Vault Enterprise Vault Security Model — Timed 15 Questions

Question 1

You are using the Kubernetes Auth method and want to restrict a role so that it can only be used by pods in a specific namespace. How do you implement this constraint?

Accepted Answer

Define the 'bound_namespaces' parameter in the Vault role configuration.. When creating a role in the Kubernetes auth method, the 'bound_namespaces' field is used to restrict the role to specific Kubernetes namespaces.

Answer

Set the 'allowed_namespaces' policy on the service account.

Answer

Apply a Vault namespace to the Kubernetes pod manifest.

Answer

Use a regex in the 'token_policies' field to filter by namespace.

Question 2

In a hardened Kubernetes environment, you are using the Vault Agent injector. You want to make sure that the Vault-issued token is automatically renewed by the agent. Which annotation is required in the deployment manifest?

Accepted Answer

vault.hashicorp.com/agent-inject: 'true'. The 'vault.hashicorp.com/agent-inject' annotation is required, and renewal is handled by the agent process running as a sidecar.

Answer

vault.hashicorp.com/auto-renew: 'true'

Answer

vault.hashicorp.com/token-renewal: 'enabled'

Answer

vault.hashicorp.com/k8s-auth: 'true'

Question 3

When configuring the Kubernetes Auth Method, which THREE of the following are required to ensure secure communication between Vault and the Kubernetes API server?

Accepted Answer

The 'kubernetes_host' address.. Option B is correct because the 'kubernetes_host' parameter specifies the Kubernetes API server's address (e.g., https://kubernetes.default.svc or the cluster endpoint) that Vault contacts to perform TokenReview and SubjectAccessReview calls, making it mandatory for the auth method to function. Option D is correct because the 'reviewer_service_account_jwt' is the JWT of a service account with permissions to call the Kubernetes TokenReview API, which Vault uses to validate incoming client JWTs and verify their authenticity. Option E is correct because the 'kubernetes_ca_cert' provides the CA certificate used to validate the TLS certificate presented by the Kubernetes API server, preventing man-in-the-middle attacks and ensuring secure, trusted communication. Option A is incorrect because Vault authenticates to the Kubernetes API using service account tokens and TLS, not SSH keys belonging to nodes. Option C is incorrect because Vault does not require a list of pod IP addresses; it validates tokens via the API server rather than by IP allowlisting.

Answer

The Kubernetes node's SSH private key.

Answer

A list of all pod IP addresses.

Question 4

You are designing a secure Vault Enterprise deployment that uses namespaces to isolate teams. You need to ensure that a token created in one namespace cannot be used to access secrets in another namespace, even if the token has a high privilege level within its own namespace. Which TWO of the following statements are correct regarding namespace isolation and token usage? (Choose two.)

Accepted Answer

Tokens are always scoped to the namespace in which they were created and cannot be used in child namespaces unless explicitly authorized.. Tokens in Vault Enterprise are strictly scoped to their namespace. A token from one namespace cannot be used in another unless it is explicitly authorized through namespace paths or reissued in the target namespace. This design enforces isolation and prevents lateral movement between teams. Understanding these boundaries is crucial for secure multi-tenant deployments.

Answer

A token created in a child namespace can be used to access secrets in the parent namespace if the parent namespace's policies allow it.

Answer

Namespace isolation can be bypassed by using a token with the 'sudo' capability on the 'sys/namespaces' path.

Answer

A root token in a parent namespace can access all child namespaces without additional policies.

Question 5

You are configuring a Vault Enterprise cluster to use Integrated Storage (Raft) and want to enable automatic unsealing using a cloud KMS. After configuring the seal stanza with the appropriate KMS parameters, you restart Vault. Upon startup, Vault logs indicate that it is unable to decrypt the root key. Which of the following is the most likely reason?

Accepted Answer

The Vault cluster was initialized with Shamir seals and then reconfigured for auto-unseal without migrating the root key.. Auto-unseal requires that the seal configuration used during initialization matches the one used for unseal. If a cluster is initialized with Shamir seals and later switched to auto-unseal without migrating the root key, Vault cannot decrypt the root key because it is still protected by Shamir shares. The root key must be migrated using the 'vault operator unseal' migration process.

Answer

The Vault node is not able to reach the KMS endpoint due to network restrictions.

Answer

The KMS key used for auto-unseal was rotated without updating the seal stanza.

Answer

The KMS key policy does not grant the Vault service account the 'encrypt' permission.

Question 6

A Vault Enterprise administrator needs to ensure that a token issued to a batch job expires automatically after 30 minutes of continuous use, even if the job is still running. The token should not be renewable. Which token parameter should be configured when creating the token?

Accepted Answer

ttl. The ttl parameter sets the token's lifetime, and when combined with a non-renewable token, it ensures the token expires after the specified duration. The other parameters either set a hard cap (explicit_max_ttl), allow indefinite renewal (period), or limit usage count (num_uses), none of which fulfill the requirement of expiring after 30 minutes of continuous use.

Answer

explicit_max_ttl

Answer

period

Answer

num_uses

Question 7

A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the 'engineering' namespace and wants to ensure that the token cannot be used to access secrets in the 'finance' namespace. Which statement about token scope in Vault Enterprise namespaces is correct?

Accepted Answer

Tokens are scoped to the namespace where they are created and cannot access other namespaces.. Tokens in Vault Enterprise are strictly scoped to the namespace in which they are created. They cannot be used to access secrets or perform operations in other namespaces, regardless of policies. This isolation is fundamental to the namespace feature, which allows secure multi-tenancy. The other options incorrectly suggest that tokens can cross namespace boundaries under certain conditions.

Answer

Tokens are global and can access any namespace if the policy allows.

Answer

Tokens can access child namespaces but not sibling or parent namespaces.

Answer

Tokens can be used across namespaces only if they have a policy with a wildcard path.

Question 8

A Vault Enterprise administrator is configuring a secrets engine to use response wrapping to securely distribute credentials to a trusted application. The application will unwrap the token to retrieve the secret. Which two statements about response wrapping are true? (Choose two.)

Accepted Answer

The wrapping TTL determines how long the wrapped token remains valid before it expires.. Response wrapping is a secure way to deliver secrets. The wrapped token is single-use by default, and it expires after the wrapping TTL. These properties ensure that the secret is only accessible once and within a limited time. The other statements are false: multiple unwraps are not default, the wrapped token does not grant broader access, and no special policy is required for unwrapping.

Answer

Response wrapping requires the client to have a policy that allows unwrapping.

Answer

The wrapped token can be unwrapped multiple times if the wrapping TTL is long enough.

Answer

The wrapped token can be used to access any secrets that the original token could access.

Question 9

A security team is configuring a Vault Enterprise cluster to use a Hardware Security Module (HSM) for seal wrapping and auto-unseal. During testing, they notice that the HSM is being used for seal wrapping, but the cluster still requires manual unseal after a restart. Which configuration issue is most likely causing this?

Accepted Answer

The HSM is configured for seal wrapping but not for auto-unseal in the seal stanza.. For HSM auto-unseal to work, the seal stanza must be configured to enable auto-unseal. Seal wrapping can be enabled independently, but auto-unseal requires the appropriate configuration. Without it, Vault will still require manual unseal even if seal wrapping is active.

Answer

The HSM's key label does not match the 'key_label' specified in the seal stanza.

Answer

The HSM's seal wrapping key is not marked as exportable.

Answer

The 'disable_mlock' option is set to true in the Vault configuration.

Question 10

A Vault Enterprise administrator is configuring a secrets engine to use a root token for initial setup. After completing the setup, they revoke the root token. Later, they discover that a child token created from the root token still has access to the secrets engine. Why does this occur?

Accepted Answer

The child token was created with the 'orphan' flag, making it independent of the parent.. Orphan tokens are created without a parent and are not revoked when the creating token is revoked. This allows them to persist independently, which can be a security risk if not managed properly. In this scenario, the child token likely had the orphan flag set.

Answer

Child tokens are not automatically revoked when the parent token is revoked.

Answer

The child token was created with a longer TTL than the root token, so it outlives the parent.

Answer

The secrets engine was mounted with the 'delegated' option, granting persistent access.

Question 11

A Vault Enterprise administrator is configuring a new auth method for an application. The application runs on a server that has a fixed IP address. The security policy requires that the authentication token issued to the application be limited to a maximum of 10 uses and must be renewable up to a maximum TTL of 24 hours. Which combination of role parameters should be set to enforce these requirements?

Accepted Answer

token_num_uses=10, token_ttl=1h, and token_max_ttl=24h. To enforce a maximum of 10 uses, set token_num_uses=10. To allow renewal up to a maximum TTL of 24 hours, set token_ttl to a value less than 24h (e.g., 1h) and token_max_ttl to 24h. The token_ttl determines the initial lease duration and renewal increment, while token_max_ttl caps the total lifetime. This ensures the token can be renewed but not beyond 24 hours. Other options either omit token_max_ttl or use token_period, which allows indefinite renewal.

Answer

token_num_uses=10 and token_max_ttl=24h

Answer

token_num_uses=10 and token_ttl=24h

Answer

token_num_uses=10 and token_period=24h

Question 12

A security engineer is reviewing the configuration of a Vault Enterprise cluster that uses the Transit secrets engine to encrypt data. The engineer needs to ensure that the encryption keys are protected against unauthorized access and that cryptographic operations are audited. Which two actions should the engineer take to enhance the security of the Transit secrets engine? (Choose two.)

Accepted Answer

Restrict access to the Transit secrets engine by using Vault policies that limit which tokens can perform encrypt and decrypt operations.. The two actions that enhance security are enabling audit logging and restricting access with Vault policies. Audit logging provides a record of all cryptographic operations, which is essential for detecting unauthorized use. Restricting access ensures that only authorized tokens can perform encryption and decryption, following the principle of least privilege. The other options either are not supported (BYOK), may weaken security (convergent encryption), or do not directly address the stated requirements (key length).

Answer

Enable the Transit secrets engine's 'convergent encryption' mode to ensure that identical plaintexts produce the same ciphertext.

Answer

Configure the Transit secrets engine to use a customer-supplied encryption key (BYOK) stored in an HSM.

Answer

Set the Transit secrets engine to use a longer key length, such as 4096-bit RSA keys, for all encryption operations.

Question 13

A Vault administrator is configuring a new auth method and wants to ensure that tokens issued by this method have a maximum lifetime of 24 hours, regardless of the token's requested TTL. Which parameter should be set on the auth method's role?

Accepted Answer

token_max_ttl. To enforce a maximum lifetime for tokens issued by an auth method role, token_max_ttl is the appropriate parameter. It caps the total lifetime of the token, ensuring it cannot be renewed beyond that point. This meets the requirement of a 24-hour maximum.

Answer

token_explicit_max_ttl

Answer

token_period

Answer

token_ttl

Question 14

A Vault Enterprise administrator is configuring a new policy for a team of developers. The policy should allow the developers to read secrets from the 'secret/data/dev' path but prevent them from deleting or modifying any secrets. Which policy statement correctly achieves this?

Accepted Answer

path "secret/data/dev/*" { capabilities = ["read"] }. The policy statement that grants only the 'read' capability on the path 'secret/data/dev/*' correctly allows reading secrets while preventing any modification or deletion. Other options either add unnecessary capabilities like 'list' or include capabilities like 'update' or 'delete' that violate the requirement. In Vault, capabilities are additive, so granting only 'read' is the precise way to enforce read-only access.

Answer

path "secret/data/dev/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/dev/*" { capabilities = ["read", "delete"] }

Answer

path "secret/data/dev/*" { capabilities = ["read", "update"] }

Question 15

A Vault Enterprise administrator is configuring a new namespace for a team and wants to enforce strict isolation. The team should only be able to create tokens within their namespace, and these tokens must not be able to access resources in other namespaces. Which two configurations are necessary to achieve this? (Choose two.)

Accepted Answer

Use a token role that specifies the 'allowed_policies' to limit which policies can be attached.. To enforce strict namespace isolation, policies must be scoped to the namespace, and token roles must limit which policies can be attached. This prevents tokens from accessing resources outside the namespace. The other options are either invalid or unrelated to namespace isolation.

Answer

Set the 'namespace' parameter on the token role to restrict token creation to the namespace.

Answer

Ensure that the team's tokens are created with the 'no_parent' option to prevent cross-namespace access.

Answer

Enable the 'isolated' flag on the namespace to block all cross-namespace communication.