HashiCorp VA-002-P Exam Dumps

HashiCorp VA-002-P Sample Question Answers

Question # 1

In regards to using a K/V v2 secrets engine, select the three correct statements below: (select three)

A. issuing a vault kv destroy statement permanently deletes a single version of a secret
B. issuing a vault kv destroy statement deletes all versions of a secret
C. issuing a vault kv delete statement permanently deletes the secret
D. issuing a vault kv metadata delete statement permanently deletes the secret
E. issuing a vault kv delete statement performs a soft delete

Show Answer

Question # 2

True or False: When encrypting data with the transit secrets engine, Vault always stores theciphertext in a dedicated KV store along with the associated encryption key.

A. False
B. True

Show Answer

Question # 3

From the options below, select the benefits of using a batch token over a service token. (select three)

A. no storage cost for token creation
B. lightweight and scalable
C. can be a root token
D. used for ephemeral, high-performance workloads
E. has accessors

Show Answer

Question # 4

What type of policy is shown below?1. key_prefix "vault/" {2. policy = "write"3. }4. node_prefix "" {5. policy = "write"6. }7. service "vault" {8. policy = "write"9. }10. agent_prefix "" {11. policy = "write"12. }13. session_prefix "" {14. policy = "write"15. }

A. Vault policy allowing access to certain paths
B. Consul ACL policy for a Vault node
C. Consul configuration policy to enable Consul features
D. Vault token policy is written for a user

Show Answer

Question # 5

From the options below, select the benefits of using the PKI (certificates) secrets engine: (selectthree)

A. TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time
B. Vault can act as an intermediate CA
C. reducing, or eliminating certificate revocations
D. reduces time to get a certificate by eliminating the need to generate a private key and CSR

Show Answer

Question # 6

Select the policies below that permit you to create a new entry of foo=bar at the path/secrets/apps/my_secret (select three)

A.path "secrets/apps/my_secret" {capabilities = ["create"]allowed_parameters = {"foo" = []}}
B.path "secrets/+/my_secret" {capabilities = ["create"]allowed_parameters = {"*" = ["bar"]}}C.path "secrets/apps/my_secret" {capabilities = ["update"]}
D.path "secrets/apps/*" {capabilities = ["create"]allowed_parameters = {"foo" = ["bar", "zip"]}}

Show Answer

Question # 7

By default, how long does the transit secrets engine store the resulting ciphertext?

A. 24 hours
B. 32 days
C. transit does not store data
D. 30 days

Show Answer

Question # 8

What is the proper command to enable the AWS secrets engine at the default path?

A. vault enable secrets aws
B. vault secrets aws enable
C. vault secrets enable aws
D. vault enable aws secrets engine

Show Answer

Question # 9

Beyond encryption and decryption of data, which of the following is not a function of the Vaulttransit secrets engine?

A. generate hashes and HMACs of data
B. sign and verify data
C. act as a source of random bytes
D. store the encrypted data securely in Vault for retrieval

Show Answer

Question # 10

Given the policy below, what would the user be able to access?1. path "*" {2. capabilities = ["create", "update", "read", "list", "delete", "sudo"]3. }

A. anything they want to within Vault
B. ability to enable a secret engine at the path *
C. only make changes to policies
D. nothing, since the policy doesn't specify any specific paths

Show Answer

Question # 11

deploying your Vault cluster, and running vault operator init, Vault responds with an error and cannotbe unsealed.You've determined that the subnet you've deployed Vault into doesn't have internet access. Whatcan you do to enable Vault to communicate with AWS KMS in the most secure way

A. ask the networking team to provide Vault with inbound access from the internet
B. deploy Vault in a public subnet and provide the Vault nodes with public IP addre
C. add a VPC endpoint
D. change the permissions on the Internet Gateway to allow the Vault nodes to communicate overthe Internet

Show Answer

Question # 12

True or False:Similar to how Vault works with databases and cloud providers, the Active Directory secrets enginedynamically generates the account and password for the requesting Vault client.

A. False
B. True

Show Answer

Question # 13

f a client is currently assigned the following policy, what additional policy can be added to ensurethey cannot access the data stored at secret/apps/confidential but still, read all other secrets?

A.path "secret/apps/confidential/*" {capabilities = ["deny"]
B.path "secret/apps/*" {capabilities = ["deny"]
C.path "secret/apps/confidential" {capabilities = ["deny"]
D.path "secret/apps/*" {capabilities = ["create", "read", "update", "delete", "list"]}path "secret/*" {capabilities = ["read", "deny"]}

Show Answer

Question # 14

True or False:When using the transit secrets engine, setting the min_decryption_version will determine theminimum key length of the data key (i.e., 2048, 4096, etc.)

Show Answer

Question # 15

Which of the following Vault policies will allow a Vault client to read a secret stored atsecrets/applications/app01/api_key?

A.path "secrets/applications/+/api_*" {capabilities = ["read"]}
B.path "secrets/applications/" {capabilities = ["read"]allowed_parameters = {"certificate" = []}}
C.path "secrets/*" {capabilities = ["list"]}
D.path "secrets/applications/app01/api_key" {capabilities = ["update", "list"]}

Show Answer

Question # 16

You've set up multiple Vault clusters, one on-premises which is intended to be the primary cluster,and the second cluster in AWS, which was deployed to be used for performance replication. Afterenabling replication, developers complain that all the data they've stored in the AWS Vault cluster ismissing. What happened?

A. the data was moved to a recovery path after replication was enabled. Use the vault secrets movecommand to move the data back to its intended location
B. there is a certificate mismatch after replication was enabled since Vault replication generates itsown TLS certificates to ensure nodes are trusted entitie
C. the data was automatically copied to the primary cluster after replication was enabled since allwrites are always forwarded to the primary cluster
D. all of the data on the secondary cluster was deleted after replication was enabled

Show Answer

Question # 17

When configuring Vault replication and monitoring its status, you keep seeing something called'WALs'. What are WALs?

A. wake after lan
B. warning of allocated logs
C. write-ahead log
D. write along logging

Show Answer

Question # 18

After logging into the Vault UI, a user complains that they cannot enable Replication. Why would thereplication configuration be missing?

A. replication wasn't configured in the Vault configuration file
B. replication hasn't been enabled
C. Vault is running an open-source version
D. replication configuration isn't available in the UI

Show Answer

Question # 19

In a Consul cluster, participating nodes can be only one of two types. Select the valid types. (selecttwo)

A. follower
B. secondary
C. active
D. primary
E. leader
F. passive

Show Answer

Question # 20

Which TCP port does Vault replication use?

A. 8200
B. 8201
C. 8300
D. 8301

Show Answer