HashiCorp HashiCorp Certifications VAULT-ASSOCIATE Questions & Answers

• Question 31:

  Which statement describes the results of this command: $ vault secrets enable transit

  A. Enables the transit secrets engine at transit path

  B. Requires a root token to execute the command successfully

  C. Enables the transit secrets engine at secret path

  D. Fails due to missing -path parameter

  E. Fails because the transit secrets engine is enabled by default

  Correct Answer: A

  The command vault secrets enable transit enables the transit secrets engine at the transit path. The transit secrets engine is a secrets engine that handles cryptographic functions on data in-transit, such as encryption, decryption, signing, verification, hashing, and random bytes generation. The transit secrets engine does not store the data sent to it, but only performs the requested operations and returns the results. The transit secrets engine can also be viewed as "cryptography as a service" or "encryption as a service". The command vault secrets enable transit uses the default path of transit for the secrets engine, but this can be changed by using the -path option. For example, vault secrets enable path=my-transit transit would enable thetransit secrets engine at the my-transit path. References: Transit - Secrets Engines | Vault | HashiCorp Developer, vault secrets enable - Command | Vault | HashiCorp Developer

• Question 32:

  You can build a high availability Vault cluster with any storage backend.

  A. True

  B. False

  Correct Answer: B

  Not all storage backends support high availability mode for Vault. Only the storage backends that support locking can enable Vault to run in a multi-server mode where one server is active and the others are standby. Some examples of storage backends that support high availability mode are Consul, Integrated Storage, and ZooKeeper. Some examples of storage backends that do not support high availability mode are Filesystem, MySQL, and PostgreSQL. References: https://developer.hashicorp.com/vault/docs/concepts/ha1, https://developer.hashicorp.com/vault/docs/configuration/storage2

• Question 33:

  You have been tasked with writing a policy that will allow read permissions for all secrets at path secret/bar. The users that are assigned this policy should also be able to list the secrets. What should this policy look like?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C

  This policy would allow read permissions for all secrets at path secret/bar, as well as list permissions for the secret/bar/ path. The list permission is required to be able to see the names of the secrets under a given path1. The wildcard () character matches any number of characters within a single path segment, while the slash (/) character matches the end of the path2. Therefore, the policy would grant read access to any secret that starts with secret/bar/, such as secret/bar/ foo or secret/bar/baz, but not to secret/bar itself. To grant list access to secret/bar, the policy needs to specify the exact path with a slash at the end. This policy follows the principle of least privilege, which means that it only grants the minimum permissions necessary for the users to perform their tasks3. The other options are not correct because they either grant too much or too little permissions. Option A would grant both read and list permissions to all secrets under secret/bar, which is more than what is required. Option B would grant list permissions to all secrets under secret/bar, but only read permissions to secret/bar itself, which is not what is required. Option D would use an invalid character (+) in the policy, which would cause an error. References: Policy Syntax | Vault | HashiCorp Developer Policy Syntax | Vault | HashiCorp Developer Policies | Vault | HashiCorp Developer

• Question 34:

  You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?

  A. A data key encrypts the blob locally, and the same key decrypts the blob locally.

  B. To process such a large blob. Vault will temporarily store it in the storage backend.

  C. Vault will store the blob permanently. Be sure to run Vault on a compute optimized machine

  D. The transit engine is not a good solution for binaries of this size.

  Correct Answer: D

  The transit secrets engine is not a good solution for binaries of this size, because it is designed to handle cryptographic functions on data in-transit, not data at-rest. The transit secrets engine does not store any data sent to it, so it would require sending the entire 2GB blob to Vault for encryption or decryption, which would be inefficient and impractical. A better solution would be to use the transit secrets engine to generate a data key, which is a high-entropy key that can be used to encrypt or decrypt data locally. The data key can be returned in plaintext or wrapped by another key, depending on the use case. This way, the transit secrets engine only handles the encryption or decryption of the data key, not the data itself, and the data can be stored in any primary data store. References: Transit - Secrets Engines | Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp Developer

• Question 35:

  Where does the Vault Agent store its cache?

  A. In a file encrypted using the Vault transit secret engine

  B. In the Vault key/value store

  C. In an unencrypted file

  D. In memory

  Correct Answer: D

  The Vault Agent stores its cache in memory, which means that it does not persist the cached tokens and secrets to disk or any other storage backend. This makes the cache more secure and performant, as it avoids exposing the sensitive data to potential attackers or unauthorized access. However, this also means that the cache is volatile and will be lost if the agent process is terminated or restarted. To mitigate this, the agent can optionally use a persistent cache file to restore the tokens and leases from a previous agent process. The persistent cache file is encrypted using a key derived from the agent's auto-auth token and a nonce, and it is stored in a user-specified location on disk. References: Caching Vault Agent | Vault | HashiCorp Developer, Vault Agent Persistent Caching | Vault | HashiCorp Developer

• Question 36:

  Which of these are a benefit of using the Vault Agent?

  A. Vault Agent allows for centralized configuration of application secrets engines

  B. Vault Agent will auto-discover which authentication mechanism to use

  C. Vault Agent will enforce minimum levels of encryption an application can use

  D. Vault Agent will manage the lifecycle of cached tokens and leases automatically

  Correct Answer: D

  Vault Agent is a client daemon that provides the following features:

  Auto-Auth - Automatically authenticate to Vault and manage the token renewal process for locally-retrieved dynamic secrets.

  API Proxy - Allows Vault Agent to act as a proxy for Vault's API, optionally using (or forcing the use of) the Auto-Auth token.

  Caching - Allows client-side caching of responses containing newly created tokens and responses containing leased secrets generated off of these newly created tokens. The agent also manages the renewals of the cached tokens and

  leases. Templating - Allows rendering of user-supplied templates by Vault Agent, using the token generated by the Auto-Auth step.

  Process Supervisor Mode - Runs a child process with Vault secrets injected as environment variables.

  One of the benefits of using the Vault Agent is that it will manage the lifecycle of cached tokens and leases automatically. This means that the agent will handle the token renewal and revocation logic, as well as the lease renewal and

  revocation logic for the secrets that are cached by the agent. This reduces the burden on the application developers and operators, and ensures that the tokens and secrets are always valid and up-to-date. References: Vault Agent | Vault |

  HashiCorp Developer, Caching - Vault Agent | Vault | HashiCorp Developer

• Question 37:

  Which Vault secret engine may be used to build your own internal certificate authority?

  A. Transit

  B. PKI

  C. PostgreSQL D. Generic

  Correct Answer: B

  The Vault secret engine that can be used to build your own internal certificate authority is the PKI secret engine. The PKI secret engine generates dynamic X.509 certificates on-demand, without requiring manual processes of generating private keys and CSRs, submitting to a CA, and waiting for verification and signing. The PKI secret engine can act as a root CA or an intermediate CA, and can issue certificates for various purposes, such as TLS, code signing, email encryption, etc. The PKI secret engine can also manage the certificate lifecycle, such as rotation, revocation, renewal, and CRL generation. The PKI secret engine can also integrate with external CAs, such as Venafi or Entrust, to delegate the certificate issuance and management. References: PKI - Secrets Engines | Vault | HashiCorp Developer, Build Your Own Certificate Authority (CA) | Vault - HashiCorp Learn

• Question 38:

  An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is AWS.

  A. True

  B. False

  Correct Answer: B

  The statement is false. An organization can authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret using more than one authentication method. The AWS auth method is one of the options, but not the only one. The AWS auth method supports two types of authentication: ec2 and iam. The ec2 type uses the signed EC2 instance identity document to authenticate the EC2 instance. The iam type uses the AWS Signature v4 algorithm to sign a request to the sts:GetCallerIdentity API and authenticate the IAM principal. However, the organization can also use other auth methods that are compatible with EC2 instances, suchas AppRole, JWT/OIDC, or Kubernetes. These methods require the EC2 instance to have some sort of identity material, such as a role ID, a secret ID, a JWT token, or a service account token, that can be used to authenticate to Vault. The identity material can be provisioned to the EC2 instance using various mechanisms, such as user data, metadata service, or cloud-init scripts. The choice of the auth method depends on the use case, the security requirements, and the trade-offs between convenience and control. References: AWS - Auth Methods | Vault | HashiCorp Developer, AppRole - Auth Methods | Vault | HashiCorp Developer, JWT/OIDC - Auth Methods | Vault | HashiCorp Developer, Kubernetes - Auth Methods | Vault | HashiCorp Developer

• Question 39:

  Which of the following statements describe the CLI command below?

  S vault login -method-1dap username-mitche11h

  A. Generates a token which is response wrapped

  B. You will be prompted to enter the password

  C. By default the generated token is valid for 24 hours

  D. Fails because the password is not provided

  Correct Answer: A

  The CLI command vault login -method ldap username=mitchellh generates a token that is response wrapped. This means that the token contains a base64-encoded response wrapper, which is a JSON object that contains information about the token, such as its policies, metadata, and expiration time. The response wrapper is used to verify the authenticity and integrity of the token, and to prevent replay attacks. The response wrapper also allows Vault to automatically renew the token when it expires, or to revoke it if it is compromised. The -method ldap option specifies that the authentication method is LDAP, which requires a username andpassword to be provided. The username mitchellh is an example of an LDAP user name, and the password will be hidden when entered. References: Vault CLI Reference | Vault | HashiCorp Developer, Vault CLI Reference | Vault | HashiCorp Developer

• Question 40:

  When creating a policy, an error was thrown:

  

  Which statement describes the fix for this issue?

  A. Replace write with create in the capabilities list

  B. You cannot have a wildcard (" ?;) in the path

  C. sudo is not a capability

  Correct Answer: A

  The error was thrown because the policy code contains an invalid capability, "write". The valid capabilities for a policy are "create", "read", "update", "delete", "list", and "sudo". The "write" capability is not recognized by Vault and should be

  replaced with "create", which allows creating new secrets or overwriting existing ones. The other statements are not correct, because the wildcard (*) and the sudo capability are both valid in a policy. The wildcard matches any number of

  characters within a path segment, and the sudo capability allows performing certain operations that require root privileges.

  References:

  [Policy Syntax | Vault | HashiCorp Developer]