HashiCorp HashiCorp Certifications VAULT-ASSOCIATE Questions & Answers

• Question 1:

  Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would you recommend?

  A. Google Cloud Secrets Engine

  B. Identity secrets engine

  C. Key/Value secrets engine version 2

  D. SSH secrets engine

  Correct Answer: A

  The Google Cloud Secrets Engine is the best option for the DevOps team to provision VMs in GCP via a CICD pipeline and integrate Vault to protect the credentials used by the tool. The Google Cloud Secrets Engine can dynamically generate GCP service account keys or OAuth tokens based on IAM policies, which can be used to authenticate and authorize the CICD tool to access GCP resources. The credentials are automatically revoked when they are no longer used or when the lease expires, ensuring that the credentials are short-lived and secure. The DevOps team can configure rolesets or static accounts in Vault to define the scope and permissions of the credentials, and use the Vault API or CLI to request credentials on demand. The Google Cloud Secrets Engine also supports generating access tokens for impersonated service accounts,which can be useful for delegating access to other service accounts without storing or managing their keys1. The Identity Secrets Engine is not a good option for this use case, because it does not generate GCP credentials, but rather generates identity tokens that can be used to access other Vault secrets engines or namespaces2. The Key/Value Secrets Engine version 2 is also not a good option, because it does not generate dynamic credentials, but rather stores and manages static secrets that the user provides3. The SSH Secrets Engine is not a good option either, because it does not generate GCP credentials, but rather generates SSH keys or OTPs that can be used to access remote hosts via SSH4. References: Google Cloud - Secrets Engines | Vault | HashiCorp Developer Identity - Secrets Engines | Vault | HashiCorp Developer KV - Secrets Engines | Vault | HashiCorp Developer SSH - Secrets Engines | Vault | HashiCorp Developer

• Question 2:

  When using Integrated Storage, which of the following should you do to recover from possible data loss?

  A. Failover to a standby node

  B. Use snapshot

  C. Use audit logs

  D. Use server logs

  Correct Answer: B

  Integrated Storage is a Raft-based storage backend that allows Vault to store its data internally without relying on an external storage system. It also enables Vault to run in high availability mode with automatic leader election and failover. However, Integrated Storage is not immune to data loss or corruption due to hardware failures, network partitions, or human errors. Therefore, it is recommended to use the snapshot feature to backup and restore the Vault data periodically or on demand. A snapshot is a point-in-time capture of the entire Vault data, including the encrypted secrets, the configuration, and the metadata. Snapshots can be taken and restored using the vault operator raft snapshot command or the sys/ storage/raft/snapshot API endpoint. Snapshots are encrypted and can only be restored with a quorum of unseal keys or recovery keys. Snapshots are also portable and can be used to migrate data between different Vault clusters or storage backends. References: https://developer.hashicorp.com/vault/docs/concepts/integrated- storage1, https://developer.hashicorp.com/vault/docs/commands/operator/raft/snapshot2, https://developer.hashicorp.com/vault/api-docs/system/ storage/raft/snapshot3

• Question 3:

  When an auth method is disabled all users authenticated via that method lose access.

  A. True

  B. False

  Correct Answer: A

  The statement is true. When an auth method is disabled, all users authenticated via that method lose access. This is because the tokens issued by the auth method are automatically revoked when the auth method is disabled. This prevents the users from performing any operation in Vault using the revoked tokens. To regain access, the users have to authenticate again using a different auth method that is enabled and has the appropriate policies attached. References: Auth Methods | Vault | HashiCorp Developer, auth disable - Command | Vault | HashiCorp Developer

• Question 4:

  Use this screenshot to answer the question below: When are you shown these options in the GUI?

  

  A. Enabling policies

  B. Enabling authentication engines

  C. Enabling secret engines

  D. Enabling authentication methods

  Correct Answer: D

  This screenshot is shown when you are enabling authentication methods in the GUI. Authentication methods are the ways users and applications authenticate with Vault. Vault supports many different authentication methods, including

  username and password, GitHub, and more. You can enable one or more authentication methods from the grid of options, which are divided into three categories: Generic, Cloud, and Infra. Each option has a name, a description, and a logo.

  You can also enable authentication methods using the Vault CLI or API.

  Enabling policies, authentication engines, and secret engines are different tasks that are not related to this screenshot. Policies are rules that govern the access to Vault resources, such as secrets, authentication methods, and audit devices.

  Authentication engines are components of Vault that perform authentication and assign policies to authenticated entities. Secret engines are components of Vault that store, generate, or encrypt data. These tasks have different GUI pages

  and options than the screenshot.

  References:

  [Authentication | Vault | HashiCorp Developer]

  [Policies | Vault | HashiCorp Developer]

  [Authentication | Vault | HashiCorp Developer]

  [Secrets Engines | Vault | HashiCorp Developer]

• Question 5:

  What can be used to limit the scope of a credential breach?

  A. Storage of secrets in a distributed ledger

  B. Enable audit logging

  C. Use of a short-lived dynamic secrets

  D. Sharing credentials between applications

  Correct Answer: C

  Using a short-lived dynamic secrets can help limit the scope of a credential breach by reducing the exposure time of the secrets. Dynamic secrets are generated on- demand by Vault and automatically revoked when they are no longer needed. This way, the credentials are not stored in plain text or in a static database, and they can be rotated frequently to prevent unauthorized access. Dynamic secrets also provide encryption as a service, which means that they perform cryptographic operations on data in-transit without storing any data. This adds an extra layer of security and reduces the risk of data leakage or tampering. References: Dynamic secrets | Vault | HashiCorp Developer, What are dynamic secrets and why do I need them? - HashiCorp

• Question 6:

  What are orphan tokens?

  A. Orphan tokens are tokens with a use limit so you can set the number of uses when you create them

  B. Orphan tokens are not children of their parent; therefore, orphan tokens do not expire when their parent does

  C. Orphan tokens are tokens with no policies attached

  D. Orphan tokens do not expire when their own max TTL is reached

  Correct Answer: D

  Orphan tokens are tokens that are root of their own token tree. This means that they do not have any parent token associated with them, and they do not expire when their parent token expires. Orphan tokens are useful for scenarios where you need a short- lived and independent token, such as for testing or debugging purposes. Orphan tokens can also be used to create temporary access tokens for applications or services that need to communicate with Vault without using a long-lived root token. References: Tokens | Vault | HashiCorp Developer, Vault cli: how to create orphan token with role - HashiCorp Discuss

• Question 7:

  Use this screenshot to answer the question below: Where on this page would you click to view a secret located at secret/my-secret?

  

  A. A

  B. B

  C. C

  D. D

  E. E

  Correct Answer: C

  In the HashiCorp Vault UI, secrets are organized in a tree-like structure. To view a secret located at secret/my-secret, you would click on the "secret/" folder in the tree, then clickon the "my-secret" file. In this screenshot, the "secret/" folder is

  located at option C. This folder contains the secrets that are stored in the key/value secrets engine, which is the default secrets engine in Vault. The key/value secrets engine allows you to store arbitrary secrets as key/value pairs. The key is

  the path of the secret, and the value is the data of the secret. For example, the secret located at secret/my-secret has a key of "my- secret" and a value of whatever data you stored there.

  References:

  [KV - Secrets Engines | Vault | HashiCorp Developer]

• Question 8:

  An organization would like to use a scheduler to track and revoke access granted to a job (by Vault) at completion. What auth-associated Vault object should be tracked to enable this behavior?

  A. Token accessor

  B. Token ID

  C. Lease ID

  D. Authentication method

  Correct Answer: C

  A lease ID is a unique identifier that is assigned by Vault to every dynamic secret and service type authentication token. A lease ID contains information such as the secret path, the secret version, the secret type, etc. A lease ID can be used

  to track and revoke access granted to a job by Vault at completion, as it allows the scheduler to perform the following operations:

  Lookup the lease information by using the vault lease lookup command or the sys/leases/lookup API endpoint. This will return the metadata of the lease, such as the expire time, the issue time, the renewable status, and the TTL. Renew the

  lease if needed by using the vault lease renew command or the sys/leases/renew API endpoint. This will extend the validity of the secret or the token for a specified increment, or reset the TTL to the original value if no increment is given.

  Revoke the lease when the job is completed by using the vault lease revoke command or the sys/leases/revoke API endpoint. This will invalidate the secret or the token immediately and prevent any further renewals. For example, with the

  AWS secrets engine, the access keys will be deleted from AWS the moment a lease is revoked.

  A lease ID is different from a token ID or a token accessor. A token ID is the actual value of the token that is used to authenticate to Vault and perform requests. A token ID should be treated as a secret and protected from unauthorized

  access. A token accessor is a secondary identifier of the token that is used for token management without revealing the token ID. A token accessor can be used to lookup, renew, or revoke a token, but not to authenticate to Vault or access

  secrets. A token ID or a token accessor can be used to revoke the token itself, but not the leases associated with the token. To revoke the leases, a lease ID is required.

  An authentication method is a way to verify the identity of a user or a machine and issue a token with appropriate policies and metadata. An authentication method is not an object that can be tracked or revoked, but a configuration that can be

  enabled, disabled, tuned, or customized by using the vault auth commands or the sys/auth API endpoints. References: (https://developer.hashicorp.com/vault/docs/commands/lease/lookup), (https://developer.hashicorp.com/vault/docs/

  commands/lease/renew), (https://developer.hashicorp.com/vault/docs/commands/lease/revoke), (https://developer.hashicorp.com/vault/docs/concepts/tokens#token-accessors), (https://developer.hashicorp.com/vault/docs/concepts/auth)

• Question 9:

  Which of the following are replication methods available in Vault Enterprise? Choose two correct answers.

  A. Cluster sharding

  B. Namespaces

  C. Performance Replication

  D. Disaster Recovery Replication

  Correct Answer: CD

  The replication methods available in Vault Enterprise are performance replication and disaster recovery replication. These methods allow critical data to be replicated across clusters to support horizontally scaling and disaster recovery workloads. Performance replication enables a primary cluster to replicate data to one or more secondary clusters, which can handle client requests and improve performance and availability. Performance replication replicates most Vault data, such as secrets, policies, auth methods, and leases, but not tokens. Performance secondaries generate their own tokens and leases, which are not replicated back to the primary. Performance replication also supports filtering, which allows selective replication of data based on namespaces or paths. Disaster recovery replication enables a primary cluster to replicate data to one or more secondary clusters, which act as standby clusters in case of a failure or outage of the primary. Disaster recovery replication replicates all Vault data, including tokens and leases, and maintains the same configuration and state as the primary. Disaster recovery secondaries do not handle client requests, but they can be promoted to a primary in a disaster recovery scenario. References: Replication - Vault Enterprise | Vault | HashiCorp Developer, Performance Replication - Vault Enterprise | Vault | HashiCorp Developer, Disaster Recovery Replication - Vault Enterprise | Vault | HashiCorp Developer

• Question 10:

  Which of the following vault lease operations uses a lease_id as an argument? Choose two correct answers.

  A. renew

  B. revoke -prefix

  C. create

  D. describe

  E. revoke

  Correct Answer: AE

  The vault lease operations that use a lease_id as an argument are renew and revoke. The renew operation allows a client to extend the validity of a lease associated with a secret or a token. The revoke operation allows a client to terminate a lease immediately and invalidate the secret or the token. Both operations require a lease_id as an argument to identify the lease to be renewed or revoked. The lease_id can be obtained from the response of reading a secret or creating a token, or from the vault lease list command. The other operations, revoke-prefix, create, and describe, do not use a lease_id as an argument. The revoke-prefix operation allows a client to revoke all secrets or tokens generated under a given prefix. The create operation allows a client to create a new lease for a secret. The describe operation allows a client to view information about a lease, such as its TTL, policies, and metadata. References: Lease, Renew, and Revoke | Vault | HashiCorp Developer, vault lease - Command | Vault | HashiCorp Developer