Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
HashiCorp
HashiCorp Security Automation Certification
VA-002-P
HashiCorp Certified: Vault Associate Questions and Answers

Pass the HashiCorp Security Automation Certification VA-002-P Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam VA-002-P Premium Access

View all detail and faqs for the VA-002-P exam

Go to Exam

724 Students Passed

97% Average Score

95% Same Questions

Viewing page 3 out of 6 pages

Viewing questions 21-30 out of questions

Questions # 21:

Permissions for Vault backend functions are available at which path?

Options:

security/

admin/

backend/

system/

vault/

sys/

Answer

Explanation

All backend system functions stored in the sys/ backend.

The system backend is a default backend in Vault that is mounted at the /sys endpoint. This endpoint cannot be disabled or moved, and is used to configure Vault and interact with many of Vault's internal features.

Questions # 22:

After logging into the Vault UI, a user complains that they cannot enable Replication. Why would the replication configuration be missing?

Options:

replication wasn't configured in the Vault configuration file

replication hasn't been enabled

Vault is running an open-source version

replication configuration isn't available in the UI

Answer

Explanation

Replication is not available in open-source versions of Vault. It is an enterprise feature.

Questions # 23:

How can Vault be used to programmatically obtain a generated code for MFA, somewhat similar to Google Authenticator?

Options:

cubbyhole

the identity secrets engine

TOTP secrets engine

the random byte generator

Answer

Explanation

The TOTP secrets engine generates time-based credentials according to the TOTP standard. The secrets engine can also be used to generate a new key and validate passwords generated by that key.

The TOTP secrets engine can act as both a generator (like Google Authenticator) and a provider (like the Google.com sign-in service).

As a Generator

The TOTP secrets engine can act as a TOTP code generator. In this mode, it can replace traditional TOTP generators like Google Authenticator. It provides an added layer of security since the ability to generate codes is guarded by policies and the entire process is audited.

Reference link:- https://www.vaultproject.io/docs/secrets/totp

Questions # 24:

Which of the following terraform subcommands could be used to remove the lock on the state for the current configuration?

Options:

unlock

Removing the lock on a state file is not possible

force-unlock

state-unlock

Answer

Explanation

terraform force-unlock removes the lock on the state for the current configuration.

Questions # 25:

What is the result of the following terraform function call?

lookup({a="hello", b="goodbye"}, "c", "what?")

Options:

goodbye

hello

what?

Answer

Explanation

lookup retrieves the value of a single element from a map, given its key. If the given key does not exist, the given default value is returned instead. In this case, the function call is searching for the key "c". But since there is no key "c", the default vault "what?" is returned.

https://www.terraform.io/docs/configuration/functions/lookup.html

Questions # 26:

What are some of the problems of how infrastructure was traditionally managed before Infrastructure as Code? (select three)

Options:

Requests for infrastructure or hardware required a ticket, increasing the time required to deploy applications

Traditional deployment methods are not able to meet the demands of the modern business where resources tend to live days to weeks, rather than months to years

Traditionally managed infrastructure can't keep up with cyclic or elastic applications

Pointing and clicking in a management console is a scalable approach and reduces human error as businesses are moving to a multi-cloud deployment model

Answer

A, B, C

Explanation

Businesses are making a transition where traditionally-managed infrastructure can no longer meet the demands of today's businesses. IT organizations are quickly adopting the public cloud, which is predominantly API-driven.

To meet customer demands and save costs, application teams are architecting their applications to support a much higher level of elasticity, supporting technology like containers and public cloud resources. These resources may only live for a matter of hours; therefore the traditional method of raising a ticket to request resources is no longer a viable option Pointing and clicking in a management console is NOT scale and increases the change of human error.

Questions # 27:

Which of the following is not an activity associated with the Vault transit secrets engine?

Options:

encrypt

decrypt

update

rewrap

Answer

Explanation

Since Vault does not store any data, hence Vault transit secrets engine does not support update activity.

Questions # 28:

Which statements best describes what the local variable assignment is doing in the following code snippet:

1. variable "subnet_details" {

2. type = list(object({

3. cidr = string

4. subnet_name = string

5. route_table_name = string

6. aznum = number

7. }))

8. }

9. locals {

10. route_tables_all = distinct([for s in var.subnet_details : s.route_table_name ])

11. }

Options:

Create a distinct list of route table name objects

Create a map of route table names to subnet names

Create a map of route table names from a list of subnet names

Create a list of route table names eliminating duplicates

Answer

Explanation

route_tables_all is assigned a list of unique route table names filtered from a list of objects describing subnet details, one of those object attributes being route_table_name.

Questions # 29:

In order to make a Terraform configuration file dynamic and/or reusable, static values should be converted to use what?

Options:

regular expressions

module

input parameters

output value

Answer

Explanation

Input variables serve as parameters for a Terraform module, allowing aspects of the module to be customized without altering the module's own source code, and allowing modules to be shared between different configurations.

Questions # 30:

Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (select four)

Options:

Transit

HSM

AWS KMS

Key Shards

Azure KMS

Answer

A, B, C, E

Explanation

When a Vault server is started, it starts in a sealed state and it does not know how to decrypt data. Before any operation can be performed on the Vault, it must be unsealed. Unsealing is the process of constructing the master key necessary to decrypt the data encryption key.

Below are links covering details of each option:- https://www.vaultproject.io/docs/concepts/seal

AWS KMS

https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms

Auto-unseal using Transit Secrets Engine

https://learn.hashicorp.com/vault/operations/autounseal-transit

Auto-unseal using Azure Key Vault

https://learn.hashicorp.com/vault/day-one/autounseal-azure-keyvault

Auto-unseal using HSM

https://learn.hashicorp.com/vault/operations/ops-seal-wrap

Key shards don't support auto unseal instead key shards require the user to provide unseal keys to reconstruct the master key

https://www.vaultproject.io/docs/concepts/seal

Viewing page 3 out of 6 pages