HashiCorp Certified: Vault Associate VA-002-P Exam Dumps

HashiCorp Certified: Vault Associate VA-002-P exam information can help you understand the test well. The VA-002-P exam format is multiple-choice, and the exam duration is 1 hour. The exam price is $70.5. The available language is English. Vault Associate certification is valid for 2 years. We provide the latest HashiCorp Certified: Vault Associate VA-002-P exam dumps, which are valid in preparation. Free HashiCorp Certified: Vault Associate VA-002-P exam dumps are available below.

Page 1 of 2

1. You are using the Vault userpass auth method mounted at auth/userpass.

How do you create a new user named "sally" with password "h0wN0wB4r0wnC0w"? This new user will need the power-users policy.

A)





B)





C)





D)

Option A

Option B

Option C

Option D

 Loading...

2. The vault lease renew command increments the lease time from:

The current time

The end of the lease

 Loading...

3. HOTSPOT

Where do you define the Namespace to log into using the Vault Ul?

To answer this question

Use your mouse to click on the screenshot in the location described above. An arrow indicator will mark where you have clicked. Click the "Answer" button once you have positioned the arrow to answer the question. You may need to scroll down to see the entire screenshot.

 Loading...

4. You have a 2GB Base64 binary large object (blob) that needs to be encrypted.

Which of the following best describes the transit secrets engine?

A data key encrypts the blob locally, and the same key decrypts the blob locally.

To process such a large blob. Vault will temporarily store it in the storage backend.

Vault will store the blob permanently. Be sure to run Vault on a compute optimized machine

The transit engine is not a good solution for binaries of this size.

 Loading...

5. How would you describe the value of using the Vault transit secrets engine?

Vault has an API that can be programmatically consumed by applications

The transit secrets engine ensures encryption in-transit and at-rest is enforced enterprise wide

Encryption for application data is best handled by a storage system or database engine, while storing encryption keys in Vault

The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault

 Loading...

6. What is the Vault CLI command to query information about the token the client is currently using?

vault lookup token

vault token lookup

vault lookup self

vault self-lookup

 Loading...

7. Which of the following is a machine-oriented Vault authentication backend?

Okta

AppRole

Transit

GitHub

 Loading...

8. Security requirements demand that no secrets appear in the shell history.

Which command does not meet this requirement?

A. generate-password | vault kv put secret/password value

B. vault kv put secret/password value-itsasecret

C. vault kv put secret/password [email protected]

D. vault kv put secret/password value-SSECRET_VALUE

 Loading...

9. You can build a high availability Vault cluster with any storage backend.

True

False

 Loading...

10. What command creates a secret with the key "my-password" and the value "53cr3t" at path "my-secrets" within the KV secrets engine mounted at "secret"?

vault kv put secret/my-secrets/my-password 53cr3t

vault kv write secret/my-secrets/my-password 53cr3t

vault kv write 53cr3t my-secrets/my-password

vault kv put secret/my-secrets »y-password-53cr3t

 Loading...

Page 2 of 2

11. What can be used to limit the scope of a credential breach?

Storage of secrets in a distributed ledger

Enable audit logging

Use of a short-lived dynamic secrets

Sharing credentials between applications

 Loading...

12. What environment variable overrides the CLI's default Vault server address?

VAULT_ADDR

VAULT_HTTP_ADORESS

VAULT_ADDRESS

VAULT _HTTPS_ ADDRESS

 Loading...

13. Which of the following statements describe the CLI command below?

S vault login -method-1dap username-mitche11h

Generates a token which is response wrapped

You will be prompted to enter the password

By default the generated token is valid for 24 hours

Fails because the password is not provided

 Loading...

14. The following three policies exist in Vault.

What do these policies allow an organization to do?

Separates permissions allowed on actions associated with the transit secret engine

Nothing, as the minimum permissions to perform useful tasks are not present

Encrypt, decrypt, and rewrap data using the transit engine all in one policy

Create a transit encryption key for encrypting, decrypting, and rewrapping encrypted data

 Loading...

15. Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool.

Which secrets engine would you recommend?

Google Cloud Secrets Engine

Identity secrets engine

Key/Value secrets engine version 2

SSH secrets engine

 Loading...

16. Which of these is not a benefit of dynamic secrets?

Supports systems which do not natively provide a method of expiring credentials

Minimizes damage of credentials leaking

Ensures that administrators can see every password used

Replaces cumbersome password rotation tools and practices

 Loading...

17. Which of the following cannot define the maximum time-to-live (TTL) for a token?

By the authentication method t natively provide a method of expiring credentials

By the client system f credentials leaking

By the mount endpoint configuration very password used

A parent token TTL e password rotation tools and practices

System max TTL

 Loading...

18. What are orphan tokens?

Orphan tokens are tokens with a use limit so you can set the number of uses when you create them

Orphan tokens are not children of their parent; therefore, orphan tokens do not expire when their parent does

Orphan tokens are tokens with no policies attached

Orphan tokens do not expire when their own max TTL is reached

 Loading...

 Loading...