Free Vault-Associate-003 sample questions

Correct answers: `patch` on `kv-v2/data/apps/+/config`; `read` on `kv-v2/data/apps/+/config`

For KVv2, write operations (create/update) are mapped to the `patch` capability on the `/data` subpath. This allows users to add new versions of a secret.

Reading the latest version of a secret from a KVv2 engine requires the `read` capability on the `/data` subpath.

Correct answer: False

The `secret_id` is designed to be a secret, similar to a password. It should be protected and delivered to the application securely (e.g., through a configuration management tool, CI/CD pipeline variable, or an orchestration platform). Storing it in source code is a major security anti-pattern. The `role_id` is considered non-secret and can be stored with the application, but the `secret_id` must be secured.

Correct answer: The AWS secrets engine plugin has not been registered in the Vault plugin catalog in the `root` namespace.

In a namespaced Vault Enterprise environment, secrets engines and auth methods are backed by plugins. These plugins must first be registered in the plugin catalog by an operator with privileges in the `root` namespace. A namespace administrator can only enable plugins that have been made available in the catalog. Even with `sudo` on `sys/mounts/*` within their own namespace, they cannot enable a secrets engine if its underlying plugin is not registered globally.

Correct answer: The Vault Agent

Vault Agent is designed to solve this exact problem. It can be configured to fetch secrets, cache them, and automatically handle the renewal of their leases before they expire. By using an Agent Template, the credentials can be rendered to a file on disk that the application can read. The agent runs as a sidecar or daemon, managing the lifecycle of the secret and token, while the application remains unaware of Vault.

Correct answer: generate-root

The `vault operator generate-root` command is used to start the root token generation process. It requires a quorum of recovery keys (or unseal keys if not using auto-unseal) to be provided to generate a new, single-use root token. This is the standard procedure for regaining root access to a running cluster.

Correct answer: The data can still be decrypted because Vault retains previous key versions for decryption operations.

When a transit key is rotated, Vault generates new key material and increments the key version. However, it securely stores all previous versions of the key. Ciphertext generated by the transit engine is versioned, so when a decryption request is received, Vault uses the appropriate key version to decrypt the data. New encryption operations will use the latest key version. This ensures that key rotation does not break the ability to decrypt older data.

Correct answer: On `us-east-1`, generate a new secondary token from `eu-west-1`'s primary, update the replication configuration on `us-east-1` to re-establish it as a secondary, wait for it to sync, then perform the promotion/demotion process again.

After a DR failover, the original primary (`us-east-1`) is in a demoted state. To fail back, it must first be re-established as a healthy, in-sync secondary of the current primary (`eu-west-1`). This involves generating a new replication token on `eu-west-1`, using that token to reconfigure replication on `us-east-1`, and allowing it to catch up on any data written during the failover. Once it is fully synced, the failover process can be reversed: demote `eu-west-1` and promote `us-east-1`.

Correct answer: It allows management operations to be performed without exposing the actual token ID in logs, audit trails, or scripts.

The token accessor acts as a reference to the token. It allows operators and systems to perform management actions (lookup, renew, revoke) on a token without needing the token ID itself. Since the token ID is the secret used for authentication, using the non-secret accessor for management tasks reduces the risk of accidental exposure of the token ID.

Correct answer: The `list` capability on a glob path (`*`) can be computationally expensive and may allow unintended discovery of secret paths.

While functionally correct, using the `list` capability with a broad globbing pattern (`*`) can be a security and performance concern. It allows the token holder to enumerate all possible secret paths under `kv/ci/`, which might reveal the existence and structure of secrets they shouldn't know about. It can also be a very expensive operation on the storage backend if there are many secrets. Best practice is to grant `list` on more specific, non-globbed paths where possible.

Correct answer: Cubbyhole response wrapping

Cubbyhole response wrapping is the ideal solution for secure introduction. When a secret read is requested with wrapping enabled, Vault does not return the secret directly. Instead, it places the secret in a temporary, single-use Cubbyhole location and returns a wrapping token. This wrapping token can be safely shared. The recipient uses the wrapping token to unwrap and retrieve the actual secret, at which point the wrapping token and the Cubbyhole secret are invalidated. This ensures the secret is only read once by the intended recipient.