Free HashiCorp VA-003-P Practice Exams - Page 2 of 3

Question #11

Vault supports which type of configuration for source limited token?

A . Cloud-bound tokens
B . Domain-bound tokens
C . CIDR-bound tokens
D . Certificate-bound tokens

Question #12

To give a role the ability to display or output all of the end points under the /secrets/apps/* end point it would need to have which capability set?

A . update
B . read
C . sudo
D . list
E . None of the above

Reveal Solution Hide Solution

Question #13

How many Shamir’s key shares are required to unseal a Vault instance?

A . All key shares
B . A quorum of key shares
C . One or more keys
D . The threshold number of key shares

Reveal Solution Hide Solution

Question #14

You can build a high availability Vault cluster with any storage backend.

A . True
B . False

Reveal Solution Hide Solution

Question #15

An authentication method should be selected for a use case based on:

A . The auth method that best establishes the identity of the client
B . The cloud provider for which the client is located on
C . The strongest available cryptographic hash for the use case
D . Compatibility with the secret engine which is to be used

Reveal Solution Hide Solution

Question #16

An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is AWS.

A . True
B . False

Reveal Solution Hide Solution

Question #17

The key/value v2 secrets engine is enabled at secret/ See the following policy:

Which of the following operations are permitted by this policy? Choose two correct answers.

A . vault kv get secret/webapp1
B . vault kv put secret/webapp1 apikey-"ABCDEFGHI] K123M"
C . vault kv metadata get secret/webapp1
D . vault kv delete secret/super-secret
E . vault kv list secret/super-secret

Reveal Solution Hide Solution

Correct Answer: AC
AC

Explanation:

The policy shown in the image is:

path “secret/data/webapp1” { capabilities = [“create”, “read”, “update”, “delete”, “list”] } path “secret/data/super-secret” { capabilities = [“deny”] }

This policy grants or denies access to the key/value v2 secrets engine mounted at secret/ according to the following rules:

The path “secret/data/webapp1” has the capabilities of “create”, “read”, “update”, “delete”, and “list”. This means that the policy allows performing any of these operations on the secrets stored under this path. The data/ prefix is used to access the actual secret data in the key/value v2 secrets engine5. Therefore, the policy permits the operation of vault kv get secret/webapp1, which reads the secret data at secret/data/webapp16.

The path “secret/data/super-secret” has the capability of “deny”. This means that the policy denies performing any operation on the secrets stored under this path. The policy overrides any other policy that might grant access to this path. Therefore, the policy does not permit the operations of vault kv delete secret/super-secret and vault kv list secret/super-secret, which delete and list the secret data at secret/data/super-secret respectively6.

The policy does not explicitly define any rules for the path “secret/metadata”. The metadata/ prefix is used to access the metadata of the secrets in the key/value v2 secrets engine, such as the number of versions, the deletion status, the creation time, etc5. By default, if the policy grants any of the capabilities of “create”, “read”, “update”, or “delete” on the data/ path, it also grants the same capabilities on the corresponding metadata/ path7. Therefore, the policy permits the operation of vault kv metadata get secret/webapp1, which reads the metadata of the secret at secret/metadata/webapp18.

Reference:

5(https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2), [6]6, 7(https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2), [8]8

Question #18

You have a 2GB Base64 binary large object (blob) that needs to be encrypted.

Which of the following best describes the transit secrets engine?

A . A data key encrypts the blob locally, and the same key decrypts the blob locally.
B . To process such a large blob. Vault will temporarily store it in the storage backend.
C . Vault will store the blob permanently. Be sure to run Vault on a compute optimized machine
D . The transit engine is not a good solution for binaries of this size.

Reveal Solution Hide Solution

Question #19

HOTSPOT

Where do you define the Namespace to log into using the Vault Ul?

To answer this question

Use your mouse to click on the screenshot in the location described above. An arrow indicator will mark where you have clicked. Click the "Answer" button once you have positioned the arrow to answer the question. You may need to scroll down to see the entire screenshot.

Reveal Solution Hide Solution

Question #20

The vault lease renew command increments the lease time from:

A . The current time
B . The end of the lease

Reveal Solution Hide Solution