You are using the Kubernetes Auth method and want to restrict a role so that it can only be used by pods in a specific namespace. How do you implement this constraint?
In a hardened Kubernetes environment, you are using the Vault Agent injector. You want to make sure that the Vault-issued token is automatically renewed by the agent. Which annotation is required in the deployment manifest?
When configuring the Kubernetes Auth Method, which THREE of the following are required to ensure secure communication between Vault and the Kubernetes API server?
You are designing a secure Vault Enterprise deployment that uses namespaces to isolate teams. You need to ensure that a token created in one namespace cannot be used to access secrets in another namespace, even if the token has a high privilege level within its own namespace. Which TWO of the following statements are correct regarding namespace isolation and token usage? (Choose two.)
You are configuring a Vault Enterprise cluster to use Integrated Storage (Raft) and want to enable automatic unsealing using a cloud KMS. After configuring the seal stanza with the appropriate KMS parameters, you restart Vault. Upon startup, Vault logs indicate that it is unable to decrypt the root key. Which of the following is the most likely reason?
A Vault Enterprise administrator needs to ensure that a token issued to a batch job expires automatically after 30 minutes of continuous use, even if the job is still running. The token should not be renewable. Which token parameter should be configured when creating the token?
A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the 'engineering' namespace and wants to ensure that the token cannot be used to access secrets in the 'finance' namespace. Which statement about token scope in Vault Enterprise namespaces is correct?
A Vault Enterprise administrator is configuring a secrets engine to use response wrapping to securely distribute credentials to a trusted application. The application will unwrap the token to retrieve the secret. Which two statements about response wrapping are true? (Choose two.)
A security team is configuring a Vault Enterprise cluster to use a Hardware Security Module (HSM) for seal wrapping and auto-unseal. During testing, they notice that the HSM is being used for seal wrapping, but the cluster still requires manual unseal after a restart. Which configuration issue is most likely causing this?
A Vault Enterprise administrator is configuring a secrets engine to use a root token for initial setup. After completing the setup, they revoke the root token. Later, they discover that a child token created from the root token still has access to the secrets engine. Why does this occur?
A Vault Enterprise administrator is configuring a new auth method for an application. The application runs on a server that has a fixed IP address. The security policy requires that the authentication token issued to the application be limited to a maximum of 10 uses and must be renewable up to a maximum TTL of 24 hours. Which combination of role parameters should be set to enforce these requirements?
A security engineer is reviewing the configuration of a Vault Enterprise cluster that uses the Transit secrets engine to encrypt data. The engineer needs to ensure that the encryption keys are protected against unauthorized access and that cryptographic operations are audited. Which two actions should the engineer take to enhance the security of the Transit secrets engine? (Choose two.)
A Vault administrator is configuring a new auth method and wants to ensure that tokens issued by this method have a maximum lifetime of 24 hours, regardless of the token's requested TTL. Which parameter should be set on the auth method's role?
A Vault Enterprise administrator is configuring a new policy for a team of developers. The policy should allow the developers to read secrets from the 'secret/data/dev' path but prevent them from deleting or modifying any secrets. Which policy statement correctly achieves this?
A Vault Enterprise administrator is configuring a new namespace for a team and wants to enforce strict isolation. The team should only be able to create tokens within their namespace, and these tokens must not be able to access resources in other namespaces. Which two configurations are necessary to achieve this? (Choose two.)
A Vault Enterprise cluster is configured with a performance replication secondary. An administrator creates a new namespace and a policy within that namespace on the primary cluster. The administrator then checks the secondary cluster and finds that the namespace and policy are not present. What is the most likely reason for this?
An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?
You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?
When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?
An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?
You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?
Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?
An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?
When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?
You are configuring a Vault Enterprise cluster to use a hardware security module (HSM) for seal wrapping and auto-unseal. During testing, you notice that after a node restarts, Vault still requires manual unseal despite the HSM being available. You have verified that the HSM is reachable and the seal stanza is correctly configured. Which of the following is the most likely cause?
A Vault Enterprise administrator is configuring a new auth method to authenticate an on-premises application that cannot present a platform identity. The administrator wants to ensure that the initial authentication can only be performed once per login attempt and that the authentication material is bound to the application's network location. Which AppRole role configuration should the administrator apply to achieve these requirements?
A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the `team-a` namespace with a policy that grants read access to `secret/data/team-a/*`. The administrator then uses this token to read a secret at `secret/data/team-b/config` in the `team-b` namespace. What is the outcome?
A security team is reviewing the configuration of a Vault Enterprise cluster that uses the Transit secrets engine for encryption as a service. They want to ensure that the encryption keys are protected against unauthorized export and that cryptographic operations are audited. Which two configurations should they implement? (Choose two.)
An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for seal wrapping and auto-unseal. After enabling the HSM, the administrator notices that the Vault cluster fails to start, reporting that the seal wrap key cannot be retrieved. Which configuration step is most likely missing?
An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for auto-unseal. The HSM supports PKCS#11. After configuring the seal stanza, Vault fails to start. Which action should the administrator take to troubleshoot the issue?
A Vault Enterprise operator has just enabled the Transit secrets engine in a namespace dedicated to a payment processing team. The team stores encryption keys in Transit and uses them to encrypt customer credit card data before writing it to an external database. An auditor asks the operator to prove that the plaintext of those credit card numbers never leaves the Vault server. Which property of the Transit secrets engine supports this claim?
A Vault administrator is configuring a new auth method and wants to ensure that the auth method's configuration is protected from unauthorized changes. Which Vault feature should be used to control access to the auth method configuration endpoints?
A security team is reviewing how Vault Enterprise tokens are bound to their origin. They observe that a batch token issued by an auth method in one performance standby node is presented to a different performance standby node and is accepted. They want to understand why this behavior is expected and what security property batch tokens lack compared to service tokens. Which statement correctly describes batch tokens in Vault Enterprise?
An operator is troubleshooting a Vault Enterprise cluster where audit logs show that a token was used from an unexpected IP address. The security team wants to enforce that a particular token can only be used from the corporate CIDR block 10.0.0.0/8. Which Vault token parameter should be set to achieve this?
An administrator is configuring a Vault Enterprise cluster with Integrated Storage (Raft). They want to ensure that the cluster can automatically recover from a full restart without manual unseal steps, while still protecting the master key. They have deployed a supported cloud KMS. Which configuration should they use?
A Vault Enterprise administrator is reviewing the security of a new auth method that will be used by external partners. The partners will authenticate from their own networks and will receive tokens with a limited set of policies. The administrator wants to ensure that if a token is stolen, the blast radius is minimized. Which TWO controls should be applied to the auth role to reduce the impact of a stolen token? (Choose two.)
A Vault Enterprise cluster is configured with a performance standby and a disaster recovery (DR) replica. The administrator wants to ensure that if the primary cluster fails, the DR replica can be promoted and clients can continue to access secrets without re-authenticating. Which statement about token replication is true?