Question 1

Thomas has authenticated to Vault using the API and has received the following response. What data

must Thomas parse from the response in order to continue making requests to Vault?

text

CollapseWrapCopy

{

"request_id": "65897160-fd8b-1f87-c24e-fdba14c9728e",

"lease_id": "",

"renewable": false,

"lease_duration": 0,

"data": null,

"wrap_info": null,

"warnings": null,

"auth": {

"client_token": "hvss.lzrmRe5Y3LMcDRmOttEjWoagd92fD29fxakwej_38djs",

"accessor": "EMX0nv4nr0Y1wXoaN7i0WDW1",

"policies": ["bryan", "default"],

"token_policies": ["bryan", "default"],

"metadata": {"username": "bryan"},

"lease_duration": 2764800,

"renewable": true,

"entity_id": "40e203e8-818e-b6ad-4cb3-0befdbf9b598",

"token_type": "service",

"orphan": true

}

Options :

A : accessor

B : request_id

C : client_token

D : entity_id

Answer: C

Question 2

During a service outage, you must ensure all current tokens and leases are copied to another Vault cluster for failover so applications don't need to authenticate. How can you accomplish this?

Options :

A : Have Vault write all the tokens and leases to a file so you have a second copy of them

B : Configure all applications to use the auto-auth feature of the Vault Agent

C : Configure Disaster Recovery replication and promote the secondary cluster during an outage

D :

Replicate to another cluster using Performance Replication and promote the secondary cluster during an outage

Answer: C

Question 3

Which of the following is NOT a valid way in which a lease can be revoked in Vault?

Options :

A : Using the user interface (UI)

B : Automatically when the TTL or Max-TTL expires

C : Using the API to call the /v1/sys/leases endpoint

D : Via the CLI using the vault token command

Answer: D

Question 4

You have a new team member on the Vault operations team. Their first task is to rotate the encryption key in Vault as part of the organization's security policy. However, when they log in, they get an access denied error when attempting to rotate the key. The policy being used is below. Why can't the user rotate the encryption key? path "auth/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "sys/rotate" { capabilities = ["read", "update"] }

Options :

A : The policy requires sudo privileges since it is a root-protected path

B : The policy doesn't include create privileges so a new encryption key can't be created

C : The policy should include sys/rotate/ as part of the path

D : The encryption key has a minimum TTL, therefore the key cannot be rotated until that time expires

Answer: A

Question 5

Your organization has applications in a primary data center and a secondary warm-standby site. You want to configure Vault replication between the primary and secondary clusters. If the primary fails over to the secondary, the applications must interact with Vault without re-authenticating. What type of Vault replication would you use?

Options :

A : Performance Replication

B : Integrated Storage

C : Disaster Recovery Replication

D : Vault Secrets Operator

Answer: C

Higher Test Marks with Free Online Vault-Associate Exam Practice

Buying Options: