VA-002 practice questions 1–10

1. Question 1 · 88 in bank

   What command creates a secret with the key "my-password" and the value "53cr3t" at path "my-secrets" within the KV secrets engine mounted at "secret"?

   • Avault kv put secret/my-secrets/my-password 53cr3t
   • Bvault kv write secret/my-secrets/my-password 53cr3t
   • Cvault kv write 53cr3t my-secrets/my-password
   • Dvault kv put secret/my-secrets my-password-53cr3t

   Show answer

   Answer: D

   Explanation

   Answer is A wrong. vault kv put secret/my-secret/my-password test Failed to parse K=V data: invalid key/value pair "test": format must be key=value vault kv put secret/my-secret/my-password user=test I have tested on my local machine. Thanks

   Source: Adapted from community discussion — bunnyjoel

   Next question

2. Question 2 · 88 in bank

   What can be used to limit the scope of a credential breach?

   • AStorage of secrets in a distributed ledger
   • BEnable audit logging
   • CUse of a short-lived dynamic secrets
   • DSharing credentials between applications

   Show answer

   Answer: C

   Next question

3. Question 3 · 88 in bank

   What environment variable overrides the CLI’s default Vault server address?

   • AVAULT_ADDR
   • BVAULT_HTTP_ADDRESS
   • CVAULT_ADDRESS
   • DVAULT_HTTPS_ADDRESS

   Show answer

   Answer: A

   Next question

4. Question 4 · 88 in bank

   Which of the following statements describe the CLI command below? $ vault login -method=ldap username=mitchellh

   • AGenerates a token which is response wrapped
   • BYou will be prompted to enter the password
   • CBy default, the generated token is valid for 24 hours
   • DFails because the password is not provided

   Show answer

   Answer: B

   References

   • HashiCorp documentation

   Next question

5. Question 5 · 88 in bank

   The following three policies exist in Vault What do these policies allow an organization to do? app.hcl

   

   callcenter.hcl

   

   rewrap.hcl

   

   • ASeparates permissions allowed on actions associated with the transit secret engine
   • BNothing, as the minimum permissions to perform useful tasks are not present
   • CEncrypt decrypt, and rewrap data using the transit engine all in one policy
   • DCreate a transit encryption key for encrypting, decrypting, and rewrapping encrypted data

   Show answer

   Answer: A

   Explanation

   C The most accurate statement describing what these policies allow the organization to do is C: "Encrypt, decrypt, and rewrap data using the transit engine all in one policy."

   Source: Adapted from community discussion — gixejod225

   References

   • HashiCorp documentation

   Next question

6. Question 6 · 88 in bank

   Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would you recommend?

   • AGoogle Cloud Secrets Engine
   • BIdentity secrets engine
   • CKey/Value secrets engine version 2
   • DSSH secrets engine

   Show answer

   Answer: A

   References

   • HashiCorp documentation

   Next question

7. Question 7 · 88 in bank

   Which of these is not a benefit of dynamic secrets?

   • ASupports systems which do not natively provide a method of expiring credentials
   • BMinimizes damage of credentials leaking
   • CEnsures that administrators can see every password used
   • DReplaces cumbersome password rotation tools and practices

   Show answer

   Answer: C

   Next question

8. Question 8 · 88 in bank

   Which of the following cannot define the maximum time-to-live (TTL) for a token?

   • ABy the authentication method
   • BBy the client system
   • CBy the mount endpoint configuration
   • DA parent token TTL
   • ESystem max TTL

   Show answer

   Answer: B

   References

   • HashiCorp documentation

   Next question

9. Question 9 · 88 in bank

   What are orphan tokens?

   • AOrphan tokens are tokens with a use limit so you can set the number of uses when you create them
   • BOrphan tokens are not children of their parent; therefore, orphan tokens do not expire when their parent does
   • COrphan tokens are tokens with no policies attached
   • DOrphan tokens do not expire when their own max TTL is reached

   Show answer

   Answer: B

   References

   • HashiCorp documentation

   Next question

10. Question 10 · 88 in bank

    To give a role the ability to display or output all of the end points under the /secrets/apps/* end point it would need to have which capability set?

    • Aupdate
    • Bread
    • Csudo
    • Dlist
    • ENone of the above

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

VA-002 practice, question 1. 88 questions available.