Access Control Configuration

Which THREE items are required to configure an AppRole auth method?

An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?

Which THREE features are specific to Vault Enterprise when managing access control?

What is the effect of setting 'token_ttl' on a Role?

What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?

Which TWO of the following are components of a Control Group configuration?

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

What is the function of an Identity Alias in Vault?

When configuring Sentinel policies for Vault, what is the 'EGP' policy type?

How can an administrator ensure that a secret is only accessible if the requester has a specific identity group membership?

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

Which THREE factors influence the effective permissions of a user in Vault?

Which TWO fields are essential in an ACL policy defined in HCL?

Which TWO of the following are valid ways to assign policies to a token?

If you need to grant a group of developers access to all paths starting with 'secret/data/developers/', which HCL syntax is correct?

When using Namespace-based multi-tenancy, which statement is true regarding the root namespace?

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

What does the 'root' policy in Vault provide?

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

Which API endpoint should you use to check if a specific policy exists in the system?