You have successfully authenticated using the Kubernetes auth method, and Vault has provided a token. What HTTP header can be used to specify your token when you request dynamic credentials? (Select two)
Correct Answer: A,D
Comprehensive and Detailed In-Depth Explanation: After authenticating with the Kubernetes auth method, Vault returns a token that must be included in subsequent API requests to retrieve dynamic credentials. The Vault documentation specifies two valid HTTP headers for this purpose: "Once authenticated, most Vault operations require a client token to be set either via the X-Vault-Token header or via the Authorization header using the Bearer type. For example: * X-Vault-Token: <token> * Authorization: Bearer <token>"-Vault API Documentation: Authentication * A: X-Vault-Token: <token> is the primary Vault-specific header for token authentication: "The X-Vault-Token header is used to specify the token when requesting dynamic credentials from Vault. This header is commonly used to authenticate and authorize requests to Vault services." -Vault API Documentation * D: Authorization: Bearer <token> is a standard HTTP authentication header supported by Vault: "The Authorization header with the Bearer token format is another common way to specify the token when requesting dynamic credentials from Vault. This header is widely used for authentication purposes in HTTP requests." -Vault API Documentation * B: Token: <token> is not a recognized Vault header. * C: Authentication: <token> is not a standard or supported header in Vault; the correct header is Authorization. These headers ensure the token is passed securely to Vault for authorizing credential requests. References: Vault API Documentation: Authentication Vault Tokens
Question 42
What is a benefit of response wrapping?
Correct Answer: D
Response wrapping is a feature that allows Vault to take the response it would have sentto a client and instead insert it into the cubbyhole of a single-use token, returning that token instead. The client can then unwrap the token and retrieve the original response. Response wrapping has several benefits, such as providing cover, malfeasance detection, and lifetime limitation for the secret data. One of the benefits is to ensure that only a single party can ever unwrap the token and see what's inside, as the token can be used only once and cannot be unwrapped by anyone else, even the root user or the creator of the token. This provides a way to securely distribute secrets to the intended recipients and detect any tampering or interception along the way5. The other options are not benefits of response wrapping: * Log every use of a secret: Response wrapping does not log every use of a secret, as the secret is not directly exposed to the client or the network. However, Vault does log the creation and deletion of the response-wrapping token, and the client can use the audit device to log the unwrapping operation6. * Load balance secret generation across a Vault cluster: Response wrapping does not load balance secret generation across a Vault cluster, as the secret is generated by the Vault server that receives the request and the response-wrapping token is bound to that server. However, Vault does support high availability and replication modes that can distribute the load and improve the performance of the cluster7. * Provide error recovery to a secret so it is not corrupted in transit: Response wrapping does not provide error recovery to a secret so it is not corrupted in transit, as the secret is encrypted and stored in the cubbyhole of the token and cannot be modified or corrupted by anyone. However, if the token is lost or expired, the secret cannot be recovered either, so the client should have a backup or retry mechanism to handle such cases. 5 (https://developer.hashicorp.com/vault/docs/concepts/response-wrapping), 6 (https://developer.hashicorp.com/vault/docs/secrets), 7 (https://developer.hashicorp.com/vault/docs/secrets), 8 (https://developer.hashicorp.com/vault/tutorials/secrets-management/cubbyhole-response-wrapping)
Question 43
You are using the Vault userpass auth method mounted at auth/userpass. How do you create a new user named "sally" with password "h0wN0wB4r0wnC0w"? This new user will need the power-users policy.
Correct Answer: D
To create a new user named "sally" with password "h0wN0wB4r0wnC0w" and the power-users policy, you would use the Vault userpass auth method mounted at auth/userpass. You would use the following command: "vault write auth/userpass/users/sally password=h0wN0wB4r0wnC0w policies=power-users". This command would create a new user named "sally" with the specified password and policy. References: * [Userpass Auth Method | Vault | HashiCorp Developer] * [Create Vault policies | Vault | HashiCorp Developer]
Question 44
You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?
Correct Answer: D
The transit secrets engine is not a good solution for binaries of this size, because it is designed to handle cryptographic functions on data in-transit, not data at-rest. The transit secrets engine does not store any data sent to it, so it would require sending the entire 2GB blob to Vault for encryption or decryption, which would be inefficient and impractical. A better solution would be to use the transit secrets engine to generate a data key, which is a high-entropy key that can be used to encrypt or decrypt data locally. The data key can be returned in plaintext or wrapped by another key, depending on the use case. This way, the transit secrets engine only handles the encryption or decryption of the data key, not the data itself, and the data can be stored in any primary data store. References: Transit - Secrets Engines | Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp Developer
Question 45
You need to create a limited-privileged token that isn't impacted by the TTL of its parent. What type of token should you create?
Correct Answer: B
Comprehensive and Detailed In-Depth Explanation: For independence from parent TTL: * B. Orphan token: "Orphan tokens are not children of their parent; therefore, orphan tokensdo not expire when their parent does." * Incorrect Options: * A: Use limit doesn't affect TTL linkage. * C: Periodic tokens renew but follow parent TTL. * D: Root tokens are unrestricted. Reference:https://developer.hashicorp.com/vault/tutorials/tokens/tokens#orphan-tokens
