HashiCorp HashiCorp Certifications VA-002-P Questions & Answers

• Question 171:

  Unsealing Vault creates the encryption keys, which is used to unencrypt the data on the storage backend.

  A. FALSE

  B. TRUE

  Correct Answer: A

  Unsealing is the process of obtaining the plaintext master key necessary to read the decryption key to decrypt the data, allowing access to the Vault. The master key is used to decrypt the encryption key which can unencrypt the data on the storage backend.

• Question 172:

  What command is used to renew a token, if permitted?

  A. vault operator token renew

  B. vault token update

  C. vault new

  D. vault update token

  E. vault token renew

  F. vault renew token

  Correct Answer: E

  In order to renew a token, a user can issue a vault token renew command to extend the TTL. The token can also be renewed using the API

• Question 173:

  Which of the following best describes a token accessor?

  A. a value that acts as a reference to a token which can be used to perform limited actions against the token

  B. a token used for Consul to access Vault auth methods

  C. describes the value associated with the tokens TTL

  D. a value that describes which clients have access to the attached token

  Correct Answer: A

  When tokens are created, a token accessor is also created and returned. This accessor is a value that acts as a reference to a token and can only be used to perform limited actions:

  -

  Lookup a token's properties (not including the actual token ID)

  -

  Lookup a token's capabilities on a path

  -Renew the token

  -Revoke the token Reference link:- https://www.vaultproject.io/docs/concepts/tokens#token-accessors

• Question 174:

  Which of the following commands will remove all secrets at a specific path?

  A. vault lease revoke -prefix

  B. vault delete lease -all

  C. vault lease revoke -all

  D. vault revoke -all

  Correct Answer: A

  The -prefix flag treats the ID as a prefix instead of an exact lease ID. This can revoke multiple leases simultaneously.

• Question 175:

  Which of the following storage backends are supported by HashiCorp technical support? (select four)

  A. Filesystem

  B. Consul

  C. In-Memory

  D. Raft

  E. DynamoDB

  F. MySQL

  Correct Answer: ABCD

  Just to clarify, "HashiCorp supported" means, it is supported by HashiCorp's technical support, it doesn't mean that Vault supports the platform as a storage backend. For example, DynamoDB is a valid storage backend, but it is not officially supported by HashiCorp technical support but it has got the community support. In-Memory - HashiCorp Supported MySQL - Community Supported Raft - HashiCorp Supported Dynamo DB - Community Supported Consul - HashiCorp Supported Filesystem - HashiCorp Supported Check more details on below link:- https://www.vaultproject.io/docs/configuration/storage/in- memory

• Question 176:

  Which commands are available only after Vault has been unsealed? (select two)

  A. vault login -method=ldap -username=vault

  B. vault operator unseal

  C. vault kv get kv/apps/app01

  D. vault status

  Correct Answer: AC

  Once Vault is unsealed, you can run vault login -method=ldap -username=vault and vault kv get kv/apps/ app01. The second command assumes that you have authenticated but it cannot be run unless Vault is unsealed. vault status can be run regardless of Vault is sealed or unsealed, and vault operator unseal can only be run when the vault is sealed.

• Question 177:

  Vault secrets engines are used to do what with data? (select three)

  A. copy

  B. generate

  C. store

  D. transmit

  E. encrypt

  Correct Answer: BCE

  Vault secrets engines are used to store, generate, or encrypt data. The KV secrets engine can store data, AWS can generate credentials, and the transit secret engine can encrypt data.

• Question 178:

  Which three interfaces can be used to access Vault? (select three)

  A. JSON

  B. CLI

  C. RPC

  D. UI

  E. API

  F. Consul

  Correct Answer: BDE

  Vault has three interfaces available.

  The API can be used by a user or application, the CLI can be used by a user directly on the Vault server or

  remotely, and the UI can be used if it's been enabled in the configuration file.

• Question 179:

  Select the two default policies created in Vault. (select two)

  A. default

  B. vault

  C. base

  D. root

  E. admin

  F. user

  Correct Answer: AD

  Vault creates two default policies; root, and default.

  The root policy cannot be deleted or modified.

  The default policy is attached to all tokens, by default, however, this action can be modified if needed.

• Question 180:

  After a client has authenticated, what security feature is used to make subsequent calls?

  A. key shard

  B. ldap

  C. pgp

  D. token

  E. listener

  F. path

  Correct Answer: D

  After authenticating, a client is issued a security token which is associated with a policy. That token is used to make a subsequent request to Vault, such as read, write, etc.