VAULT-ASSOCIATE-002 Exam Questions

What can be used to limit the scope of a credential breach?

What environment variable overrides the CLI's default Vault server address?

Which of the following statements describe the CLI command below? $ vault login -method=ldap username=mitchellh

The following three policies exist in Vault. What do these policies allow an organization to do? app.hcl callcenter.hcl rewrap.hcl

Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would...

Which of these is not a benefit of dynamic secrets?

Which of the following cannot define the maximum time-to-live (TTL) for a token?

What are orphan tokens?

To give a role the ability to display or output all of the end points under the /secrets/apps/* end point it would need to have which capability set?

When using Integrated Storage, which of the following should you do to recover from possible data loss?

How many Shamir's key shares are required to unseal a Vault instance?

Which of these are a benefit of using the Vault Agent?

To make an authenticated request via the Vault HTTP API, which header would you use?

Which of the following are replication methods available in Vault Enterprise? (Choose two.)

Use this screenshot to answer the question below: When are you shown these options in the GUI?

Examine the command below. Output has been trimmed. Which of the following statements describe the command and its output?

The secrets engine is enabled at secret/. See the following policy: key/value v2 Which of the following operations are permitted by this policy? (Choose two.)

You are performing a high number of authentications in a short amount of time. You're experiencing slow throughput for token generation. How would you solve this problem?

When looking at Vault token details, which key helps you find the paths the token is able to access?

When an auth method is disabled, all users authenticated via that method lose access.

An authentication method should be selected for a use case based on:

A web application uses Vault's transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit, which of the following statements are true? (Choose...

The Vault encryption key is stored in Vault's backend storage.

Which of the following statements describe the secrets engine in Vault? (Choose three.)

What is a benefit of response wrapping?

Which of the following describes the Vault's auth method component?

Which Vault secret engine may be used to build your own internal certificate authority?

Which of the following statements are true about Vault policies? (Choose two.)

Use this screenshot to answer the question below: Where on this page would you click to view a secret located at secret/my-secret?

An organization would like to use a scheduler to track & revoke access granted to a job (by Vault) at completion. What auth-associated Vault object should be tracked to enable this...

Which statement describes the results of this command: $ vault secrets enable transit?

Which of the following is a reason to rekey a Vault cluster? (Choose two.)

What information is required to revoke a Vault lease?

Use this screenshot to answer the question below: Which statement describes this AppRole auth method configuration?

What is a secret in the context of Vault?

What methods of authentication does Vault support? (Choose four.)

Vault Agent allows client-side caching of tokens and leases. If the agent is shut down, those tokens and leases cached will be revoked.

Which kind of token can be renewed indefinitely?

You can use a response-wrapping token more than once for as long as it has not expired.

Which statement describes the results of this command: $ vault secrets enable - version=2 kv (Choose two.)

Which of these are names of the replication methods available in Vault Enterprise? (Choose two.)

What attributes are unique to batch tokens? (Choose three.)

You have manually created some usernames and passwords for a Microsoft SQL database on Azure, and need to store these credentials in Vault. What secrets engine should you use for t...

To create a non-root token with time-to-live (TTL) set to 30 minutes but with no max TTL which flag would you use?

A user successfully logs into Vault with the following cURL command: curl --request POST --data @payload.json The response will include what information?

Which of the following statements are true about the default policy? (Choose two.)

Why might an application be mapped to an identity entity?

Unsealing a single Vault server in a cluster unseals all Vault servers in that cluster.

Which endpoint can be used to list all tokens?

The mechanism to associate an authentication method with access to specific secrets is by specifying a/an: