Select Two (Multi-Select) Questions

Kubernetes auth requires the secret_id to be specified in a configuration file.

Why wrong: Kubernetes auth uses a token, not a secret_id.

Both AppRole and Kubernetes support response wrapping for initial credentials.

Why wrong: Only AppRole supports secret_id wrapping; Kubernetes token is already short-lived.

AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.

Why wrong: Both methods can generate service tokens by default.

Enable audit logging on the mount to track secret access

Why wrong: Audit logging is enabled globally, not per-mount.

Set a high default lease TTL to reduce renewals

Why wrong: High TTLs increase risk if secrets are compromised, so low TTLs are preferred.

Disable the 'default' policy for the mount to restrict access

Why wrong: The default policy is attached to all tokens; disabling it could break functionality.

Configure a policy to allow users to read credentials from the role

Why wrong: While important for access control, it is not required for the engine to function; the engine itself works without policies.

Tune the engine's default TTL

Why wrong: Tuning is optional and can be done later; not a required step.

With Integrated Storage, all nodes can handle write requests

Why wrong: Only the leader (active node) handles writes; followers forward.

Disaster Recovery Replication replicates everything including policies and audit logs

Why wrong: DR Replication replicates secrets, config, and policies, but audit logs are not replicated.

Set `disable_clustering` to true.

Why wrong: Disabling clustering would prevent HA, increasing impact of a failure.

Use a load balancer to distribute client requests.

Why wrong: Load balancers improve client experience but do not affect cluster resilience.

Enable `performance_standby` on all nodes.

Why wrong: Performance standby nodes are for read scaling, not for handling node failures.

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Why wrong: No such environment variable.

Set the `encrypt` parameter on the audit device configuration.

Why wrong: Audit encryption is optional.

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Why wrong: Integrated Storage does not encrypt at rest without seal.

GET /v1/sys/leases/renew/abc123

Why wrong: Incorrect path and method; should be PUT /v1/sys/leases/renew with body.

POST /v1/sys/leases/renew/abc123

Why wrong: Incorrect method and path.

GET /v1/sys/leases/revoke/abc123

Why wrong: Should be PUT.

The wrapping token never expires

Why wrong: It has a TTL and expires.

The original token used to make the wrapped request is required to unwrap the response

Why wrong: The wrapping token itself is used to unwrap.

vault write sys/leases/list lease_id=<mount_path>

Why wrong: You cannot list leases by writing; you must use a read or list operation.

vault lease list -prefix <mount_path>

Why wrong: There is no 'vault lease list' command; the correct command is 'vault list'.

vault read sys/leases/list/<mount_path>

Why wrong: Correct path is sys/leases/lookup/ or sys/leases/prefix/, not sys/leases/list/.

vault secrets disable <path>

Why wrong: This disables the entire secret engine, which is more heavy-handed.

vault token revoke <token>

Why wrong: This revokes a token and its associated leases, not a direct lease revoke.

vault lease renew <lease_id>

Why wrong: This renews a lease, not revokes.

vault sys/leases/revoke-force <prefix>

Why wrong: Incorrect path; there is no revoke-force endpoint.

vault token revoke -mode=orphan <token>

Why wrong: Orphan mode revokes the token but leaves its leases intact; not suitable for revoking leases.

vault lease revoke <lease_id>

Why wrong: Only revokes a single lease, not all associated with a policy.

The requesting token's TTL

Why wrong: Token TTL does not affect lease TTL.

The backend's rotation period

Why wrong: Rotation period is for periodic password changes, not lease TTL.

Expired

Why wrong: Tokens are either active or revoked; expiration leads to revocation.

Orphan

Why wrong: Orphan is a property of a token, not a state.

Suspended

Why wrong: There is no suspended state for tokens.

vault secrets disable <path>

Why wrong: This disables a secret engine, not revoke tokens.

vault auth disable <path>

Why wrong: This disables an auth method, not revoke a token.

vault policy delete <name>

Why wrong: This deletes a policy, not revoke tokens.

modify

Why wrong: modify is not a standard capability; use create/update instead.

patch

Why wrong: patch is not a standard Vault policy capability.

encrypt

Why wrong: encrypt is an operation on the transit engine, not a policy capability.

encrypt

Why wrong: encrypt is an operation on the transit engine, not a policy capability.

patch

Why wrong: patch is not a standard Vault policy capability.

path "auth/token/renew" { capabilities = ["update"] }

Why wrong: This would allow renewing any token, which is too broad.

path "secret/data/app/*" { capabilities = ["read"] }

Why wrong: This would also allow reading subkeys, which is not necessary and may be too permissive.

path "sys/auth" { capabilities = ["read"] }

Why wrong: This is not required for reading the secret or renewing the token.

Avoid using negative capabilities (deny) when possible.

Why wrong: Deny can be useful for specific exceptions and is not inherently bad.

Grant maximum permissions initially and then restrict as needed.

Why wrong: This is the opposite of least privilege; start minimal and expand.

Use a single all-encompassing policy for each environment.

Why wrong: Monolithic policies are hard to maintain and violate least privilege.

AWS

Why wrong: AWS is an auth method, not a secrets engine.

SSH

Why wrong: SSH is not a built-in secrets engine; there is an SSH secrets engine but it's not listed as such.

LDAP

Why wrong: LDAP is an auth method, not a secrets engine.

num_uses

Why wrong: 'Num_uses' is a valid parameter for service tokens.

accessor

Why wrong: Accessor is generated by Vault, not passed in.