HikeLetter | PMP Training & Certification Online Course | Project Management Learning

1

What is the main purpose of a Vault authentication method? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. To verify a client’s identity and issue or establish a Vault identity B. To encrypt the storage backend directly C. To define which API paths a client may access D. To rotate every secret automatically

2

A person needs to sign in interactively to Vault. Which category is generally intended for human users? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. A human-oriented method such as OIDC or userpass, depending on organizational policy B. A database dynamic-secret lease C. A transit encryption key D. A storage backend

3

A workload running in a cloud environment needs to authenticate to Vault without a human password. What is usually the best approach? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. Use a workload-oriented method such as cloud IAM or AppRole, selected for the environment B. Share the initial root token with the application C. Store a permanent root token in source control D. Disable authentication and rely on network location

4

What do Vault policies primarily control? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. Which paths and operations an authenticated client is allowed to perform B. Which users can boot the Vault server machine C. The physical location of storage disks D. The version of the Vault CLI installed

5

In a Vault policy, what do capabilities such as read, create, update, delete, and list specify? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. The operations a token may perform on matching paths B. The encryption algorithm used for the storage backend C. The token’s expiration time D. The number of unseal key shares required

6

A policy should allow a client to read a specific secret path but not modify it. What is the best principle? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. Grant only the read capability on the narrowest appropriate path B. Grant sudo on every path C. Give the client a root token D. Disable the policy and depend on secrecy of the path

7

What is a Vault token used for after a client authenticates? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. It is presented to Vault to identify the client’s authenticated context for authorization B. It permanently encrypts the Vault data directory C. It replaces all Vault policies D. It proves that a secret can never expire

8

Which statement best distinguishes service tokens from batch tokens in Vault? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. Service tokens support richer lifecycle and renewal behavior; batch tokens are lightweight and generally non-renewable B. Batch tokens are always root tokens C. Service tokens cannot be revoked D. Both types always have identical lifecycle semantics

9

Why should a root token be used sparingly? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. It has extremely broad privileges and increases impact if exposed B. It can only read public health endpoints C. It cannot access administrative operations D. It is required for every application request

10

What is a token accessor useful for? A security engineer is configuring Vault for an application team.Which option is most appropriate?

A. Referencing or looking up a token without revealing the token secret itself B. Decrypting all stored data without authorization C. Extending every token’s TTL automatically D. Replacing the token’s policies

Vault Associate (002)

Overview

Course Description

Course Questions