Vault Security Model

You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?

Which THREE of the following are potential security risks when using the AppRole method if not configured correctly?

Which TWO of the following statements about the 'vault-agent' injector in Kubernetes are correct?

A Vault Enterprise administrator is configuring a new auth method to authenticate an on-premises application that cannot present a platform identity. The administrator wants to ensure that the initial authentication can only be performed once per login attempt and that the authentication material is bound to the application's network location. Which AppRole role configuration should the administrator apply to achieve these requirements?

An administrator is configuring a Vault Enterprise cluster with Integrated Storage (Raft). They want to ensure that the cluster can automatically recover from a full restart without manual unseal steps, while still protecting the master key. They have deployed a supported cloud KMS. Which configuration should they use?

A Vault Enterprise administrator is reviewing the security of a new auth method that will be used by external partners. The partners will authenticate from their own networks and will receive tokens with a limited set of policies. The administrator wants to ensure that if a token is stolen, the blast radius is minimized. Which TWO controls should be applied to the auth role to reduce the impact of a stolen token? (Choose two.)

When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?

Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?

An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?

A Vault administrator is configuring a new auth method and wants to ensure that the auth method's configuration is protected from unauthorized changes. Which Vault feature should be used to control access to the auth method configuration endpoints?

When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?

An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?

When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?

An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for seal wrapping and auto-unseal. After enabling the HSM, the administrator notices that the Vault cluster fails to start, reporting that the seal wrap key cannot be retrieved. Which configuration step is most likely missing?

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

A security team is reviewing how Vault Enterprise tokens are bound to their origin. They observe that a batch token issued by an auth method in one performance standby node is presented to a different performance standby node and is accepted. They want to understand why this behavior is expected and what security property batch tokens lack compared to service tokens. Which statement correctly describes batch tokens in Vault Enterprise?

What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?

An operator is troubleshooting a Vault Enterprise cluster where audit logs show that a token was used from an unexpected IP address. The security team wants to enforce that a particular token can only be used from the corporate CIDR block 10.0.0.0/8. Which Vault token parameter should be set to achieve this?

Which TWO of the following are true about AppRole 'SecretID' management?

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?

When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?

When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?

Which TWO of the following are valid ways to improve the security of the AppRole authentication process?

A Vault Enterprise operator has just enabled the Transit secrets engine in a namespace dedicated to a payment processing team. The team stores encryption keys in Transit and uses them to encrypt customer credit card data before writing it to an external database. An auditor asks the operator to prove that the plaintext of those credit card numbers never leaves the Vault server. Which property of the Transit secrets engine supports this claim?

Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?

A Vault Enterprise cluster is configured with a performance standby and a disaster recovery (DR) replica. The administrator wants to ensure that if the primary cluster fails, the DR replica can be promoted and clients can continue to access secrets without re-authenticating. Which statement about token replication is true?

In the context of the Vault Kubernetes Auth Method, what is the role of the 'reviewer_service_account'?

When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?

A security team is reviewing the configuration of a Vault Enterprise cluster that uses the Transit secrets engine for encryption as a service. They want to ensure that the encryption keys are protected against unauthorized export and that cryptographic operations are audited. Which two configurations should they implement? (Choose two.)

An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?

A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the `team-a` namespace with a policy that grants read access to `secret/data/team-a/*`. The administrator then uses this token to read a secret at `secret/data/team-b/config` in the `team-b` namespace. What is the outcome?

You are configuring a Vault Enterprise cluster to use a hardware security module (HSM) for seal wrapping and auto-unseal. During testing, you notice that after a node restarts, Vault still requires manual unseal despite the HSM being available. You have verified that the HSM is reachable and the seal stanza is correctly configured. Which of the following is the most likely cause?

An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for auto-unseal. The HSM supports PKCS#11. After configuring the seal stanza, Vault fails to start. Which action should the administrator take to troubleshoot the issue?

Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?