Which of the following capabilities can be used when writing a Vault policy? (Select four)
Correct Answer: A,B,E,F
Comprehensive and Detailed In-Depth Explanation: Vault policies define access control using specific capabilities. The Vault documentation lists the valid capabilities: "When creating a policy, only the following capabilities are available in Vault: * create * read * update * delete * list * sudo * deny"-Vault Policies: Capabilities * A: list is valid: "The list capability enables the user to view a list of available resources or entities within Vault." -Vault Policies: Capabilities * B: deny is valid: "The deny capability is used to explicitly deny access to specific resources or operations within Vault." -Vault Policies: Capabilities * E: create is valid: "The create capability allows the user to create new policies, roles, tokens, and other entities within Vault." -Vault Policies: Capabilities * F: write is a common shorthand for update in Vault's context and is valid: "The update capability (often referred to as write in CLI contexts) allows the user to modify or update existing resources or entities within Vault." -Vault Policies: Capabilities Note: While write isn't explicitly listed, it's synonymous with update in practice, as confirmed by CLI usage and community convention. * C: apply is not a Vault policy capability. * D: root is not a capability; it's a policy name for superuser access. References: Vault Policies: Capabilities
Question 52
How can Vault be used to programmatically obtain a generated code for MFA, somewhat similar to Google Authenticator?
Correct Answer: C
Comprehensive and Detailed in Depth Explanation: Vault can generate time-based one-time passwords (TOTP) for multi-factor authentication (MFA), mimicking apps like Google Authenticator. Let's evaluate: * Option A: CubbyholeCubbyhole is a per-token secret store, not a TOTP generator. It's for temporary secretstorage, not MFA code generation. Incorrect.Vault Docs Insight:"Cubbyhole stores secrets tied to a token... no TOTP functionality." (Different purpose.) * Option B: The random byte generatorVault's /sys/tools/random endpoint generates random bytes, not time-based codes synced with a clock (TOTP requirement). It's for generic randomness, not MFA. Incorrect.Vault Docs Insight:"Random bytes are not time-based... unsuitable for TOTP." (Unrelated feature.) * Option C: TOTP secrets engineThe TOTP engine generates and validates TOTP codes (e.g., 6-digit codes every 30s) using a shared secret, just like Google Authenticator. You create a key (vault write totp /keys/my-key) and fetch codes (vault read totp/code/my-key). Perfect for programmatic MFA. Correct. Vault Docs Insight:"The TOTP secrets engine can act as a TOTP code generator... replacing traditional generators like Google Authenticator." (Exact match.) * Option D: The identity secrets engineThe Identity engine manages user/entity identities and policies, not TOTP codes. It's for identity management, not MFA generation. Incorrect.Vault Docs Insight: "Identity engine handles identity data... no TOTP generation." (Different scope.) Detailed Mechanics: Enable: vault secrets enable totp. Create key: vault write totp/keys/my-key issuer=Vault. Get code: vault read totp/code/my-key returns {"data":{"code":"123456"}}. Codes sync with time (RFC 6238), usable in APIs or apps. Overall Explanation from Vault Docs: "The TOTP secrets engine can act as a TOTP code generator... It provides an added layer of security since the ability to generate codes is guarded by policies and audited." Reference:https://developer.hashicorp.com/vault/docs/secrets/totp
Question 53
You have TBs of data encrypted by Vault stored in a database and are worried about Vault becoming unavailable and not being able to decrypt the data. Is it possible to export the encryption key to store it somewhere else in the event Vault becomes unavailable?
Correct Answer: A
Comprehensive and Detailed In-Depth Explanation: Vault allows key export under specific conditions: * A. Yes, if Exportable: "When creating the key, the exportable flag must be set as true. By default, it is false." If set, "this enables the keys to be exportable," allowing retrieval for external storage. "Once set, this cannot be disabled." * Incorrect Option: * B. No: Incorrect if the key is exportable. "You cannot export the encryption key from Vault if it was not configured to be exportable." This feature, while not best practice, supports disaster recovery scenarios. Reference:https://developer.hashicorp.com/vault/api-docs/secret/transit#exportable
Question 54
What does the following policy do?
Correct Answer: C
This policy allows a user to read data about the secret endpoint identity. The policy grants the user the ability to create, update, read, and delete data in the "secret/data/{identity.entity.id}" path. Additionally, the user is allowed to list data in the "secret/metadata/{identity.entity.id}" path. This policy is useful for users who need to access information about the secret endpoint identity. The secret endpoint identity is a feature of the Identity Secrets Engine, which allows Vault to generate identity tokens that can be used to access other Vault secrets engines or namespaces. The identity tokens are based on the entity and group information of the user or machine that authenticates with Vault. The entity is a unique identifier for the user or machine, and the group is a collection of entities that share some common attributes. The identity tokens can carry metadata and policies that are associated with the entity and group. The "secret/data/{identity.entity.id}" path is where the user can store and retrieve data that is related to the secret endpoint identity. For example, the user can store some configuration or preferences for the secret endpoint identity in this path. The "secret/metadata/{identity.entity.id}" path is where the user can list the metadata of the data stored in the "secret/data/{identity.entity.id}" path. For example, the user can list the version, creation time, deletion time, and destroy time of the data in this path. : [Identity - Secrets Engines | Vault | HashiCorp Developer] [KV - Secrets Engines | Vault | HashiCorp Developer]
Question 55
Which of the following statements are true regarding Vault seal and unseal (select three)?
Correct Answer: A,C,D
Comprehensive and Detailed in Depth Explanation: * A:Vault uses Shamir's Secret Sharing by default for unseal keys. Correct. * B:Auto Unseal uses KMS or similar; it returns recovery keys, not unseal keys. Incorrect. * C:Third-party KMS (e.g., AWS KMS) can auto-unseal Vault. Correct. * D:Auto Unseal supports HA with multiple keys for redundancy. Correct. Overall Explanation from Vault Docs: "Vault uses Shamir's algorithm by default... Auto Unseal with KMS supports HA and does not return unseal keys but recovery keys." Reference:https://developer.hashicorp.com/vault/docs/concepts/seal#seal-unseal
