Question 1

Where can you set the Vault seal configuration? Choose two correct answers.

Options :

A : Cloud Provider KMS

B : Vault CLI

C : Vault configuration file

D : Environment variables

E : Vault API

Answer: C,D

Question 2

You want to encrypt a credit card number using the Transit secrets engine. You enter the following command and receive an error. What can you do to ensure that the credit card number is properly encrypted and the ciphertext is returned? $ vault write -format=json transit/encrypt/creditcards plaintext="1234 5678 9101 1121" Error: * illegal base64 data at input byte 4

Options :

A : The plain text data needs to be encoded to base64

B : The token used to issue the encryption request does not have the appropriate permissions

C :

Credit card numbers are not supported using the Transit secrets engine since it is considered sensitive data

D : The credit card number should not include spaces

Answer: A

Question 3

True or False? The Vault Secrets Operator does NOT encrypt client cache, such as Vault tokens and leases, by default in Kubernetes Secrets.

Options :

A : True

B : False

Answer: A

Question 4

To give a role the ability to display or output all of the end points under the /secrets/apps/* end point it would need to have which capability set?

Options :

A : update

B : read

C : sudo

D : list

E : None of the above

Answer: C

Question 5

Which of the following policies would permit a user to generate dynamic credentials on a database?

Options :

A : path "database/creds/read_only_role" { capabilities = ["generate"] }

B : path "database/creds/read_only_role" { capabilities = ["update"] }

C : path "database/creds/read_only_role" { capabilities = ["list"] }

D : path "database/creds/read_only_role" { capabilities = ["read"] }

Answer: D

Higher Test Marks with Free Online Vault-Associate Exam Practice

Buying Options: