To make an authenticated request via the Vault HTTP API, which header would you use?

• A.The X-Vault-Token HTTP Header
• B.The x-Vault-Request HTTP Header
• C.The Content-Type HTTP Header
• D.The X-Vault-Namespace HTTP Header

Comment: *

Name: *

Email: *

Verification: *

Which statement best explains how Vault handles data encryption?

• A.Vault uses encryption to secure data at rest and in transit, using an encryption key protected by the root key.
• B.Vault encrypts data using a root key stored in plain text on the server's filesystem.
• C.Vault stores data in plaintext on disk but encrypts it only when transmitting it over the network.
• D.Vault offloads all encryption to third-party services, so no secret data is ever processed by Vault.

Comment: *

Name: *

Email: *

Verification: *

Your organization audited an essential application and found it isn't securely storing data. For added security, auditors recommended encrypting all data before storing it in a backend database, and the application server should not store encryption keys locally. Which secrets engine meets these requirements?

• A.PKI secrets engine
• B.SSH secrets engine
• C.Transit secrets engine
• D.Cubbyhole secrets engine

Comment: *

Name: *

Email: *

Verification: *

Which of the following describes the Vault's auth method component?

• A.It verifies a client against an internal or external system, and generates a token with the appropriate policies attached
• B.It verifies a client against an internal or external system, and generates a token with root policy
• C.It is responsible for durable storage of client tokens
• D.It dynamically generates a unique set of secrets with appropriate permissions attached

Comment: *

Name: *

Email: *

Verification: *

Your team uses the Transit secrets engine to encrypt all data before writing it to a MySQL database server.
During testing, you manually retrieve ciphertext from the database and decrypt it to ensure the data can be read. After decrypting the data, you are worried something is wrong because the plaintext data isn't legible.
Why can you not read the original plaintext data after decrypting the ciphertext?
* $ vault write transit/decrypt/krausen-key ciphertext=vault:v1:8SDd3WHDOjf7mq69C.....
* Key Value
* --- -----
* plaintext Zml2ZSBzdGFyIHByYWN0aWNlIGV4YW1zIGJ5IGJyeWFuIGtyYXVzZW4=

• A.The incorrect key was selected when decrypting the ciphertext. Use the correct key to successfully read the data
• B.The incorrect key version was used to decrypt the data. Update the ciphertext and change the v1 to v3 to use the latest key version
• C.The plaintext is Base64 encoded. Decode the plaintext to see the original data
• D.The data was also encrypted on the database. Therefore Vault cannot decrypt the original data

Comment: *

Name: *

Email: *

Verification: *