24 questions · Vault Security Model · All types, answers revealed
You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?
This enforces single-use functionality.
Why this answer
The 'num_uses' parameter allows you to restrict a SecretID to a specific number of authentication attempts (in this case, 1).
Which THREE of the following are potential security risks when using the AppRole method if not configured correctly?
Tokens last too long, increasing risk.
Why this answer
Missing CIDR limits, long TTLs, and lack of SecretID usage limits all increase security risk.
Which TWO of the following statements about the 'vault-agent' injector in Kubernetes are correct?
This is the architecture of the injector.
Why this answer
The injector is a controller that modifies pod specs, and it uses sidecars for secret delivery.
When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?
This is the standard location for the K8s service account token.
Why this answer
The Vault client automatically reads the JWT from /var/run/secrets/kubernetes.io/serviceaccount/token in the pod.
Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?
Vault uses this to verify the JWT authenticity.
Why this answer
You must provide the 'kubernetes_ca_cert' that the Kubernetes API server uses to sign its tokens, so Vault can verify them.
An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?
This is the specific field for SecretID CIDR binding.
Why this answer
The 'secret_id_bound_cidrs' parameter allows you to restrict where a SecretID can be used.
When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?
Vault must be able to talk to the K8s API to validate tokens.
Why this answer
The 'kubernetes_host' and the 'kubernetes_ca_cert' must be correctly configured in the auth/kubernetes/config endpoint for Vault to communicate securely with the API server.
An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?
This targets the compromised credential directly.
Why this answer
Destroying the SecretID through the API effectively invalidates it, preventing any new tokens from being issued via that specific SecretID.
When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?
Audit logs record the authentication attempt and the failure reason.
Why this answer
The Vault server logs (at 'debug' level) will show the specific error returned by the Kubernetes TokenReview API.
Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?
Ensures best practices for token lifecycle.
Why this answer
Short TTLs, CIDR binding, and using the agent injector all minimize the risk and blast radius of token theft.
What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?
It controls the lifespan of the resulting token.
Why this answer
The 'token_ttl' sets the initial time-to-live for the tokens generated by that role, ensuring tokens are short-lived by default.
Which TWO of the following are true about AppRole 'SecretID' management?
A key security feature for SecretIDs.
Why this answer
SecretIDs can be generated via API and can have specific expiration or usage constraints, but they should never be hardcoded.
You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?
It protects the delivery of the token.
Why this answer
Vault's 'Response Wrapping' allows for a secure, one-time introduction of a token to a client, which is essential for dynamic infrastructure.
You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?
This ensures Vault points to the correct API server for token verification.
Why this answer
You must ensure that each Vault instance is configured with the correct 'kubernetes_host' and its own unique 'kubernetes_ca_cert' for the specific K8s cluster it is meant to trust.
When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?
Limit the token's privileges.
Why this answer
Pod isolation, token scope (TTL), and secure communication (TLS/API trust) are the pillars of secure integration.
When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?
This is a core security control for tokens.
Why this answer
This restricts the resulting token to only be usable from the specified CIDR ranges, providing an additional layer of security after authentication.
Which TWO of the following are valid ways to improve the security of the AppRole authentication process?
Adds IP-based validation.
Why this answer
Response wrapping provides secure introduction, and CIDR binding adds network-level restrictions.
Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?
It provides a temporary, single-use wrapper for the sensitive data.
Why this answer
Response wrapping ensures that the token is not visible in cleartext in logs or process lists during delivery.
When configuring the Kubernetes Auth Method, which THREE of the following are required to ensure secure communication between Vault and the Kubernetes API server?
Points Vault to the correct API server.
Why this answer
The host address, the CA certificate, and the token for the reviewer account are mandatory for the TokenReview API communication.
In the context of the Vault Kubernetes Auth Method, what is the role of the 'reviewer_service_account'?
Vault needs a service account with permission to call the TokenReview API.
Why this answer
The 'reviewer_service_account' is the service account that Vault uses to perform the 'TokenReview' request against the Kubernetes API.
When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?
This ensures the token was intended for the Vault instance.
Why this answer
The 'audience' field specifies the expected audience of the JWT, which helps in preventing token reuse attacks across different services.
An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?
Response wrapping protects the secret in transit and ensures it is single-use.
Why this answer
Using Response Wrapping with a short TTL provides a single-use token that ensures the SecretID is only accessible by the intended recipient.
You are using the Kubernetes Auth method and want to restrict a role so that it can only be used by pods in a specific namespace. How do you implement this constraint?
Vault enforces this at the role level during authentication.
Why this answer
When creating a role in the Kubernetes auth method, the 'bound_namespaces' field is used to restrict the role to specific Kubernetes namespaces.
Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?
Wildcards are supported for flexibility.
Why this answer
It restricts authentication to specific service accounts and prevents unauthorized service accounts from assuming the role.
Ready to test yourself?
Try a timed practice session using only Vault Security Model questions.