Free Vault-Associate-003 sample questions

Correct answer: HCP Vault supports log streaming to Splunk, but it must be configured through the HashiCorp Cloud Platform (HCP) interface, not directly via the Vault API or CLI.

HCP Vault Dedicated abstracts away much of the operational overhead of a self-managed cluster. While it supports streaming audit logs to external destinations like Splunk, Datadog, and others, this integration is managed through the HCP Portal. Users cannot enable or configure audit devices directly using the `vault audit enable` command as they would in a self-managed environment. This is a key operational difference between the two deployment models.

Correct answer: Instant updates via event streams

The 'Instant Updates' feature of the Vault Secrets Operator leverages Vault Enterprise's event stream capabilities. The VSO subscribes to events for specific secrets, and when a secret is updated in Vault, an event is pushed to the VSO. This triggers an immediate reconciliation and update of the corresponding Kubernetes secret, bypassing the normal polling interval. This provides near-real-time secret synchronization, fulfilling the low-latency requirement.

Correct answers: `patch` on `kv-v2/data/apps/+/config`; `read` on `kv-v2/data/apps/+/config`

For KVv2, write operations (create/update) are mapped to the `patch` capability on the `/data` subpath. This allows users to add new versions of a secret.

Reading the latest version of a secret from a KVv2 engine requires the `read` capability on the `/data` subpath.

Correct answer: False

The `secret_id` is designed to be a secret, similar to a password. It should be protected and delivered to the application securely (e.g., through a configuration management tool, CI/CD pipeline variable, or an orchestration platform). Storing it in source code is a major security anti-pattern. The `role_id` is considered non-secret and can be stored with the application, but the `secret_id` must be secured.

Correct answer: The AWS secrets engine plugin has not been registered in the Vault plugin catalog in the `root` namespace.

In a namespaced Vault Enterprise environment, secrets engines and auth methods are backed by plugins. These plugins must first be registered in the plugin catalog by an operator with privileges in the `root` namespace. A namespace administrator can only enable plugins that have been made available in the catalog. Even with `sudo` on `sys/mounts/*` within their own namespace, they cannot enable a secrets engine if its underlying plugin is not registered globally.

Correct answer: The Vault Agent

Vault Agent is designed to solve this exact problem. It can be configured to fetch secrets, cache them, and automatically handle the renewal of their leases before they expire. By using an Agent Template, the credentials can be rendered to a file on disk that the application can read. The agent runs as a sidecar or daemon, managing the lifecycle of the secret and token, while the application remains unaware of Vault.

Correct answer: generate-root

The `vault operator generate-root` command is used to start the root token generation process. It requires a quorum of recovery keys (or unseal keys if not using auto-unseal) to be provided to generate a new, single-use root token. This is the standard procedure for regaining root access to a running cluster.

Correct answer: The data can still be decrypted because Vault retains previous key versions for decryption operations.

When a transit key is rotated, Vault generates new key material and increments the key version. However, it securely stores all previous versions of the key. Ciphertext generated by the transit engine is versioned, so when a decryption request is received, Vault uses the appropriate key version to decrypt the data. New encryption operations will use the latest key version. This ensures that key rotation does not break the ability to decrypt older data.

Correct answer: On `us-east-1`, generate a new secondary token from `eu-west-1`'s primary, update the replication configuration on `us-east-1` to re-establish it as a secondary, wait for it to sync, then perform the promotion/demotion process again.

After a DR failover, the original primary (`us-east-1`) is in a demoted state. To fail back, it must first be re-established as a healthy, in-sync secondary of the current primary (`eu-west-1`). This involves generating a new replication token on `eu-west-1`, using that token to reconfigure replication on `us-east-1`, and allowing it to catch up on any data written during the failover. Once it is fully synced, the failover process can be reversed: demote `eu-west-1` and promote `us-east-1`.

Correct answer: It allows management operations to be performed without exposing the actual token ID in logs, audit trails, or scripts.

The token accessor acts as a reference to the token. It allows operators and systems to perform management actions (lookup, renew, revoke) on a token without needing the token ID itself. Since the token ID is the secret used for authentication, using the non-secret accessor for management tasks reduces the risk of accidental exposure of the token ID.