VA-003 Drag & Drop — 10 Questions

Question 1

Drag and drop the steps to configure Vault's AWS secrets engine to generate IAM credentials into the correct order.

Accepted Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then create a role, then generate IAM credentials, then rotate root credentials.. The correct sequence for configuring Vault's AWS secrets engine to generate IAM credentials is: first enable the AWS secrets engine at a path, then configure the root IAM credentials that Vault will use to interact with AWS, then create a role that defines the permissions for generated credentials, then generate the actual IAM credentials using that role, and finally rotate the root credentials to enhance security. This order ensures that each step's prerequisites are met.

Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then generate IAM credentials, then create a role, then rotate root credentials.

Answer

Enable the AWS secrets engine, then create a role, then configure the root IAM credentials, then generate IAM credentials, then rotate root credentials.

Answer

Configure the root IAM credentials, then enable the AWS secrets engine, then create a role, then generate IAM credentials, then rotate root credentials.

Question 2

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Accepted Answer

Enable AppRole authentication, create a role, retrieve the RoleID, generate a SecretID, then login.. First enable the auth method, then create the role, then retrieve the RoleID, generate a SecretID, and finally login.

Answer

Create a role, enable AppRole authentication, retrieve the RoleID, generate a SecretID, then login.

Answer

Enable AppRole authentication, create a role, generate a SecretID, retrieve the RoleID, then login.

Answer

Enable AppRole authentication, create a role, retrieve the RoleID, login, then generate a SecretID.

Question 3

Drag and drop the steps to perform a Vault disaster recovery using the replication feature into the correct order.

Accepted Answer

Step 1: Initialize clusters, Step 2: Enable primary replication, Step 3: Generate secondary activation token, Step 4: Enable secondary replication, Step 5: Promote secondary to primary if needed. Initialize clusters, enable primary replication, generate token, enable secondary, promote if needed.

Answer

Step 1: Generate secondary activation token, Step 2: Enable primary replication, Step 3: Enable secondary replication, Step 4: Initialize clusters, Step 5: Promote secondary to primary if needed

Answer

Step 1: Enable primary replication, Step 2: Enable secondary replication, Step 3: Initialize clusters, Step 4: Generate secondary activation token, Step 5: Promote secondary to primary if needed

Answer

Step 1: Enable secondary replication, Step 2: Enable primary replication, Step 3: Initialize clusters, Step 4: Generate secondary activation token, Step 5: Promote secondary to primary if needed

Question 4

Drag and drop the steps to set up Vault's Transit secrets engine for encryption/decryption into the correct order.

Accepted Answer

Enable the transit secrets engine, create a key, encrypt data, decrypt data, rotate the key. The correct order is to first enable the Transit secrets engine, then create a key, use the key to encrypt and decrypt data, and finally rotate the key for security. Enabling creates the path, key creation provides the encryption material, and rotation updates the key without interrupting operations.

Answer

Create a key, enable the transit secrets engine, encrypt data, decrypt data, rotate the key

Answer

Enable the transit secrets engine, create a key, rotate the key, encrypt data, decrypt data

Answer

Enable the transit secrets engine, encrypt data, create a key, decrypt data, rotate the key

Question 5

Drag and drop the steps to configure Vault's audit logging to a file into the correct order.

Accepted Answer

Enable audit device, then perform operations to generate log entries, then verify the audit log.. The correct sequence for configuring Vault's audit logging to a file is: first enable the audit device (e.g., 'vault audit enable file file_path=...'), then perform operations (e.g., read/write secrets) to generate audit log entries, and finally verify the log file to confirm entries are being recorded. Common mistakes include enabling after generating logs, verifying too early, or skipping the generation step.

Answer

Perform operations to generate log entries, then enable audit device, then verify the audit log.

Answer

Verify audit log, then enable audit device, then perform operations to generate log entries.

Answer

Enable audit device, then verify the audit log, then perform operations to generate log entries.

Question 6

Drag and drop the steps to configure Vault's database secrets engine with PostgreSQL into the correct order.

Accepted Answer

Enable the database secrets engine, then configure the PostgreSQL connection, then create a role, then generate credentials, and finally revoke the lease.. The correct sequence for configuring Vault's database secrets engine with PostgreSQL is: first enable the secrets engine, then configure the database connection, then create a role that defines the credential generation parameters, then generate credentials, and finally revoke the lease when done. This order ensures all prerequisites are met at each step.

Answer

Configure the PostgreSQL connection, then enable the database secrets engine, then create a role, then generate credentials, and finally revoke the lease.

Answer

Create a role, then configure the PostgreSQL connection, then enable the database secrets engine, then generate credentials, and finally revoke the lease.

Answer

Generate credentials, then create a role, then configure the PostgreSQL connection, then enable the database secrets engine, and finally revoke the lease.

Question 7

Drag and drop the steps to initialize and unseal a Vault server for the first time into the correct order.

Accepted Answer

Start the server, then initialize Vault, then distribute the unseal keys, then unseal the Vault, then verify the status.. The correct sequence for initializing and unsealing a Vault server for the first time is: start the server, initialize Vault (which generates unseal keys), distribute the unseal keys to key holders, unseal the Vault using a threshold of keys, then verify the Vault is unsealed. This ensures proper security and operational readiness.

Answer

Initialize Vault, then start the server, then distribute the unseal keys, then unseal the Vault, then verify the status.

Answer

Start the server, then initialize Vault, then unseal the Vault, then distribute the unseal keys, then verify the status.

Answer

Start the server, then distribute the unseal keys, then initialize Vault, then unseal the Vault, then verify the status.

Question 8

Drag and drop the steps to configure Vault's PKI secrets engine to issue certificates into the correct order.

Accepted Answer

Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate. The correct sequence to configure Vault's PKI secrets engine for issuing certificates is: first enable the PKI secrets engine, then generate a root certificate (self-signed CA), then create a role that defines certificate parameters, and finally issue a certificate using that role. Enabling the engine mounts it at a path, generating the root CA establishes the trust anchor, the role configures certificate properties, and the issuance step produces the actual certificate. Common mistakes include attempting to generate the root or create a role before enabling the engine, or creating the role before generating the root CA, which leads to errors or missing configurations.

Answer

Generate a root certificate, then enable PKI secrets engine, then create a role, then issue a certificate

Answer

Create a role, then enable PKI secrets engine, then generate a root certificate, then issue a certificate

Answer

Enable PKI secrets engine, then create a role, then generate a root certificate, then issue a certificate

Question 9

Drag and drop the steps to create and use a periodic service token in Vault into the correct order.

Accepted Answer

Create role, generate token, use token, renew periodically. First create the role, then generate a token with a TTL, use it, and renew periodically.

Answer

Generate token, create role, use token, renew periodically

Answer

Create role, use token, renew periodically, generate token

Answer

Generate token, use token, renew periodically, create role

Question 10

Drag and drop the steps to set up Vault's Kubernetes auth method into the correct order.

Accepted Answer

Enable the Kubernetes auth method, then configure it with the Kubernetes host and CA cert, then create a role that binds a service account, then deploy a pod using that service account, then verify login using the Vault token.. The correct sequence for setting up Vault's Kubernetes auth method is: enable the auth method, configure it with the Kubernetes API server details, create a role that binds to a service account, deploy a pod using that service account, and finally verify login. This order ensures that each prerequisite is fulfilled before the subsequent step can function correctly.

Answer

Configure the Kubernetes auth method with host and CA cert, then enable it, then create a role, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then create a role, then configure the auth method, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then configure it, then deploy a pod, then create a role, then verify login.