HashiCorp HashiCorp Certifications VA-002-P Questions & Answers

• Question 161:

  In order to extend a Consul storage backend, Consul nodes should be provisioned across multiple data centers or cloud regions.

  A. True

  B. False

  Correct Answer: B

  Consul nodes in the same cluster should not be provisioned across multiple data centers or cloud regions due to the low-latency requirements.

• Question 162:

  Which two interfaces automatically assume the token for subsequent requests after successfully authenticating? (select two)

  A. UI

  B. API

  C. CLI

  D. Consul

  Correct Answer: AC

  After authenticating, the UI and CLI automatically assume the token for all subsequent requests. The API, however, requires the user to extract the token from the server response after authenticating in order to send with subsequent requests.

• Question 163:

  Vault policies are deny by default

  A. TRUE

  B. FALSE

  Correct Answer: A

  Everything in Vault is path-based including policies. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault. Policies are deny by default, so an empty policy grants no permission in the system.

• Question 164:

  Which of the following cloud providers are not supported by Vault secrets engines?

  A. Oracle

  B. Azure

  C. AWS

  D. GCP

  E. AliCloud

  Correct Answer: A

  Vault supports AWS, Azure, Google Cloud, and Alibaba Cloud out of the box for secrets engines

• Question 165:

  Which two characters can be used when writing a policy to reflect a wildcard or path segment? (select two)

  A. @

  B. $

  C. and

  D. *

  E. +

  Correct Answer: DE

  The splat (*) can be used as a wildcard but can only be used at the very end of a path. The plus sign (+) can be used in the middle of a path to denote a path segment.

• Question 166:

  Using the Vault CLI, what command is used to authenticate to Vault?

  A. vault creds

  B. vault user

  C. vault login

  D. vault auth

  Correct Answer: C

  vault login command would be issued to log in to Vault via CLI followed by the type of login. For example, an LDAP login would use vault login method=ldap username=

• Question 167:

  A Vault client who has read access to the path secrets/apps/app1 is having trouble viewing the secret in the user interface (UI) but can access via the API. What can be done to resolve this issue?

  A. add read permissions to the path secrets/apps

  B. modify the policy to allow the create permission

  C. remove the deny policy blocking access to the secrets/apps/app1 path

  D. add LIST to the policy so the user can browse the paths leading up to the key/value's path

  Correct Answer: D

  To view the paths leading up to the secrets/apps/app1 path in the user interface, the user must have at least LIST permissions to avoid permission denied error in the UI.

• Question 168:

  What happens to child tokens when a parent token is revoked?

  A. the child tokens are renewed

  B. the child tokens are converted to parent tokens

  C. the child tokens create their own child tokens to be used

  D. the child tokens are revoked

  Correct Answer: D

  When a parent token is revoked, all of its child tokens and leases are revoked as well. This ensures that a user cannot skip revocation by simply making a timeless tree of child tokens.

• Question 169:

  Vault configuration files can be written in what languages? (select two)

  A. XML

  B. JSON

  C. YAML

  D. HCL

  Correct Answer: BD

  The Vault configuration file supports either JSON or HCL, which is HashiCorp Configuration Language

• Question 170:

  Which type of Vault replication copies all data from Vault, including K/V data, policies, and client tokens?

  A. DR replication

  B. performance replication

  C. failover replication

  D. online replication

  Correct Answer: A

  Vault Enterprise supports multi-datacenter deployment where you can replicate data across data centers for performance as well as disaster recovery. In DR replication, secondary clusters do not forward service read or write requests until they are elevated and become a new primary. DR replicated cluster will replicate all data from the primary cluster, including tokens. A performance replicated cluster, however, will not replicate the tokens from the primary, as the performance replicated cluster will generate its own client tokens for requests made directly to it. In performance replication, secondaries keep track of their own tokens and leases but share the underlying configuration, policies, and supporting secrets (K/V values, encryption keys for transit, etc). Note: Failover and Online replication, there is no such replication exist in hashicorp vault. Check below links for more details:https://www.vaultproject.io/docs/enterprise/replication https://learn.hashicorp.com/vault/operations/opsdisaster-recovery