Vault Enterprise Vault Security Model Practice Test 2 — 15 Questions

Question 1

A Vault Enterprise cluster is configured with a performance replication secondary. An administrator creates a new namespace and a policy within that namespace on the primary cluster. The administrator then checks the secondary cluster and finds that the namespace and policy are not present. What is the most likely reason for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The namespace and policy were created in a mount that is not replicated to the secondary due to a replication filter.. In Vault Enterprise performance replication, replication filters can be used to selectively replicate data. If a filter is set to exclude certain namespaces or mounts, objects created there will not appear on the secondary. The other options are less likely: namespaces and policies are normally replicated, a failed state would be evident, and license discrepancies are rare in a functioning replication setup. Thus, a replication filter is the most probable cause.

Answer

The performance replication secondary is in a failed state and is not receiving updates from the primary.

Answer

Namespaces and policies are not replicated to performance secondary clusters; they must be created manually on each secondary.

Answer

The secondary cluster has a different license that does not support namespaces, so it cannot replicate them.

Question 2

When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?

Accepted Answer

Restricts the generated Vault token to specific IP ranges.. The 'token_bound_cidrs' parameter on a Kubernetes auth role restricts the CIDR ranges from which the Vault token issued by that role may be used. It is embedded into the token at issuance and enforced on every subsequent request, so a token issued to a pod in one subnet cannot be replayed from another subnet. This is the token-side counterpart to 'secret_id_bound_cidrs' in AppRole.

Answer

Restricts the Kubernetes API server access.

Answer

Binds the login process to a specific pod IP.

Answer

Limits the number of simultaneous logins from an IP.

Question 3

An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?

Accepted Answer

Issue a wrapped response for the SecretID with a specific TTL.. Response wrapping delivers the SecretID as a single-use wrapping token with a short TTL, so the SecretID is never exposed in transit or at rest in the application's config. The application unwraps the token via cubbyhole, retrieving the SecretID exactly once, which prevents interception and replay. This is the recommended secure introduction pattern for AppRole.

Answer

Use a global static token for all AppRole authentications.

Answer

Hardcode the SecretID into the application's configuration file.

Answer

Disable the SecretID requirement and use only the RoleID.

Question 4

When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?

Accepted Answer

The contents of the mounted service account token file.. When you run 'vault login -method=kubernetes' from inside a pod, the Vault CLI reads the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token and sends its contents as the JWT to the Vault Kubernetes auth endpoint. Vault then calls the Kubernetes TokenReview API to validate it.

Answer

The pod's hostname.

Answer

The Vault server's Root CA certificate.

Answer

The Kubernetes API server public key.

Question 5

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

Accepted Answer

Response Wrapping.. Response Wrapping is the Vault feature specifically designed for secure introduction of secrets to dynamic infrastructure. It wraps a response (such as a token) in a single-use, time-limited wrapping token that can be safely delivered to a new VM. The VM then unwraps the token to retrieve the actual secret, ensuring the secret is not exposed in transit or logs.

Answer

LDAP bind credentials.

Answer

Cubbyhole storage.

Answer

Transit Secret Engine.

Question 6

When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?

Accepted Answer

Configure the 'kubernetes_host' and 'kubernetes_ca_cert' in the auth method configuration.. To enable Vault to verify service account tokens against the Kubernetes TokenReview API, you must configure the Kubernetes auth method with the Kubernetes API host (kubernetes_host) and the CA certificate (kubernetes_ca_cert) so Vault can securely communicate with the API server.

Answer

Enable the 'kubernetes_allow_any_token' flag in the global configuration.

Answer

Create a static secret in Vault that matches the Kubernetes service account name.

Answer

Manually copy the pod's service account token into the Vault server's local keyring.

Question 7

An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?

Accepted Answer

Update the 'secret_id_bound_cidrs' field in the role.. The AppRole role has a dedicated 'secret_id_bound_cidrs' field that restricts which source IP ranges may present a SecretID during login. Setting it to a CIDR list enforces that the SecretID is only usable from those networks, which is precisely the requirement. This is separate from 'token_bound_cidrs', which restricts where the resulting token can be used after login.

Answer

Configure the CIDR block in the 'token_policies'.

Answer

Create a custom sentinel policy for the auth method.

Answer

Update the 'token_bound_cidrs' field in the role.

Question 8

When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?

Accepted Answer

Verify the 'aud' claim in the JWT.. The 'audience' parameter in the Kubernetes auth method configuration specifies the expected 'aud' (audience) claim value in the service account JWT presented by the pod. Vault validates that the token's aud claim matches this configured value before accepting the authentication request, preventing tokens minted for a different audience from being replayed against Vault. This is a defense-in-depth control aligned with the projected service account token feature in Kubernetes 1.21+.

Answer

Restrict access to specific K8s pods.

Answer

Define which namespaces can authenticate.

Answer

Control the maximum token TTL.

Question 9

What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?

Accepted Answer

To define the duration of the authentication session.. The 'token_ttl' setting in an AppRole role definition controls the Time-To-Live (TTL) of the authentication token issued when a client successfully authenticates using that role. It defines how long the resulting Vault token remains valid before expiring, effectively setting the duration of the authentication session. This is distinct from SecretID TTL, RoleID TTL, or master key rotation, which are separate configuration parameters.

Answer

To limit the number of uses for the SecretID.

Answer

To set the expiration of the RoleID.

Answer

To set the rotation period for the Vault master key.

Question 10

You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?

Accepted Answer

Set a different 'kubernetes_host' for each cluster.. Setting a different 'kubernetes_host' for each cluster's auth method configuration ensures that Vault validates service account tokens against the correct Kubernetes API server. The kubernetes_host is the API endpoint Vault uses to verify the token's issuer and audience via TokenReview. If both clusters pointed to the same host, a token from Cluster B could be validated by Cluster A's Vault, enabling cross-cluster authentication.

Answer

Use the same 'kubernetes_ca_cert' for both clusters.

Answer

Enable 'token_bound_cidrs' on the roles.

Answer

Assign different 'token_policies' to the roles.

Question 11

Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?

Accepted Answer

Provide the 'kubernetes_ca_cert' of the K8s API server.. When Vault's Kubernetes auth method validates a service account JWT, it calls the Kubernetes TokenReview API on the configured 'kubernetes_host'. If a TLS-terminating load balancer sits in front of the K8s API server, Vault must trust the certificate chain presented by that endpoint. Supplying 'kubernetes_ca_cert' (the CA that signed the API server / LB certificate) allows Vault to verify the TLS connection to 'kubernetes_host' without disabling verification.

Answer

Map the load balancer IP to the Vault 'cluster_addr'.

Answer

Disable TLS verification in the auth method.

Answer

Import the load balancer's CA into Vault's trust store.

Question 12

Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?

Accepted Answer

Response wrapping.. Response wrapping returns a single-use wrapping token that the client unwraps to retrieve the actual secret or token, so the sensitive credential is never exposed in transit or at rest in the client environment. This is the recommended pattern for securely delivering tokens to automated clients during the Secure Client Introduction phase. It limits exposure because the wrapping token is short-lived and can be unwrapped only once.

Answer

Using a long-lived root token.

Answer

Passing the token as an environment variable.

Answer

Storing the token in a public configuration repo.

Question 13

An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?

Accepted Answer

Destroy the specific SecretID.. Destroying the specific SecretID via vault write auth/approle/role/<role>/secret-id/destroy (or the secret-id-accessor/destroy endpoint) immediately invalidates that SecretID while leaving the RoleID, other SecretIDs, and existing tokens untouched. This is the surgical response to a compromised SecretID.

Answer

Rotate the RoleID.

Answer

Disable the AppRole auth method.

Answer

Delete the entire AppRole.

Question 14

When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?

Accepted Answer

Checking Vault server audit logs.. Vault's audit logs record every request and response, including authentication attempts against the Kubernetes auth method, with details such as the JWT presented, the role requested, and the error returned. When pods fail to authenticate, the audit log is the authoritative source showing exactly why Vault rejected the token — for example, a role mismatch, expired service account token, or failed bound-service-account-claims check.

Answer

Checking the Kubernetes events list.

Answer

Running 'kubectl describe pod'.

Answer

Running 'vault read sys/auth/kubernetes'.

Question 15

You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?

Accepted Answer

Set 'num_uses' to 1.. The 'num_uses' parameter on an AppRole SecretID controls how many times the SecretID can be used to authenticate and retrieve a token. Setting num_uses=1 means the SecretID is consumed on first successful login and cannot be reused, providing single-use semantics. This is the standard way to enforce one-time SecretID usage in AppRole workflows.

Answer

Set 'secret_id_ttl' to 0.

Answer

Set 'token_bound_cidrs' to the client IP.

Answer

Set 'secret_id_no_store' to true.