IT Certification Exam Questions & Answers

Q53. An organization would like to use a scheduler to track & revoke access granted to a job (by Vault) at completion.
What auth-associated Vault object should be tracked to enable this behavior?

Q54. You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?

Q55. A user issues the following cURI command to encrypt data using the transit engine and the Vault API:

Which payload.json file has the correct contents?

Q56. Unsealing a single Vault server in a cluster unseals all Vault servers in that cluster.

Q57. What does the following policy do?

Q58. What can be used to limit the scope of a credential breach?

Q59. An authentication method should be selected for a use case based on:

Q60. Your organization has an initiative to reduce and ultimately remove the use of long lived X.509 certificates. Which secrets engine will best support this use case?

Q61. Which statement describes the results of this command: $ vault secrets enable – version=2 kv(Choose two.)

Q62. Use this screenshot to answer the question below:

Where on this page would you click to view a secret located at secret/my-secret?

Q63. Which path will this policy allow?
path “kv/+/team_*” {
capabilities = [ “read” ]
}

Q64. What is true of Vault tokens? Choose TWO correct answers.

Q65. You manage two Vault dusters: “vaultduster1.acme.corp” and “vaultduster2.acme.corp”. You want to write a secret to the first Vaultcluster vaultcluster1.acme.corp and run vault kv put secret/foo value=’bar’. The command times out and the error references the Vault cluster, “vaultcluster2.acme.corp”.
You run the command again with the following address flag:
vault kv put -address=’https://vaultcluster1.acme.corp’ secret/foo
value=’bar’
The command completes successfully. You find that the terminal session defines the environment variable VAULT_ADDR=’https://vaultcluster2.acxe.corp:8200′ Why was the second attempt successful?

Q66. The mechanism to associate an authentication method with access to specific secrets is by specifying a/an:

Q67. To encrypt your secret with the transit secrets engine, you must send the Base32-encoded plaintext to Vault.

Q68. You are using the Vault userpass auth method mounted at auth/userpass. How do you create a new user named “sally” with password “h0wN0wB4r0wnC0w”? This new user will need the power-users policy.

Q69. An organization needs to protect sensitive application data currently stored in a database as plaintext. Which secrets engine provides a solution?

Q70. Which command will generate a new transit key?

Q71. Which statement describes the results of this command: $ vault secrets enable transit?

Q72. You can use a response-wrapping token more than once for as long as it has not expired.

Q73. Which of the following statements explains the benefit of response wrapping? Choose TWO correct answers.