HashiCorp HashiCorp Certifications VA-002-P Questions & Answers

• Question 141:

  What is the Consul Agent?

  A. a process that registers services with Consul

  B. an agent that runs in the background to provide additional features for Consul

  C. the core process of Consul which maintains membership information, manages services, runs checks, responds to queries, and more.

  D. a daemon that Vault uses to register auth methods across all of its clusters to ensure consistency among the data written to disk

  Correct Answer: C

  The Consul agent is the core Consul process that runs the Consul service. Everything Consul does is the result of the Consul agent, which can run in either server or client mode. Reference link:- https://www.consul.io/docs/agent

• Question 142:

  When registering a plugin with Vault, where would you configure the location where the binaries are located in order for Vault to properly register the plugin?

  A. in the Vault configuration file using plugin_directory=

  B. in the UI underneath the plugin tab

  C. in the plugin configuration file using directory=

  D. within the CLI command when registering a plug

  Correct Answer: A

  The plugin directory is a configuration option of Vault, and can be specified in the configuration file. This setting specifies a directory in which all plugin binaries must live; this value cannot be a symbolic link. A plugin can not be added to Vault unless it exists in the plugin directory. There is no default for this configuration option, and if it is not set plugins can not be added to Vault. Reference link:- https:// www.vaultproject.io/docs/internals/plugins

• Question 143:

  Which of the following policies would permit a user to generate dynamic credentials on a database?

  A. path "database/creds/read_only_role" { capabilities = ["read"] }

  B. path "database/creds/read_only_role" { capabilities = ["generate"] }

  C. path "database/creds/read_only_role" { capabilities = ["list"] }

  D. path "database/creds/read_only_role" { capabilities = ["sudo"] }

  Correct Answer: A

  The HTTP request is a GET which corresponds to a read capability. Thus, to grant access to generate database credentials, the policy would grant read access on the appropriate path.

• Question 144:

  You are deploying Vault in a local data center, but want to be sure you have a secondary cluster in the event the primary cluster goes offline. In the secondary data center, you have applications that are running, as they are architected to run active/active. Which type of replication would be best in this scenario?

  A. disaster recovery replication

  B. single-node replication

  C. performance replication

  D. end-to-end replication

  Correct Answer: C

  In this scenario, the key to answering is that there are applications actively running the secondary data center. Because of this, you can deploy Performance Replication and the applications can now use the Vault cluster in their respective data center. This reduces network latency for your applications and provides you with a secondary cluster for redundancy.

• Question 145:

  You've hit the URL for the Vault UI, but you're presented with this screen. Why doesn't Vault present you with a way to log in?

  

  A. a vault policy is preventing you from logging in

  B. the vault configuration file has an incorrect configuration

  C. the consul storage backend was not configured correctly

  D. vault needs to be initialized before it can be used

  Correct Answer: D

  Before Vault can be used, it must be initialized and unsealed. This screen indicates that Vault has not been initialized yet and is offering you a way to do so.

• Question 146:

  True or False:

  Once you create a KV v1 secrets engine and place data in it, there is no way to modify the mount to

  include the features of a KV v2 secrets engine.

  A. True

  B. False

  Correct Answer: B

  The kv enable-versioning command turns on versioning for an existing non-versioned key/value secrets engine (K/V Version 1) at its path. Reference link:- https://www.vaultproject.io/docs/commands/kv/enable-versioning

• Question 147:

  When architecting a Vault replication configuration, why should you never terminate TLS on a front- end load balancer?

  A. If Vault detects that the traffic has been unencrypted and re-encrypted, due to the load balancer, it will automatically drop the traffic as it is no longer trusted.

  B. Vault generates self-signed mutual TLS for replication. If the LB is performing TLS termination, this will break the mutual TLS between nodes.

  C. Vault requires that only Consul service discovery can be used to direct traffic to an active Vault node.

  D. Vault replication won't work with the type of certificates that a traditional load balancer uses.

  Correct Answer: B

  For replication (port 8201), Vault generates a mutual TLS connection between nodes using self- generated certs/keys (this is different than the TLS you configure in the listener, which is particular to client requests)... server-to-server always uses this mutual TLS, even if you have TLS disabled on the listener. Reference link:https://www.vaultproject.io/docs/configuration/listener/tcp https://www.vaultproject.io/docs/concepts/ha

• Question 148:

  After issuing the command to delete a secret, you run a vault kv list command but the secret still exists. What command would permanently delete this secret from Vault?

  1.

  $ vault kv delete kv/applications/app01

  2.

  Success! Data deleted (if it existed) at: kv/applications/app01

  3.

  $ vault kv list kv/applications

  4.

  Keys

  5.

  ---

  6.

  app01

  A. vault kv metadata delete kv/applications/app01

  B. vault kv delete -all kv/applications/app01

  C. vault kv delete -force kv/applications/app01

  D. vault kv destroy -versions=1 kv/applications/app01

  Correct Answer: A

  The kv metadata command has subcommands for interacting with the metadata and versions for the versioned secrets (K/V Version 2 secrets engine) at the specified path. The kv metadata delete command deletes all versions and metadata for the provided key. Reference link:- https://www.vaultproject.io/docs/ commands/kv/metadata

• Question 149:

  While Vault provides businesses tons of functionality out of the box, what feature allows you to extend its functionality with solutions written by third-party providers?

  A. vault agent

  B. namespaces

  C. plugin backend

  D. control groups

  Correct Answer: C

  Plugin backends are the components in Vault that can be implemented separately from Vault's built- in backends. These backends can be either authentication or secrets engines. All Vault auth and secret backends are considered plugins. This simple concept allows both built-in and external plugins to be treated like Legos. Any plugin can exist at multiple different locations. Different versions of a plugin may be at each one, with each version differing from Vault's version. Reference links:https://www.vaultproject.io/docs/plugin https://www.vaultproject.io/docs/internals/plugins

• Question 150:

  An administrator wants to create a new KV mount for individual users to maintain their own secrets but needs a way to simplify the policy so they don't need to write a new one for each new user? With the requirements listed below, what would such a policy look like? Requirement: Each user can perform all operations on their allocated key/value secret path

  A. path "user-kv/data/{{identity.entity.name}}/*" { capabilities = [ "create", "update", "read", "delete", "list" ] }

  B. path "user-kv/data/{{identity.entity.id.name}}/*" { capabilities = [ "create", "update", "read", "delete", "list" ] }

  C. path "user-kv/data/{{identity.entity.aliases.<>.id}}/*" { capabilities = [ "create", "update", "read", "delete", "list" ] }

  D. path "user-kv/data/{{user}}/*" { capabilities = [ "create", "update", "read", "delete", "list" ] }

  Correct Answer: A

  Everything in the Vault is path-based, and policies are no exception. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault. The policy template makes it very flexible to customize the environment. By using parameters within your template, you can have Vault "insert" a value into the path based upon things like identity values, group membership, and metadata associated with either the user's identity or group they are a member of. Using the parameter, the path user-kv/data/{{identity.entity.name}}/* converts to user- kv/data/student01/*