Access Control Configuration

An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?

Which THREE features are specific to Vault Enterprise when managing access control?

What is the effect of setting 'token_ttl' on a Role?

What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

A security engineer is configuring Vault Enterprise to allow an application to authenticate using AppRole. The application will run on a server that has a unique role ID and secret ID. The engineer wants to ensure that the secret ID can be used only once and expires after 24 hours. Which AppRole role configuration parameters should be set to achieve this?

What is the function of an Identity Alias in Vault?

A Vault Enterprise administrator needs to delegate the management of a specific secrets engine to a team. The team should be able to create, update, and delete roles within the 'database' secrets engine but should not be able to modify the secrets engine's configuration or access other secrets engines. Which policy should the administrator create?

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

A Vault Enterprise administrator is configuring a new namespace for a subsidiary company. The subsidiary requires that only users authenticated via their corporate LDAP can access secrets in the namespace. Additionally, the subsidiary's security team must be able to manage policies and auth methods within the namespace but should not have access to the root namespace. Which combination of Vault Enterprise features should the administrator use to meet these requirements?

Which TWO fields are essential in an ACL policy defined in HCL?

Which TWO of the following are valid ways to assign policies to a token?

A Vault Enterprise administrator is configuring an external group mapping using the LDAP auth method. They want to ensure that members of the LDAP group 'vault-admins' automatically receive the 'admin' policy when they authenticate. Which configuration is required to achieve this?

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

What does the 'root' policy in Vault provide?

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

A Vault Enterprise cluster uses a Control Group to require approval for reading secrets at "secret/data/prod/*". A user with a token that has a policy granting read on that path attempts to read a secret but is blocked pending approval. Which statement accurately describes the token's capabilities during the pending approval?