Question 1

True or False? Once the lease for a dynamic secret has expired, Vault revokes the credentials on the backend platform for which they were created (i.e., database, AWS, Kubernetes).

Options :

A : True

B : False

Answer: A

Question 2

As a best practice, the root token should be stored in which of the following ways?

Options :

A : Should be revoked and never stored after initial setup

B : Should be stored in configuration automation tooling

C : Should be stored in another password safe

D : Should be stored in Vault

Answer: A

Question 3

Where can you set the Vault seal configuration? Choose two correct answers.

Options :

A : Cloud Provider KMS

B : Vault CLI

C : Vault configuration file

D : Environment variables

E : Vault API

Answer: C,D

Question 4

What is the proper command to enable the AWS secrets engine at the default path?

Options :

A : vault enable aws secrets engine

B : vault secrets enable aws

C : vault secrets aws enable

D : vault enable secrets aws

Answer: B

Question 5

You want to encrypt a credit card number using the Transit secrets engine. You enter the following command and receive an error. What can you do to ensure that the credit card number is properly encrypted and the ciphertext is returned? $ vault write -format=json transit/encrypt/creditcards plaintext="1234 5678 9101 1121" Error: * illegal base64 data at input byte 4

Options :

A : The plain text data needs to be encoded to base64

B : The token used to issue the encryption request does not have the appropriate permissions

C :

Credit card numbers are not supported using the Transit secrets engine since it is considered sensitive data

D : The credit card number should not include spaces

Answer: A

Higher Test Marks with Free Online Vault-Associate Exam Practice

Buying Options: