Which auth method is ideal for machine-to-machine authentication?
Correct Answer: D
Comprehensive and Detailed in Depth Explanation: For machine-to-machine authentication,AppRoleis the ideal method. The HashiCorp Vault documentation states: "Although it's not the only method for applications, the ideal method for machine-to-machine authentication is AppRole. The other options are frequently reserved for human access." AppRole allows machines or services to authenticate using a role ID and secret ID, providing a secure, automated approach without human intervention. The documentation elaborates: "The AppRole auth method provides a workflow tailored to machine-to- machine authentication. It allows applications to authenticate with Vault-defined roles and retrieve a token." Okta,UserPass, andGitHubare better suited for human users, not automated systems. Thus, D (AppRole) is correct. Reference: HashiCorp Vault Documentation - AppRole Auth Method
Question 42
Which of the following statements are true regarding Vault seal and unseal (select three)?
Correct Answer: A,C,D
Comprehensive and Detailed in Depth Explanation: * A:Vault uses Shamir's Secret Sharing by default for unseal keys. Correct. * B:Auto Unseal uses KMS or similar; it returns recovery keys, not unseal keys. Incorrect. * C:Third-party KMS (e.g., AWS KMS) can auto-unseal Vault. Correct. * D:Auto Unseal supports HA with multiple keys for redundancy. Correct. Overall Explanation from Vault Docs: "Vault uses Shamir's algorithm by default... Auto Unseal with KMS supports HA and does not return unseal keys but recovery keys." Reference:https://developer.hashicorp.com/vault/docs/concepts/seal#seal-unseal
Question 43
Which is true about Vault authentication responses when using the Vault API?
Correct Answer: D
When a client authenticates to Vault through the API, Vault returns a client token. That token is then used to authorize later API requests. Unlike the CLI and UI, the raw HTTP API does not automatically remember or reuse the token for the client. The caller must explicitly send the token in the request header, normally as X- Vault-Token: < token > or as a bearer token. Option A is false because Vault authentication can be performed through the API. Option B is false because most useful Vault API endpoints require authentication. Option C is wrong because deleting the token would prevent further authenticated requests. HashiCorp's token authentication documentation confirms that API authentication requires passing the token in the request header.
Question 44
By default, what happens to child tokens when a parent token is revoked?
Correct Answer: A
Comprehensive and Detailed in Depth Explanation: By default, when a parent token is revoked, all child tokens are also revoked. The HashiCorp Vault documentation (via support article) states: " When a parent token is revoked, all of its child tokens-and all of their leases-are revoked as well. This ensures that a user cannot escape revocation by simply generating a never-ending tree of child tokens. " This hierarchical revocation ensures security by terminating all derived access when the parent is invalidated. The documentation on tokens adds: " Tokens in Vault are part of a hierarchy. Child tokens inherit properties from their parents, and revoking a parent token cascades to its children. " Options like renewal, conversion to parent tokens, or creating new child tokens do not occur by default. Thus, A is correct. Reference: HashiCorp Support - Parent-Child Token Hierarchy HashiCorp Vault Documentation - Tokens
Question 45
What API endpoint is used to manage secrets engines in Vault?
Correct Answer: B
Comprehensive and Detailed in Depth Explanation: Vault's API provides endpoints for managing its components, including secrets engines, which generate and manage secrets (e.g., AWS, KV, Transit). Managing secrets engines involves enabling, disabling, tuning, or listing them. Let's evaluate: * Option A: /secret-engines/ This is not a valid Vault API endpoint. Vault uses /sys/ for system-level operations, and no endpoint named /secret-engines/ exists in the official API documentation. It's a fabricated path, possibly a misunderstanding of secrets engine management. Incorrect. * Option B: /sys/mounts This is the correct endpoint. The /sys/mounts endpoint allows operators to list all mounted secrets engines (GET), enable a new one (POST to /sys/mounts/ < path > ), or tune existing ones (POST to /sys/mounts/ < path > /tune). For example, enabling the AWS secrets engine at aws/ uses POST /v1/sys/mounts/aws with a payload specifying the type (aws). This endpoint is the central hub for secrets engine management. Correct. * Option C: /sys/capabilities The /sys/capabilities endpoint checks permissions for a token on specific paths (e.g., what capabilities like read or write are allowed). It's unrelated to managing secrets engines-it's for policy auditing, not mount operations. Incorrect. * Option D: /sys/kv There's no /sys/kv endpoint. The KV secrets engine, when enabled, lives at a user- defined path (e.g., kv/), not under /sys/. System endpoints under /sys/ handle configuration, not specific secrets engine instances. Incorrect. Detailed Mechanics: The /sys/mounts endpoint interacts with Vault's mount table, a registry of all enabled backends (auth methods and secrets engines). A GET request to /v1/sys/mounts returns a JSON list of mounts, e.g., { " kv/ " : { " type " : " kv " , " options " : { " version " : " 2 " }}}. A POST request to /v1/sys/mounts/my-mount with { " type " : " kv " } mounts a new KV engine. Tuning (e.g., setting TTLs) uses /sys/mounts/ < path > /tune. This endpoint' s versatility makes it the go-to for secrets engine management. Real-World Example: To enable the Transit engine: curl -X POST -H " X-Vault-Token: < token > " -d ' { " type " : " transit " } ' http://127.0.0.1:8200/v1/sys/mounts/transit. To list mounts: curl -X GET -H " X-Vault-Token: < token > " http://127.0.0.1:8200/v1/sys/mounts. Overall Explanation from Vault Docs: "The /sys/mounts endpoint is used to manage secrets engines in Vault... List, enable, or tune mounts via this system endpoint." Reference: https://developer.hashicorp.com/vault/api-docs/system/mounts
