Vault Enterprise Vault Security Model — 25 Questions

Question 1

In a hardened Kubernetes environment, you are using the Vault Agent injector. You want to make sure that the Vault-issued token is automatically renewed by the agent. Which annotation is required in the deployment manifest?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vault.hashicorp.com/agent-inject: 'true'. The 'vault.hashicorp.com/agent-inject' annotation is required, and renewal is handled by the agent process running as a sidecar.

Answer

vault.hashicorp.com/auto-renew: 'true'

Answer

vault.hashicorp.com/token-renewal: 'enabled'

Answer

vault.hashicorp.com/k8s-auth: 'true'

Question 2

When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?

Accepted Answer

Restricts the generated Vault token to specific IP ranges.. This restricts the resulting token to only be usable from the specified CIDR ranges, providing an additional layer of security after authentication.

Answer

Restricts the Kubernetes API server access.

Answer

Binds the login process to a specific pod IP.

Answer

Limits the number of simultaneous logins from an IP.

Question 3

You are using the Kubernetes Auth method and want to restrict a role so that it can only be used by pods in a specific namespace. How do you implement this constraint?

Accepted Answer

Define the 'bound_namespaces' parameter in the Vault role configuration.. When creating a role in the Kubernetes auth method, the 'bound_namespaces' field is used to restrict the role to specific Kubernetes namespaces.

Answer

Set the 'allowed_namespaces' policy on the service account.

Answer

Apply a Vault namespace to the Kubernetes pod manifest.

Answer

Use a regex in the 'token_policies' field to filter by namespace.

Question 4

An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?

Accepted Answer

Issue a wrapped response for the SecretID with a specific TTL.. Using Response Wrapping with a short TTL provides a single-use token that ensures the SecretID is only accessible by the intended recipient.

Answer

Use a global static token for all AppRole authentications.

Answer

Hardcode the SecretID into the application's configuration file.

Answer

Disable the SecretID requirement and use only the RoleID.

Question 5

When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?

Accepted Answer

The contents of the mounted service account token file.. The Vault client automatically reads the JWT from /var/run/secrets/kubernetes.io/serviceaccount/token in the pod.

Answer

The pod's hostname.

Answer

The Vault server's Root CA certificate.

Answer

The Kubernetes API server public key.

Question 6

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

Accepted Answer

Response Wrapping.. Vault's 'Response Wrapping' allows for a secure, one-time introduction of a token to a client, which is essential for dynamic infrastructure.

Answer

LDAP bind credentials.

Answer

Cubbyhole storage.

Answer

Transit Secret Engine.

Question 7

When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?

Accepted Answer

Configure the 'kubernetes_host' and 'kubernetes_ca_cert' in the auth method configuration.. The 'kubernetes_host' and the 'kubernetes_ca_cert' must be correctly configured in the auth/kubernetes/config endpoint for Vault to communicate securely with the API server.

Answer

Enable the 'kubernetes_allow_any_token' flag in the global configuration.

Answer

Create a static secret in Vault that matches the Kubernetes service account name.

Answer

Manually copy the pod's service account token into the Vault server's local keyring.

Question 8

An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?

Accepted Answer

Update the 'secret_id_bound_cidrs' field in the role.. The 'secret_id_bound_cidrs' parameter allows you to restrict where a SecretID can be used.

Answer

Configure the CIDR block in the 'token_policies'.

Answer

Create a custom sentinel policy for the auth method.

Answer

Update the 'token_bound_cidrs' field in the role.

Question 9

When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?

Accepted Answer

Verify the 'aud' claim in the JWT.. The 'audience' field specifies the expected audience of the JWT, which helps in preventing token reuse attacks across different services.

Answer

Restrict access to specific K8s pods.

Answer

Define which namespaces can authenticate.

Answer

Control the maximum token TTL.

Question 10

What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?

Accepted Answer

To define the duration of the authentication session.. The 'token_ttl' sets the initial time-to-live for the tokens generated by that role, ensuring tokens are short-lived by default.

Answer

To limit the number of uses for the SecretID.

Answer

To set the expiration of the RoleID.

Answer

To set the rotation period for the Vault master key.

Question 11

You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?

Accepted Answer

Set a different 'kubernetes_host' for each cluster.. You must ensure that each Vault instance is configured with the correct 'kubernetes_host' and its own unique 'kubernetes_ca_cert' for the specific K8s cluster it is meant to trust.

Answer

Use the same 'kubernetes_ca_cert' for both clusters.

Answer

Enable 'token_bound_cidrs' on the roles.

Answer

Assign different 'token_policies' to the roles.

Question 12

Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?

Accepted Answer

Provide the 'kubernetes_ca_cert' of the K8s API server.. You must provide the 'kubernetes_ca_cert' that the Kubernetes API server uses to sign its tokens, so Vault can verify them.

Answer

Map the load balancer IP to the Vault 'cluster_addr'.

Answer

Disable TLS verification in the auth method.

Answer

Import the load balancer's CA into Vault's trust store.

Question 13

Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?

Accepted Answer

Response wrapping.. Response wrapping ensures that the token is not visible in cleartext in logs or process lists during delivery.

Answer

Using a long-lived root token.

Answer

Passing the token as an environment variable.

Answer

Storing the token in a public configuration repo.

Question 14

An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?

Accepted Answer

Destroy the specific SecretID.. Destroying the SecretID through the API effectively invalidates it, preventing any new tokens from being issued via that specific SecretID.

Answer

Rotate the RoleID.

Answer

Disable the AppRole auth method.

Answer

Delete the entire AppRole.

Question 15

When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?

Accepted Answer

Checking Vault server audit logs.. The Vault server logs (at 'debug' level) will show the specific error returned by the Kubernetes TokenReview API.

Answer

Checking the Kubernetes events list.

Answer

Running 'kubectl describe pod'.

Answer

Running 'vault read sys/auth/kubernetes'.

Question 16

You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?

Accepted Answer

Set 'num_uses' to 1.. The 'num_uses' parameter allows you to restrict a SecretID to a specific number of authentication attempts (in this case, 1).

Answer

Set 'secret_id_ttl' to 0.

Answer

Set 'token_bound_cidrs' to the client IP.

Answer

Set 'secret_id_no_store' to true.

Question 17

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

Accepted Answer

Use the Vault Agent injector for automatic sidecar management.. Short TTLs, CIDR binding, and using the agent injector all minimize the risk and blast radius of token theft.

Answer

Disable audit logging to increase performance.

Answer

Use the 'root' token for the application.

Question 18

Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?

Accepted Answer

It allows wildcards to match multiple service accounts.. It restricts authentication to specific service accounts and prevents unauthorized service accounts from assuming the role.

Answer

It can only be applied to cluster-admin accounts.

Answer

It replaces the need for Vault policies.

Answer

It is optional if 'bound_namespaces' is set.

Question 19

When configuring the Kubernetes Auth Method, which THREE of the following are required to ensure secure communication between Vault and the Kubernetes API server?

Accepted Answer

The 'kubernetes_host' address.. The host address, the CA certificate, and the token for the reviewer account are mandatory for the TokenReview API communication.

Answer

The Kubernetes node's SSH private key.

Answer

A list of all pod IP addresses.

Question 20

In the context of the Vault Kubernetes Auth Method, what is the role of the 'reviewer_service_account'?

Accepted Answer

It is the account Vault uses to verify client tokens.. The 'reviewer_service_account' is the service account that Vault uses to perform the 'TokenReview' request against the Kubernetes API.

Answer

It is the account that logs in to Vault.

Answer

It is the account that manages K8s secrets.

Answer

It is an administrative account used to manage Vault roles.