Select Two (Multi-Select) Questions

Audit device

Why wrong: Optional; logs requests but does not encrypt data.

Authentication method

Why wrong: Optional; used for user identity, not data encryption.

PUT /v1/auth/token/roles

Why wrong: Incorrect. Token roles are managed via POST or GET on /v1/auth/token/roles/:name, not PUT without a role name. This endpoint does not perform a token lifecycle operation.

DELETE /v1/auth/token/revoke

Why wrong: Incorrect. Token revocation uses POST /v1/auth/token/revoke, not DELETE. Vault uses POST for all token mutation operations.

Wrap the token

Why wrong: Wrapping is done using the token ID, not accessor.

Create a child token

Why wrong: Creating a child token requires the parent token ID.

Renew the token

Why wrong: Renewal requires the token ID, not accessor.

Supports federation via SAML with Azure AD

Why wrong: SAML federation is not a feature of the AWS secrets engine; Azure secrets engine may support Azure AD.

Provides native integration with Azure Key Vault for key management

Why wrong: This is specific to Azure secrets engine, not AWS.

Allows connection to AWS via IAM instance profiles

Why wrong: IAM instance profiles are used to authenticate Vault to AWS, not a feature of the engine itself.

renewable

Why wrong: Renewable is true by default for periodic tokens; setting it explicitly is not necessary.

ttl

Why wrong: TTL sets initial lifetime but without period and max_ttl, it can't achieve the requirement.

num_uses

Why wrong: Num_uses is not related to renewal or lifetime.

write

Why wrong: 'write' is not a valid capability; use 'create' or 'update'.

sudo

Why wrong: 'sudo' is not a capability; it's a parameter for root-protected paths.

rename

Why wrong: 'rename' is not a valid capability.

They support explicit max TTL.

Why wrong: Incorrect. Batch tokens do not support explicit max TTL.

They have a TTL.

Why wrong: Incorrect. Batch tokens do not have their own TTL; they inherit the parent token's lifetime.

They are renewable.

Why wrong: Incorrect. Batch tokens are not renewable.

Update the min_decryption_version to the newest version immediately.

Why wrong: This would prevent decryption of any data encrypted with older versions.

Export the key and re-encrypt all data manually.

Why wrong: Unnecessary and introduces security risk; rewrapping is sufficient.

Delete old key versions after rotation.

Why wrong: Deleting old versions prematurely can cause data loss if not all data is rewrapped.

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Why wrong: No such environment variable.

Set the `encrypt` parameter on the audit device configuration.

Why wrong: Audit encryption is optional.

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Why wrong: Integrated Storage does not encrypt at rest without seal.

It can manage EC2 key pairs

Why wrong: Not a feature; key pairs are managed via AWS console/CLI.

It supports STS federation

Why wrong: STS federation is separate; engine generates STS tokens but doesn't federate.

It only supports static IAM users

Why wrong: It supports both static and dynamic, but dynamic is primary.

AppRole requires a secret ID, while Kubernetes auth does not require any secret.

Why wrong: Both require a secret: AppRole uses secret ID, Kubernetes uses the JWT token.

Kubernetes auth can only be used within the same cluster as Vault, while AppRole can be used remotely.

Why wrong: Kubernetes auth can be used from any cluster as long as Vault can reach its API.

Both support response wrapping for secure delivery of credentials.

Why wrong: AppRole supports response wrapping for secret IDs; Kubernetes tokens are usually not wrapped.

issue

Why wrong: Issue is used in PKI engine to issue certificates.

revoke

Why wrong: Revoke is used in PKI engine to revoke certificates.

Creating a new lease

Why wrong: This increases the lease count.

Increasing the max lease TTL

Why wrong: This could allow longer leases, increasing count.

Renewing a lease

Why wrong: Renewal extends the lease, does not reduce count.

PUT /v1/sys/policy/{name}

Why wrong: Vault uses POST, not PUT, for policy creation.

PATCH /v1/sys/policy/{name}

Why wrong: PATCH is not supported for policy management.

Auto-unseal using a cloud KMS eliminates the need for unseal keys entirely.

Why wrong: Unseal keys are still needed for rekey.

Consul as a storage backend requires Consul's own gossip protocol for leader election.

Why wrong: Vault uses Consul's session/lock for leader election.

AWS IAM authentication

Why wrong: AWS auth does not support MFA directly; MFA must be done on AWS side before authentication.

Token authentication

Why wrong: Token auth is for existing tokens, not for user login MFA.

Kubernetes authentication

Why wrong: Kubernetes auth does not have built-in MFA support.

The AWS secrets engine can only generate static access keys

Why wrong: AWS engine generates dynamic credentials (STS or IAM users).

The Database secrets engine requires a root database user for all configurations

Why wrong: It can use non-root users with sufficient privileges.

The Transit secrets engine can generate dynamic database credentials

Why wrong: Transit provides encryption, not dynamic credentials.

Run 'vault write' to test if the token can write to a path.

Why wrong: Writing is not a troubleshooting step; reading or looking up is more diagnostic.

Run 'vault status' to check if the server is reachable.

Why wrong: While server connectivity is important, the command failure may be due to token issues rather than connectivity.

Run 'vault read' to test if any secret is accessible.

Why wrong: While reading may reveal permission issues, it is not a direct troubleshooting step for CLI failures.

A ConfigMap to store Vault configuration including unseal keys.

Why wrong: Unseal keys should never be in ConfigMap.

An Ingress controller to expose Vault externally.

Why wrong: Ingress is not essential; LoadBalancer works.

Kubernetes auth requires the secret_id to be specified in a configuration file.

Why wrong: Kubernetes auth uses a token, not a secret_id.

Both AppRole and Kubernetes support response wrapping for initial credentials.

Why wrong: Only AppRole supports secret_id wrapping; Kubernetes token is already short-lived.

AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.

Why wrong: Both methods can generate service tokens by default.