22 questions · Access Control Configuration · All types, answers revealed
Which THREE items are required to configure an AppRole auth method?
Policies define what the role can access.
Why this answer
AppRole requires a Role ID, a Secret ID (for added security), and a Policy assignment.
An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?
A policy with 'control_group' parameters defines the required approval criteria.
Why this answer
Control Groups require an 'accessor' or an identity-based wrapping mechanism, but the configuration relies on defining the 'request_entity' and the required 'approver' in the policy or configuration.
Which THREE features are specific to Vault Enterprise when managing access control?
Namespaces are an Enterprise feature.
Why this answer
Namespaces, Replication, and Sentinel are all exclusive to the Enterprise version of Vault.
What is the effect of setting 'token_ttl' on a Role?
The TTL determines how long the token is valid.
Why this answer
Token TTL defines the lifespan of the token generated by that role.
What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?
Explicit deny overrides any allow permissions.
Why this answer
In Vault's policy evaluation, 'deny' always takes precedence over 'allow'.
Which TWO of the following are components of a Control Group configuration?
The approval window must be defined.
Why this answer
Control groups rely on defining the 'approver' entities and the 'ttl' of the request, which governs the workflow.
In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?
Policies are namespaced resources and cannot be applied to child namespaces directly.
Why this answer
Policies are namespace-scoped. A policy created in the root namespace is not automatically visible or effective in a child namespace unless explicitly managed via cross-namespace access patterns.
What is the function of an Identity Alias in Vault?
Aliases allow multiple external credentials to resolve to one entity.
Why this answer
An identity alias maps an external auth method identity to a single internal Vault identity entity.
When configuring Sentinel policies for Vault, what is the 'EGP' policy type?
EGP policies govern access to specific endpoints.
Why this answer
Endpoint Governing Policies (EGP) are scoped to specific paths and evaluated on every request to those paths.
How can an administrator ensure that a secret is only accessible if the requester has a specific identity group membership?
Sentinel can inspect the identity of the requester to enforce group requirements.
Why this answer
By using path-level ACLs that leverage the identity information or by integrating Sentinel policies to check group membership.
Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?
Used to write/create secrets.
Why this answer
Create, Read, and Update are standard operations for secrets engines, while Delete and List are also common.
Which THREE factors influence the effective permissions of a user in Vault?
Sentinel policies can restrict allowed actions.
Why this answer
Effective permissions are the result of policies attached to the token, policies attached to the identity entity, and potentially Sentinel policies that filter the request.
Which TWO fields are essential in an ACL policy defined in HCL?
Capabilities define the permissions.
Why this answer
The path to be restricted and the capabilities allowed for that path are the core components of an ACL policy.
Which TWO of the following are valid ways to assign policies to a token?
Tokens generated for an entity inherit its policies.
Why this answer
Policies can be assigned during token creation via the CLI or API, or they can be associated with an identity entity which then inherits them.
If you need to grant a group of developers access to all paths starting with 'secret/data/developers/', which HCL syntax is correct?
The /* wildcard covers all paths under the prefix.
Why this answer
The path should be defined with a trailing wildcard (/*) to cover sub-paths.
When using Namespace-based multi-tenancy, which statement is true regarding the root namespace?
The identity store is global at the root namespace level.
Why this answer
The root namespace acts as the parent and manages the configuration of auth methods and secrets engines that are globally applicable if desired, and it owns the identity store.
An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?
The role configuration in the AppRole auth method allows setting 'bound_cidrs'.
Why this answer
Token restrictions like 'bound_cidrs' are configured on the 'role' within the AppRole auth method.
What does the 'root' policy in Vault provide?
The root policy grants root permissions.
Why this answer
The 'root' policy provides full administrative access to all paths and operations.
Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?
These are the two main types of Sentinel policies.
Why this answer
Sentinel policies are applied at the request level, and they support both RGP (Request Governing Policy) and EGP (Endpoint Governing Policy).
You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?
The 'request' object contains the attributes of the request being evaluated.
Why this answer
The 'request' object in Sentinel for Vault contains metadata about the API request, including 'path' and 'operation'.
A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?
The read capability is necessary to fetch the contents of a secret.
Why this answer
The 'read' capability is required for reading data from a path, while 'list' is for listing keys and 'create'/'update' for writing.
Which API endpoint should you use to check if a specific policy exists in the system?
This returns a list of all ACL policies.
Why this answer
The 'sys/policies/acl' endpoint allows for listing and reading ACL policies.
Ready to test yourself?
Try a timed practice session using only Access Control Configuration questions.