Released HashiCorp Vault-Associate-002 Updated Questions PDF
Vault-Associate-002 Dumps and Practice Test (105 Exam Questions)
NEW QUESTION # 21
When looking at Vault token details, which key helps you find the paths the token is able to access?
- A. Meta
- B. Path
- C. Policies
- D. Accessor
Answer: C
NEW QUESTION # 22
When using Integrated Storage, which of the following should you do to recover from possible data loss?
- A. Use snapshot
- B. Enable audit device
- C. Use local storage
- D. Use external storage
Answer: A
NEW QUESTION # 23
Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?
- A. vault kv put secret/password [email protected]
- B. generate-password | vault kv put secret/password value=-
- C. vault kv put secret/password value=$SECRET_VALUE
- D. vault kv put secret/password value=itsasecret
Answer: D
NEW QUESTION # 24
Why might an application be mapped to an identity entity?
- A. To get around cloud license limitations
- B. To allow the same application in one cloud to access already provisioned Vault tokens for that application in another clo
- C. To allow an application deployed with multiple authentication methods have a consistent set of policies
- D. To prohibit Vault administrators from revoking tokens associated with that application
Answer: C
NEW QUESTION # 25
Use this screenshot to answer the question below:
When are you shown these options in the GUI?
- A. Enabling authentication methods
- B. Enabling policies
- C. Enabling secret engines
- D. Enabling authentication engines
Answer: C
NEW QUESTION # 26
When creating a policy, an error was thrown:
Which statement describes the fix for this issue?
- A. You cannot have a wildcard ("*") in the path
- B. Replace writewith createin the capabilities list
- C. sudois not a capability
Answer: B
NEW QUESTION # 27
Which of the following is a reason to rekey a Vault cluster? (Choose two.)
- A. The rook token is lost
- B. A keyholder joins or leaves the organization
- C. A compliance mandate to rotate the master key at a regular interval
- D. Upgrading Vault Community Edition to Vault Enterprise
- E. Adding additional Vault nodes to a cluster
Answer: B,C
NEW QUESTION # 28
When an auth method is disabled, all users authenticated via that method lose access.
- A. False
- B. True
Answer: B
NEW QUESTION # 29
The mechanism to associate an authentication method with access to specific secrets is by specifying a/an:
- A. Token
- B. Policy
- C. Secret
- D. Accessor
Answer: B
NEW QUESTION # 30
Unsealing a single Vault server in a cluster unseals all Vault servers in that cluster.
- A. False
- B. True
Answer: A
NEW QUESTION # 31
You need to edit a policy, but the UI appears as shown. What is the problem?
- A. This is an UI error. Contact support.
- B. You don't have a permission to manage policies.
- C. Use the command shell in UI to manage policies.
- D. Vault UI does not support policy creation and management.
Answer: B
NEW QUESTION # 32
When using Integrated Storage, which of the following should you do to recover from possible data loss?
- A. Use snapshot
- B. Failover to a standby node
- C. Use audit logs
- D. Use server logs
Answer: A
NEW QUESTION # 33
Vault operators can create two types of groups in Vault. What are the two types?
- A. external groups
- B. policy groups
- C. internal groups
- D. user groups
- E. security groups
Answer: A,C
NEW QUESTION # 34
What attributes are unique to batch tokens? (Choose three.)
- A. Can be periodic
- B. Are persisted
- C. Are not persisted
- D. Have a set time-to-live (TTL)
- E. Cannot be renewed
Answer: C,D,E
NEW QUESTION # 35
Which of these is not a benefit of dynamic secrets?
- A. Minimizes damage of credentials leaking
- B. Replaces cumbersome password rotation tools and practices
- C. Ensures that administrators can see every password used
- D. Supports systems which do not natively provide a method of expiring credentials
Answer: C
NEW QUESTION # 36
What is a benefit of response wrapping?
- A. Provide error recovery to a secret so it is not corrupted in transit
- B. Load balance secret generation across a Vault cluster
- C. Log every use of a secret
- D. Ensure that only a single party can ever unwrap the token and see what's inside
Answer: D
NEW QUESTION # 37
Where on the page would you click to display the list of available Vault-created encryption keys?
- A. transit/
transit_c8663e33 - B. secret/
v2 kv_ad199c3d
key/value secret storage - C. Cubbyhole/
Cubbyhole_6ea98f91
per-token private secret storage
Answer: A
NEW QUESTION # 38
What is true of Vault tokens? Choose TWO correct answers.
- A. Vault tokens are required for every Vault call
- B. Vault tokens are also known as unseal keys
- C. Vault token IDs always begin with "s." such as s.E7rOurS2n7m2Dt5409jWxR87
- D. Vault tokens are the core method for authentication in Vault
- E. Vault tokens are generated by every authentication method login
Answer: D,E
NEW QUESTION # 39
A developer mistakenly committed code that contained AWS S3 credentials into a public repository. You have been tasked with revoking the AWS S3 credential that was in the code. This credential was created using Vault's AWS secrets engine and the developer received the following output when requesting a credential from Vault.
Which Vault command will revoke the lease and remove the credential from AWS?
vault lease revoke aws/creds/s3-access/f3e92392-7d9c-09c8-c921-
- A. 575d62fe80d8
- B. vault lease revoke f3e92392-7d9c-09c8-c921-575d62fe80d8
- C. vault lease revoke access_key=AKIAIOWQXTLW36DV7IEA
- D. vault lease revoke AKIAIOMQXTLW36DV7IEA
Answer: A
NEW QUESTION # 40
How would you describe the value of using the Vault transit secrets engine?
- A. The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault
- B. Encryption for application data is best handled by a storage system or database engine, while storing encryption keys in Vault
- C. Vault has an API that can be programmatically consumed by applications
- D. The transit secrets engine ensures encryption in-transit and at-rest is enforced enterprise wide
Answer: A
NEW QUESTION # 41
Which of these options does not allow the creation of a root token?
- A. By using another root token
- B. By using vault operator generate-rootwith the permission of a quorum of unseal key holders
- C. The initial root token generated at the vault operator inittime
- D. By using batch tokens
Answer: D
NEW QUESTION # 42
One of the benefits of using the Vault transit secrets engine is its ability to easily rotate encryption keys. Which of these is true regarding key rotation?
- A. Vault can rotate encryption keys, but cannot enforce restrictions about the minimum encryption key version
- B. Encryption keys can be rotated manually by a user, or by an automated process which invokes the key rotation API
- C. Vault does not maintain the versioned keyring
- D. Vault automatically rotates the encryption key based on a set period
Answer: B
NEW QUESTION # 43
......
Vault-Associate-002 Exam Dumps Pass with Updated 2026 Certified Exam Questions: https://actualtorrent.exam4pdf.com/Vault-Associate-002-dumps-torrent.html
