Free HashiCorp Certified: Vault Associate (002) Exam Vault-Associate Exam Practice Test

You are using the Vault userpass auth method mounted at auth/userpass. How do you create a new user named "sally" with password "h0wN0wB4r0wnC0w"? This new user will need the power-users policy.

A web application uses Vault's transit secrets engine to encrypt data in-transit. If an attackerintercepts the data in transit which of the following statements are true? Choose two correct answers.

• You can rotate the encryption key so that the attacker won’t be able to decrypt the data
• The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted
• The Vault administrator would need to seal the Vault server immediately
• Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)

What is a benefit of response wrapping?

• Log every use of a secret
• Load balanc secret generation across a Vault cluster
• Provide error recovery to a secret so it is not corrupted in transit
• Ensure that only a single party can ever unwrap the token and see what's inside

Vault supports which type of configuration for source limited token?

• Cloud-bound tokens
• Domain-bound tokens
• CIDR-bound tokens
• Certificate-bound tokens

You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?

• A data key encrypts the blob locally, and the same key decrypts the blob locally.
• To process such a large blob. Vault will temporarily store it in the storage backend.
• Vault will store the blob permanently. Be sure to run Vault on a compute optimized machine
• The transit engine is not a good solution for binaries of this size.

How would you describe the value of using the Vault transit secrets engine?

• Vault has an API that can be programmatically consumed by applications
• The transit secrets engine ensures encryption in-transit and at-rest is enforced enterprise wide
• Encryption for application data is best handled by a storage system or database engine, while storing encryption keys in Vault
• The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault

An organization would like to use a scheduler to track & revoke access granted to a job (by Vault) at completion. What auth-associated Vault object should be tracked to enable this behavior?

• Token accessor
• Token ID
• Lease ID
• Authentication method

Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?

• generate-password | vault kv put secret/password value
• vault kv put secret/password value-itsasecret
• vault kv put secret/password value=@data.txt
• vault kv put secret/password value-SSECRET_VALUE

Which of these are a benefit of using the Vault Agent?

• Vault Agent allows for centralized configuration of application secrets engines
• Vault Agent will auto-discover which authentication mechanism to use
• Vault Agent will enforce minimum levels of encryption an application can use
• Vault Agent will manage the lifecycle of cached tokens and leases automatically

Where does the Vault Agent store its cache?

• In a file encrypted using the Vault transit secret engine
• In the Vault key/value store
• In an unencrypted file
• In memory