Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
HashiCorp
HashiCorp Security Automation Certification
VA-002-P
HashiCorp Certified: Vault Associate Questions and Answers

Pass the HashiCorp Security Automation Certification VA-002-P Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam VA-002-P Premium Access

View all detail and faqs for the VA-002-P exam

Go to Exam

724 Students Passed

97% Average Score

95% Same Questions

Viewing page 6 out of 6 pages

Viewing questions 51-60 out of questions

Questions # 51:

In order to extend Vault beyond a data center or cloud regional boundary, what feature should be used?

Options:

plugins

secrets engine

replication

seal/unseal

snapshots

Answer

Explanation

To extend Vault beyond a data center or cloud regional boundary, replication can be used. Vault supports both DR replication and Performance replication to copy data from the primary cluster to a secondary cluster safely.

Questions # 52:

Which commands are available only after Vault has been unsealed? (select two)

Options:

vault login -method=ldap -username=vault

vault operator unseal

vault kv get kv/apps/app01

vault status

Answer

A, C

Explanation

Once Vault is unsealed, you can run vault login -method=ldap -username=vault and vault kv get kv/apps/app01. The second command assumes that you have authenticated but it cannot be run unless Vault is unsealed. vault status can be run regardless of Vault is sealed or unsealed, and vault operator unseal can only be run when the vault is sealed.

Questions # 53:

When creating a dynamic secret in Vault, Vault returns what value that can be used to renew or revoke the lease?

Options:

lease_id

vault_accessor

revocation_access

token_revocation_id

Answer

Explanation

When reading a dynamic secret, such as via vault read, Vault always returns a lease_id. This is the ID used with commands such as vault lease renew and vault lease revoke to manage the lease of the secret.

vault lease lookup

Usage: vault lease [options] [args]

This command groups subcommands for interacting with leases. Users can revoke or renew leases.

Renew a lease:

$ vault lease renew database/creds/readonly/2f6a614c...

Revoke a lease:

$ vault lease revoke database/creds/readonly/2f6a614c...

Subcommands:

renew Renews the lease of a secret

revoke Revokes leases and secrets

Reference link:- https://www.vaultproject.io/docs/concepts/lease

Questions # 54:

What feature of Vault would allow you to architect a "Vault within a Vault"?

Options:

sentinel

secrets engines

control groups

namespaces

Answer

Explanation

Namespaces are isolated environments that functionally exist as "Vaults within a Vault." They have separate login paths and support creating and managing data isolated to their namespace. This data includes the following:

- Secret Engines

- Auth Methods

- Policies

- Identities (Entities, Groups)

- Tokens

Reference link:- https://www.vaultproject.io/docs/enterprise/namespaces

Questions # 55:

By default, where does Terraform store its state file?

Options:

shared directory

current working directory

Amazon S3 bucket

remotely using Terraform Cloud

Answer

Explanation

By default, the state file is stored in a local file named "terraform.tfstate", but it can also be stored remotely, which works better in a team environment.

Questions # 56:

When multiple arguments with single-line values appear on consecutive lines at the same nesting level, HashiCorp recommends that you:

Options:

place a space in between each line

type = "A"

ttl = "300"

zone_id = aws_route53_zone.primary.zone_id

align their equals signs

ami = "abc123"

instance_type = "t2.micro"

place all arguments using a variable at the top

ami = var.aws_ami

instance_type = var.instance_size

subnet_id = "subnet-0bb1c79de3EXAMPLE"

tags = {

Name = "HelloWorld"

}

put arguments in alphabetical order

name = "www.pythonfanclub.com "

records = [aws_eip.lb.public_ip]

type = "A"

ttl = "300"

zone_id = aws_route53_zone.primary.zone_id

Answer

Explanation

HashiCorp style conventions suggest you that align the equals sign for consecutive arguments for easing readability for configurations

ami = "abc123"

instance_type = "t2.micro"

Questions # 57:

You've set up multiple Vault clusters, one on-premises which is intended to be the primary cluster, and the second cluster in AWS, which was deployed to be used for performance replication. After enabling replication, developers complain that all the data they've stored in the AWS Vault cluster is missing. What happened?

Options:

the data was moved to a recovery path after replication was enabled. Use the vault secrets move command to move the data back to its intended location

there is a certificate mismatch after replication was enabled since Vault replication generates its own TLS certificates to ensure nodes are trusted entities

the data was automatically copied to the primary cluster after replication was enabled since all writes are always forwarded to the primary cluster

all of the data on the secondary cluster was deleted after replication was enabled

Answer

Explanation

Replication relies on having a shared keyring between primary and secondaries and a shared understanding of the data store state.

As soon as replication is enabled, all of the secondary's existing data will be destroyed, which is irrevocable.

Generally, activating as a secondary will be the first thing that is done upon setting up a new cluster for replication.

Hence, create a backup first if there is a slight chance that you would need this existing storage in the future.

Reference link:- https://www.hashicorp.com/resources/setting-up-configuring-performance-replication/

Questions # 58:

Which of the following Vault policies will allow a Vault client to read a secret stored at secrets/applications/app01/api_key?

Options:

path "secrets/applications/+/api_*" {

capabilities = ["read"]

}

path "secrets/applications/" {

capabilities = ["read"]

allowed_parameters = {

"certificate" = []

}

path "secrets/*" {

capabilities = ["list"]

}

path "secrets/applications/app01/api_key" {

capabilities = ["update", "list"]

}

Answer

Explanation

Wildcards and path segments can be used to allow access to a broader set of secrets rather than having to call out each individual secret itself. None of the other policies will allow a client to actually read the data stored at the path secrets/applications/app01/api_key

Questions # 59:

Complete the following sentence:

For the local state, the workspaces are stored directly in a...

Options:

a file called terraform.tfstate

directory called terraform.workspaces.tfstate

directory called terraform.tfstate.d

a file called terraform.tfstate.backup

Answer

Explanation

For local state, Terraform stores the workspace states in a directory called terraform.tfstate.d.

https://www.terraform.io/docs/state/workspaces.html#workspace-internals

Questions # 60:

True or False:

Multiple providers can be declared within a single Terraform configuration file.

Options:

False

True

Answer

Explanation

Multiple provider blocks can exist if a Terraform configuration is composed of multiple providers, which is a common situation. To add multiple providers in your configuration, declare the providers, and create resources associated with those providers.

Viewing page 6 out of 6 pages

Viewing questions 51-60 out of questions