HashiCorp HashiCorp Certifications VA-002-P Questions & Answers

• Question 181:

  Which of the following secrets engine can generate dynamic credentials? (select three)

  A. Azure

  B. database

  C. key/value

  D. Transit

  E. AWS

  Correct Answer: ABE

  Vault has many secrets engines that can generate dynamic credentials, including AWS, Azure, and database secrets engines. The key/value secret engine is used to store data, and the transit secret engine is used to encrypt data.

• Question 182:

  Which of the following best describes the storage backend?

  A. configures client interaction with a cloud storage service, such as Amazon S3

  B. configures the location for storage of Vault data

  C. selects the type of storage the Vault node runs on, such as SSD or traditional spinning hard drive

  D. Encrypts the hard drives of the server which Vault is running on

  Correct Answer: B

  The storage stanza configures the storage backend, which represents the location for the durable storage

  of Vault's information.

  Storage backend configuration is done through the Vault configuration file using the storage stanza.

  Reference link:- https://www.vaultproject.io/docs/configuration/storage

• Question 183:

  What is the default method of authentication after first initializing Vault?

  A. GitHub

  B. AppRole

  C. Admin account

  D. Tokens

  E. Userpass

  F. TLS certificates

  Correct Answer: D

  After initializing, Vault provides the root token to the user, this is the only way to log in to Vault to configure additional auth methods.

• Question 184:

  The userpass auth method has the ability to access external services in order to provide authentication to Vault.

  A. FALSE

  B. TRUE

  Correct Answer: A

  The userpass auth method uses a local database that cannot interact with any services outside of the Vault instance.

• Question 185:

  Which TCP port does Vault use, by default, for its API and UI?

  A. 8600

  B. 8201

  C. 8500

  D. 8301

  E. 8300

  F. 8200

  Correct Answer: F

  By default, Vault uses port 8200 for its API and UI.

  8201 is used for the cluster to cluster communication, 8300 is used for Consul Server RPC,

  8500 is used for the Consul interface,

  8600 is used for Consul DNS,

  and 8301 is used for its LAN gossip protocol.

• Question 186:

  Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (select four)

  A. Transit

  B. HSM

  C. AWS KMS

  D. Key Shards

  E. Azure KMS

  Correct Answer: ABCE

  When a Vault server is started, it starts in a sealed state and it does not know how to decrypt data. Before any operation can be performed on the Vault, it must be unsealed. Unsealing is the process of constructing the master key necessary to decrypt the data encryption key. Below are links covering details of each option:- https://www.vaultproject.io/docs/concepts/seal AWS KMS https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms Auto-unseal using Transit Secrets Engine https://learn.hashicorp.com/vault/operations/autounseal-transit Auto-unseal using Azure Key Vault https://learn.hashicorp.com/vault/day-one/autounseal-azure-keyvault Auto-unseal using HSM https://learn.hashicorp.com/vault/operations/ops-seal-wrap Key shards don't support auto unseal instead key shards require the user to provide unseal keys to reconstruct the master key https://www.vaultproject.io/docs/concepts/seal

• Question 187:

  Vault's User Interface (UI) needs to be enabled in the command line before it can be used.

  A. FALSE

  B. TRUE

  Correct Answer: A

  The UI is enabled in the Vault configuration file, not in the CLI.

• Question 188:

  Which is not a benefit of running HashiCorp Vault in your environment?

  A. Integrate with your code repository to pull secrets when deploying your applications

  B. Consolidate static, long-lived passwords used throughout your organization

  C. Act as root or intermediate certificate authority to automate the generation of PKI certificates

  D. The ability to generate dynamic secrets for applications and resource access

  Correct Answer: A

  Vault does not integrate with any VCS (Version Control System) to checkout or read code. However, It can use GitHub as an auth method.

• Question 189:

  Which of the following settings are configured using the configuration file? (select three)

  A. Cluster Name

  B. Replication

  C. Seal Type

  D. Auth Methods

  E. Namespaces

  F. Storage Backend

  G. Audit Devices

  Correct Answer: ACF

  Seal types, Storage backends, and cluster names are just a few of the configurations done via the configuration file. The others are configured within Vault itself.

• Question 190:

  Which is not a capability that can be used when writing a Vault policy?

  A. read

  B. list

  C. delete

  D. create

  E. modify

  F. update

  Correct Answer: E

  When writing a Vault policy, permissions which can be applied to paths include create, read, update,

  delete, list, deny, and sudo.

  https://www.vaultproject.io/docs/concepts/policies

  Modify is not one of them.