HashiCorp HashiCorp Certifications VA-002-P Questions & Answers

• Question 151:

  Permissions for Vault backend functions are available at which path?

  A. security/

  B. admin/

  C. backend/

  D. system/

  E. vault/

  F. sys/

  Correct Answer: F

  All backend system functions stored in the sys/ backend. The system backend is a default backend in Vault that is mounted at the /sys endpoint. This endpoint cannot be disabled or moved, and is used to configure Vault and interact with many of Vault's internal features.

• Question 152:

  Which of the following Vault features is available only in the Enterprise version? (select three)

  A. MFA

  B. dynamic credentials

  C. cloud auto unseal

  D. replication

  E. auto unseal with HSM

  Correct Answer: ADE

  Most of the important features of Vault are available in the open-source version, however, some of the features which are generally required by large organizations are only available in the Enterprise version such as:

  -MFA - Multi-factor Authentication

  -Replication

  -Auto unseal with HSM and many more.

  Check all the features at the below link.

  Reference link:- https://www.hashicorp.com/products/vault/pricing/

• Question 153:

  The security barrier protects all of the following Vault components except ___.

  A. secret engine

  B. auth method

  C. storage backend

  D. audit devices

  E. token store

  Correct Answer: C

  storage backend and HTTP API are outside of the security barrier hence can't be protected.

• Question 154:

  To prepare for day-to-day operations, the root token should be safety saved outside of Vault in order to administer Vault

  A. False

  B. True

  Correct Answer: A

  It is generally considered a best practice to not persist root tokens. Instead, a root token should be generated using Vault's operator generate-root command only when absolutely necessary. For day-to-day operations, the root token should be deleted after configuring other auth methods which will be used by admins and Vault clients.

• Question 155:

  A user has logged into the Vault user interface but cannot browse to a secret located at kv/applications/

  app3, however, the policy the user is bound by permits read permission to the secret.

  Because of the read permission, the user should be able to read the secret in the Vault UI.

  A. False

  B. True

  Correct Answer: A

  To browse Vault paths in the UI, the user must have list permissions on the mount and the paths leading up to the secret.

• Question 156:

  The command vault lease revoke -prefix aws/ will revoke all leases associated with the secret engine mounted at aws/

  A. False

  B. True

  Correct Answer: B

  The lease command groups subcommands for interacting with leases attached to secrets.

  Subcommands:

  renew Renews the lease of a secret

  revoke Revokes leases and secrets

  Using the '-prefix' flag allows you to revoke the entire tree of secrets.

• Question 157:

  When a primary Vault cluster fails, Vault will automatically promote a secondary cluster to ensure maximum uptime.

  A. False

  B. True

  Correct Answer: A

  Vault secondary clusters must be manually promoted to a primary.

• Question 158:

  The Vault Agent provides which of the following benefits? (select three)

  A. client-side caching of responses

  B. automatically creates secrets in the desired storage backend

  C. authentication to Vault

  D. token renewal

  Correct Answer: ACD

  Vault Agent is a client daemon that provides the following features:

  -Auto-Auth

  -Caching

  -Templating Reference link:- https://www.vaultproject.io/docs/agent

• Question 159:

  As opposed to service tokens, batch tokens are ideal for what type of action?

  A. generating dynamic credentials

  B. configuring Vault features

  C. renewing tokens

  D. issuing snapshots

  E. encrypting data

  F. writing secrets

  Correct Answer: E

  Batch tokens are generally used for encrypting data because they are lightweight and scalable and also include enough information to use with Vault.

• Question 160:

  Vault does not trust the storage backend.

  A. False

  B. True

  Correct Answer: B

  Storage backends are not trusted by Vault and are only expected to render durability. The storage backend

  is configured when starting the Vault server.

  Reference link:- https://www.vaultproject.io/docs/internals/architecture