Vault Associate 002 Practice Test

Vault Associate 002 Practice Test practice questions, page 3 of 4, with answer review and explanations.

Question 11

What can be used to limit the scope of a credential breach?

  1. Storage of secrets in a distributed ledger
  2. Enable audit logging
  3. Use of a short-lived dynamic secrets
  4. Sharing credentials between applications

Question 12

What environment variable overrides the CLI’s default Vault server address?

  1. VAULT_ADDR
  2. VAULT_HTTP_ADDRESS
  3. VAULT_ADDRESS
  4. VAULT_HTTPS_ADDRESS

Question 13

Which of the following statements describe the CLI command below? $ vault login -method=ldap username=mitchellh

  1. Generates a token which is response wrapped
  2. You will be prompted to enter the password
  3. By default, the generated token is valid for 24 hours
  4. Fails because the password is not provided

Question 14

The following three policies exist in Vault What do these policies allow an organization to do? app.hcl callcenter.hcl rewrap.hcl

  1. Separates permissions allowed on actions associated with the transit secret engine
  2. Nothing, as the minimum permissions to perform useful tasks are not present
  3. Encrypt decrypt, and rewrap data using the transit engine all in one policy
  4. Create a transit encryption key for encrypting, decrypting, and rewrapping encrypted data

Question 15

Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would you recommend?

  1. Google Cloud Secrets Engine
  2. Identity secrets engine
  3. Key/Value secrets engine version 2
  4. SSH secrets engine