HashiCorp VA-002-P Practice Exam Questions

HashiCorp VA-002-P Sample Question Answers

Question # 1

In regards to using a K/V v2 secrets engine, select the three correct statements below: (select three)

A. issuing a vault kv destroy statement permanently deletes a single version of a secret
B. issuing a vault kv destroy statement deletes all versions of a secret
C. issuing a vault kv delete statement permanently deletes the secret
D. issuing a vault kv metadata delete statement permanently deletes the secret
E. issuing a vault kv delete statement performs a soft delete

Show Answer

Question # 2

True or False: When encrypting data with the transit secrets engine, Vault always stores theciphertext in a dedicated KV store along with the associated encryption key.

A. False
B. True

Show Answer

Question # 3

From the options below, select the benefits of using a batch token over a service token. (select three)

A. no storage cost for token creation
B. lightweight and scalable
C. can be a root token
D. used for ephemeral, high-performance workloads
E. has accessors

Show Answer

Question # 4

What type of policy is shown below?1. key_prefix "vault/" {2. policy = "write"3. }4. node_prefix "" {5. policy = "write"6. }7. service "vault" {8. policy = "write"9. }10. agent_prefix "" {11. policy = "write"12. }13. session_prefix "" {14. policy = "write"15. }

A. Vault policy allowing access to certain paths
B. Consul ACL policy for a Vault node
C. Consul configuration policy to enable Consul features
D. Vault token policy is written for a user

Show Answer

Question # 5

From the options below, select the benefits of using the PKI (certificates) secrets engine: (selectthree)

A. TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time
B. Vault can act as an intermediate CA
C. reducing, or eliminating certificate revocations
D. reduces time to get a certificate by eliminating the need to generate a private key and CSR

Show Answer

Question # 6

Select the policies below that permit you to create a new entry of foo=bar at the path/secrets/apps/my_secret (select three)

A.path "secrets/apps/my_secret" {capabilities = ["create"]allowed_parameters = {"foo" = []}}
B.path "secrets/+/my_secret" {capabilities = ["create"]allowed_parameters = {"*" = ["bar"]}}C.path "secrets/apps/my_secret" {capabilities = ["update"]}
D.path "secrets/apps/*" {capabilities = ["create"]allowed_parameters = {"foo" = ["bar", "zip"]}}

Show Answer

Question # 7

By default, how long does the transit secrets engine store the resulting ciphertext?

A. 24 hours
B. 32 days
C. transit does not store data
D. 30 days

Show Answer

Question # 8

What is the proper command to enable the AWS secrets engine at the default path?

A. vault enable secrets aws
B. vault secrets aws enable
C. vault secrets enable aws
D. vault enable aws secrets engine

Show Answer

Question # 9

Beyond encryption and decryption of data, which of the following is not a function of the Vaulttransit secrets engine?

A. generate hashes and HMACs of data
B. sign and verify data
C. act as a source of random bytes
D. store the encrypted data securely in Vault for retrieval

Show Answer

Question # 10

Given the policy below, what would the user be able to access?1. path "*" {2. capabilities = ["create", "update", "read", "list", "delete", "sudo"]3. }

A. anything they want to within Vault
B. ability to enable a secret engine at the path *
C. only make changes to policies
D. nothing, since the policy doesn't specify any specific paths

Show Answer