer

token_max_ttl. To enforce a maximum lifetime for tokens issued by an auth method role, token_max_ttl is the appropriate parameter. It caps the total lifetime of the token, ensuring it cannot be renewed beyond that point. This meets the requirement of a 24-hour maximum.

Answer

token_explicit_max_ttl

Answer

token_period

Answer

token_ttl

Question 14

A Vault Enterprise administrator is configuring a new policy for a team of developers. The policy should allow the developers to read secrets from the 'secret/data/dev' path but prevent them from deleting or modifying any secrets. Which policy statement correctly achieves this?

Accepted Answer

path "secret/data/dev/*" { capabilities = ["read"] }. The policy statement that grants only the 'read' capability on the path 'secret/data/dev/*' correctly allows reading secrets while preventing any modification or deletion. Other options either add unnecessary capabilities like 'list' or include capabilities like 'update' or 'delete' that violate the requirement. In Vault, capabilities are additive, so granting only 'read' is the precise way to enforce read-only access.

Answer

path "secret/data/dev/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/dev/*" { capabilities = ["read", "delete"] }

Answer

path "secret/data/dev/*" { capabilities = ["read", "update"] }

Question 15

A Vault Enterprise administrator is configuring a new namespace for a team and wants to enforce strict isolation. The team should only be able to create tokens within their namespace, and these tokens must not be able to access resources in other namespaces. Which two configurations are necessary to achieve this? (Choose two.)

Accepted Answer

Use a token role that specifies the 'allowed_policies' to limit which policies can be attached.. To enforce strict namespace isolation, policies must be scoped to the namespace, and token roles must limit which policies can be attached. This prevents tokens from accessing resources outside the namespace. The other options are either invalid or unrelated to namespace isolation.

Answer

Set the 'namespace' parameter on the token role to restrict token creation to the namespace.

Answer

Ensure that the team's tokens are created with the 'no_parent' option to prevent cross-namespace access.

Answer

Enable the 'isolated' flag on the namespace to block all cross-namespace communication.

Question 16

A Vault Enterprise cluster is configured with a performance replication secondary. An administrator creates a new namespace and a policy within that namespace on the primary cluster. The administrator then checks the secondary cluster and finds that the namespace and policy are not present. What is the most likely reason for this?

Accepted Answer

The namespace and policy were created in a mount that is not replicated to the secondary due to a replication filter.. In Vault Enterprise performance replication, replication filters can be used to selectively replicate data. If a filter is set to exclude certain namespaces or mounts, objects created there will not appear on the secondary. The other options are less likely: namespaces and policies are normally replicated, a failed state would be evident, and license discrepancies are rare in a functioning replication setup. Thus, a replication filter is the most probable cause.

Answer

The performance replication secondary is in a failed state and is not receiving updates from the primary.

Answer

Namespaces and policies are not replicated to performance secondary clusters; they must be created manually on each secondary.

Answer

The secondary cluster has a different license that does not support namespaces, so it cannot replicate them.

Question 17

When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?

Accepted Answer

Restricts the generated Vault token to specific IP ranges.. The 'token_bound_cidrs' parameter on a Kubernetes auth role restricts the CIDR ranges from which the Vault token issued by that role may be used. It is embedded into the token at issuance and enforced on every subsequent request, so a token issued to a pod in one subnet cannot be replayed from another subnet. This is the token-side counterpart to 'secret_id_bound_cidrs' in AppRole.

Answer

Restricts the Kubernetes API server access.

Answer

Binds the login process to a specific pod IP.

Answer

Limits the number of simultaneous logins from an IP.

Question 18

An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?

Accepted Answer

Issue a wrapped response for the SecretID with a specific TTL.. Response wrapping delivers the SecretID as a single-use wrapping token with a short TTL, so the SecretID is never exposed in transit or at rest in the application's config. The application unwraps the token via cubbyhole, retrieving the SecretID exactly once, which prevents interception and replay. This is the recommended secure introduction pattern for AppRole.

Answer

Use a global static token for all AppRole authentications.

Answer

Hardcode the SecretID into the application's configuration file.

Answer

Disable the SecretID requirement and use only the RoleID.

Question 19

When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?

Accepted Answer

The contents of the mounted service account token file.. When you run 'vault login -method=kubernetes' from inside a pod, the Vault CLI reads the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token and sends its contents as the JWT to the Vault Kubernetes auth endpoint. Vault then calls the Kubernetes TokenReview API to validate it.

Answer

The pod's hostname.

Answer

The Vault server's Root CA certificate.

Answer

The Kubernetes API server public key.

Question 20

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

Accepted Answer

Response Wrapping.. Response Wrapping is the Vault feature specifically designed for secure introduction of secrets to dynamic infrastructure. It wraps a response (such as a token) in a single-use, time-limited wrapping token that can be safely delivered to a new VM. The VM then unwraps the token to retrieve the actual secret, ensuring the secret is not exposed in transit or logs.

Answer

LDAP bind credentials.

Answer

Cubbyhole storage.

Answer

Transit Secret Engine.