VAULT-ASSOCIATE-002 Exam Questions

You are managing a Vault implementation that has been integrated with Azure SQL database to provide dynamic credentials. You have created a role that will provide database credenti...

One of the benefits of using the Vault transit secrets engine is its ability to easily rotate encryption keys. Which of these is true regarding key rotation?

What is not a function provided by Vault's transit secret engine?

Which of the following storage backends supports high availability?

Which command will generate a new transit key?

Which of the following is the correct option to authenticate to Vault using a token using the CLI?

A child token must be assigned the same or a subset the parent token's policies.

When enabling auto-unseal, how do you specify the seal type? (Choose two.)

An organization needs to protect sensitive application data currently stored in a database as plaintext. Which secrets engine provides a solution?

What is true of Vault tokens? Choose TWO correct answers.

Using the Vault CLI, what command is used to authenticate to Vault?

The vault lease renew command increments the lease time from:

You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?

How would you describe the value of using the Vault transit secrets engine?

What is the Vault CLI command to query information about the token the client is currently using?

Which of the following is a machine-oriented Vault authentication backend?

Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?

You can build a high availability Vault cluster with any storage backend.

What command creates a secret with the key "my-password" and the value "53cr3t" at path "my- secrets" within the KV secrets engine mounted at "secret"?

Which of the following statements explains the benefit of response wrapping? Choose TWO correct answers.

Vault operators can create two types of groups in Vault. What are the two types?

Where on the page would you click to display the list of available Vault-created encryption keys?

Which of the following describes usage of an identity group?

Vault supports which type of configuration for source limited token?

Where does the Vault Agent store its cache?

Your organization has an initiative to reduce and ultimately remove the use of long lived X.509 certificates. Which secrets engine will best support this use case?

When unsealing Vault each Shamir unseal key should be entered:

As a best practice, the root token should be stored in which of the following ways?

When creating a policy, an error was thrown: Which statement describes the fix for this issue?

Where can you set the Vault seal configuration? (Choose two.)

Which of the following vault lease operations uses a lease_id as an argument? (Choose two.)

An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is A...

You are using Vault's Transit secrets engine to encrypt your data. You want to reduce the amount of content encrypted with a single key in case the key gets compromised. How would...

What does the following policy do?

Which path will this policy allow? path "kv/+/team_*" { capabilities = [ "read" ] }

Which statements correctly describe the command below. Choose TWO correct answers. vault write transit/decrypt/password \ ciphertext=vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13o...

Which statement is true about an orphan token?

You need to edit a policy, but the UI appears as shown. What is the problem?

Running the second command in the GUI CU will succeed.

Which of these options does not allow the creation of a root token?

You manage two Vault dusters: "vaultduster1.acme.corp" and "vaultduster2.acme.corp". You want to write a secret to the first Vaultcluster vaultcluster1.acme.corp and run vault kv p...

Which statement describes the results of this command: vault kv list secret/test?

To encrypt your secret with the transit secrets engine, you must send the Base32-encoded plaintext to Vault.

Vault Agent supports which of the following? (Choose two.)

Which is not true of Vault tokens?

When using Integrated Storage, which of the following should you do to recover from possible data loss?