HashiCorp HashiCorp Certifications VAULT-ASSOCIATE Questions & Answers

• Question 51:

  What does the following policy do?

  

  A. Grants access for each user to a KV folder which shares their id

  B. Grants access to a special system entity folder

  C. Allows a user to read data about the secret endpoint identity

  D. Nothing, this is not a valid policy

  Correct Answer: C

  This policy allows a user to read data about the secret endpoint identity. The policy grants the user the ability to create, update, read, and delete data in the "secret/data/{identity.entity.id}" path. Additionally, the user is allowed to list data in the

  "secret/metadata/{identity.entity.id}" path. This policy is useful for users who need to access information about the secret endpoint identity.

  The secret endpoint identity is a feature of the Identity Secrets Engine, which allows Vault to generate identity tokens that can be used to access other Vault secrets engines or namespaces. The identity tokens are based on the entity and

  group information of the user or machine that authenticates with Vault. The entity is a unique identifier for the user or machine, and the group is a collection of entities that share some common attributes. The identity tokens can carry

  metadata and policies that are associated with the entity and group.

  The "secret/data/{identity.entity.id}" path is where the user can store and retrieve data that is related to the secret endpoint identity. For example, the user can store some configuration or preferences for the secret endpoint identity in this path.

  The "secret/metadata/{identity.entity.id}" path is where the user can list the metadata of the data stored in the "secret/data/{identity.entity.id}" path. For example, the user can list the version, creation time, deletion time, and destroy time of the

  data in this path.

  References:

  [Identity - Secrets Engines | Vault | HashiCorp Developer] [KV - Secrets Engines | Vault | HashiCorp Developer]

• Question 52:

  Which of the following describes the Vault's auth method component?

  A. It verifies a client against an internal or external system, and generates a token with the appropriate policies attached

  B. It verifies a client against an internal or external system, and generates a token with root policy

  C. It is responsible for durable storage of client tokens

  D. It dynamically generates a unique set of secrets with appropriate permissions attached

  Correct Answer: A

  The Vault's auth method component is the component that performs authentication and assigns identity and policies to a client. It verifies a client against an internal or external system, and generates a token with the appropriate policies attached. The token can then be used to access the secrets and resources that are authorized by the policies. Vault supports various auth methods, such as userpass, ldap, aws, kubernetes, etc., that can integrate with different identity providers and systems. The auth method component can also handle token renewal and revocation, as well as identity grouping and aliasing. References: Auth Methods | Vault | HashiCorp Developer, Authentication - Concepts | Vault | HashiCorp Developer

• Question 53:

  Which of the following describes usage of an identity group?

  A. Limit the policies that would otherwise apply to an entity in the group

  B. When they want to revoke the credentials for a whole set of entities simultaneously

  C. Audit token usage

  D. Consistently apply the same set of policies to a collection of entities

  Correct Answer: D

  An identity group is a collection of entities that share some common attributes. An identity group can have one or more policies attached to it, which are inherited by all the members of the group. An identity group can also have subgroups, which can further refine the policies and attributes for a subset of entities. One of the use cases of an identity group is to consistently apply the same set of policies to a collection of entities. For example, an organization may have different teams or departments, such as engineering, sales, or marketing. Each team may have its own identity group, with policies that grant access to the secrets and resources that are relevant to their work. By creating an identity group for each team, the organization can ensure that the entities belonging to each team have the same level of access and permissions, regardless of which authentication method they use to log in to Vault. References: Identity: entities and groups | Vault | HashiCorp Developer, vault_identity_group | Resources | hashicorp/vault | Terraform | Terraform Registry

• Question 54:

  Which of the following statements are true about Vault policies? Choose two correct answers.

  A. The default policy can not be modified

  B. You must use YAML to define policies

  C. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault

  D. Vault must be restarted in order for a policy change to take an effect

  E. Policies deny by default (empty policy grants no permission)

  Correct Answer: CE

  Vault policies are written in HCL or JSON format and are attached to tokens or roles by name. Policies define the permissions and restrictions for accessing and performing operations on certain paths and secrets in Vault. Policies are deny by

  default, which means that an empty policy grants no permission in the system, and any request that is not explicitly allowed by a policy is implicitly denied1. Some of the features and benefits of Vault policies are:

  Policies are path-based, which means that they match the request path to a set of rules that specify the allowed or denied capabilities, such as create, read, update, delete, list, sudo, etc2.

  Policies are additive, which means that if a token or a role has multiple policies attached, the effective policy is the union of all the individual policies. The most permissive capability is granted if there is a conflict3. Policies can use glob

  patterns, such as * and +, to match multiple paths or segments with a single rule. For example, path "secret/*" matches any path starting with secret/, and path "secret/+/config" matches any path with two segments after secret/ and ending

  with config4.

  Policies can use templating to interpolate certain values into the rules, such as identity information, time, randomness, etc. For example, path "secret/{{identity.entity.id}}/*" matches any path starting with secret/ followed by the entity ID of the

  requester5.

  Policies can be managed by using the vault policy commands or the sys/policy API endpoints. You can write, read, list, and delete policies by using these interfaces6. The default policy is a built-in policy that is attached to all tokens by default

  and cannot be deleted. However, the default policy can be modified by using the vault policy write command or the sys/policy API endpoint. The default policy provides common permissions for tokens, such as renewing themselves, looking

  up their own information, creating and managing response-wrapping tokens, etc7.

  You do not have to use YAML to define policies, as Vault supports both HCL and JSON formats. HCL is a human-friendly configuration language that is also JSON compatible, which means that JSON can be used as a valid input for policies

  as well8. Vault does not need to be restarted in order for a policy change to take effect, as policies are stored and evaluated in memory. Any change to a policy is immediately reflected in the system, and any token or role that has that policy

  attached will be affected by the change.

  References

  1(https://developer.hashicorp.com/vault/docs/concepts/policies),

  2(https://developer.hashi corp.com/vault/docs/concepts/policies),

  3(https://developer.hashicorp.com/vault/docs/conc epts/policies),

  4(https://developer.hashicorp.com/vault/docs/concepts/policies),

  5(https://de veloper.hashicorp.com/vault/docs/concepts/policies),

  6(https://developer.hashicorp.com/va ult/docs/commands/lease),

  7(https://developer.hashicorp.com/vault/docs/concepts/policies) ,

  8(https://developer.hashicorp.com/vault/docs/concepts/policies),

  9(https://developer.hashicorp.com/vault/docs/concepts/policies#policy-updates)

• Question 55:

  The Vault encryption key is stored in Vault's backend storage.

  A. True

  B. False

  Correct Answer: B

  The statement is false. The Vault encryption key is not stored in Vault's backend storage, but rather in Vault's memory. The Vault encryption key is the key that is used to encrypt and decrypt the data that is stored in Vault's backend storage, such as secrets, tokens, policies, etc. The Vault encryption key is derived from the master key, which is generated when Vault is initialized. The master key is split into unseal keys using Shamir's secret sharing algorithm, and the unseal keys are distributed to trusted operators. To start Vault, a quorum of unseal keys is required to reconstruct the master key and derive the encryption key. The encryption key is then kept in memory and used to protect the data in Vault's backend storage. The encryption key is never written to disk or exposed via the API. References: Seal/Unseal | Vault | HashiCorp Developer, Key Rotation | Vault | HashiCorp Developer

• Question 56:

  An authentication method should be selected for a use case based on:

  A. The auth method that best establishes the identity of the client

  B. The cloud provider for which the client is located on

  C. The strongest available cryptographic hash for the use case

  D. Compatibility with the secret engine which is to be used

  Correct Answer: A

  An authentication method should be selected for a use case based on the auth method that best establishes the identity of the client. The identity of the client is the basis for assigning a set of policies and permissions to the client in Vault. Different auth methods have different ways of verifying the identity of the client, such as using passwords, tokens, certificates, cloud credentials, etc. Depending on the use case, some auth methods may be more suitable or convenient than others. For example, for human users, the userpass or ldap auth methods may be easy to use, while for machines or applications, the approle or aws auth methods may be more secure and scalable. The choice of the auth method should also consider the trade-offs between security, performance, and usability. References: Auth Methods | Vault | HashiCorp Developer, Authentication - Concepts | Vault | HashiCorp Developer

• Question 57:

  HOTSPOT Where do you define the Namespace to log into using the Vault Ul? To answer this question Use your mouse to click on the screenshot in the location described above. An arrow indicator will mark where you have clicked. Click the "Answer" button once you have positioned the arrow to answer the question. You may need to scroll

  down to see the entire screenshot.

  Hot Area:

  

  Correct Answer:

  

  The namespace can be defined in the "Mount path" field in the "Advanced options" section of the login screen. The mount path is the path where the auth method is enabled, and it can include a namespace prefix. For example, if the LDAP auth method is enabled at the pathns1/auth/ldap, where ns1 is the namespace, then the mount path field should be set to ns1/auth/ldap. This way, the Vault UI will log in to the correct namespace and auth method. Alternatively, the namespace can also be specified in the URL of the Vault UI, such as https://vault.example.com/ui/vault/auth/ns1/auth/ldap/login.