Vault operators can create two types of groups in Vault. What are the two types?
Correct Answer: A,D
Comprehensive and Detailed In-Depth Explanation: In HashiCorp Vault, operators can create two distinct types of groups within the Identity secrets engine: external groupsandinternal groups. These groups are used to manage and organize users and policies, facilitating access control and permissions management. * External Groups: These groups are designed to integrate with external identity providers or systems, such as LDAP or OIDC (OpenID Connect). External groups allow Vault to map groups from these external systems to Vault policies, enabling seamless access control for users authenticated via external auth methods. They can be created manually or automatically mapped (e.g., from LDAP group memberships to Vault policies). This is particularly useful when managing users who exist outside of Vault's internal identity store but need access to Vault resources. The documentation states: "External groups are usually associated with an auth method, such as LDAP or OIDC." * Internal Groups: These are created and managed directly within Vault's identity store. Internal groups are used to organize Vault entities (representing users or machines) and assign policies to them manually. They are ideal for scenarios where user management is entirely within Vault's ecosystem, without reliance on external identity providers. The documentation explains: "Internal groups are created in the identity store and map to other groups or entities." * Incorrect Options: * Security Groups: This term is not used in Vault's context for group types. While security is a core concern, "security groups" do not represent a specific category of groups in Vault. * Policy Groups: Policies in Vault define permissions, but there is no concept of "policy groups" as a distinct group type. Policies are attached to groups, not grouped themselves in this manner. The distinction between external and internal groups enhances flexibility in managing authentication and authorization, aligning with Vault's design to support both internal and federated identity systems. Reference:https://developer.hashicorp.com/vault/docs/secrets/identity#external-vs-internal-groups
Question 57
What is the default TTL for tokens in Vault if one is not specified?
Correct Answer: C
Comprehensive and Detailed In-Depth Explanation: In HashiCorp Vault, thedefault TTL (Time To Live)for tokens, when not explicitly specified, is768 hours, equivalent to32 days. This applies to both the initial TTL and the maximum TTL unless overridden. * Default Configuration: The documentation states: "When no specific TTL is provided, a generated token will inherit the default TTL which is 768 hours (32 days)." This long default ensures usability in many scenarios while allowing customization. * Customization Option: Operators can adjust this using commands like vault write sys/mounts/auth /token/tune default_lease_ttl=1h max_lease_ttl=24h, but without such tuning, 768 hours applies. * Incorrect Options: * A. 24 hours: Too short for Vault's default; it's a common custom setting instead. * B. 15 minutes: Far too brief and not aligned with Vault's defaults. * D. 60 minutes: Another common custom value, not the default. This default balances usability with security, encouraging explicit configuration for shorter-lived tokens when needed. Reference:https://developer.hashicorp.com/vault/docs/concepts/tokens
Question 58
You want to generate a token with a TTL of 24 hours which can be renewed indefinitely. Which flag would you use on the following command? vault token create
Correct Answer: C
The correct flag is -period=24h because it creates a periodic token. A periodic token receives a fixed renewal period, and every renewal uses that period. As long as the token is actively renewed and no explicit maximum TTL is imposed, it can continue to be renewed indefinitely. The -ttl=24h flag only sets the initial TTL; normal token renewal is still constrained by maximum TTL values from the token, mount, auth method, parent token, or system configuration. The -explicit-max-ttl=0 option alone does not create a periodic token. The -orphan flag removes the parent relationship but does not make the token indefinitely renewable. HashiCorp's token create command documentation shows -period as the periodic-token flag.
Question 59
Which of the following actions can be performed if you only had access to a token's accessor? (Select four)
Correct Answer: A,B,D,E
Comprehensive and Detailed In-Depth Explanation: A token accessor allows: * A, B, D, E: "This accessor can only be used to perform limited actions: Look up a token's properties, Look up a token's capabilities on a path, Renew the token, Revoke the token." The calling token needs permissions. * Incorrect Option: * C: "Not including the actual token ID." Reference:https://developer.hashicorp.com/vault/docs/concepts/tokens#token-accessors
Question 60
Your company ' s security policies require that all encryption keys must be rotated at least once per year. After using the Transit secrets engine for a year, the Vault admin issues the proper command to rotate the key named ecommerce that was used to encrypt your data. What command can be used to easily re-encrypt the original data with the new version of the key?
Correct Answer: D
Comprehensive and Detailed in Depth Explanation: The Transit secrets engine in Vault manages encryption keys and supports key rotation. After rotating the ecommerce key, existing ciphertext (encrypted with the old key version) must be re-encrypted (rewrapped) with the new key version without exposing plaintext. Let's evaluate: * A: vault write -f transit/keys/ecommerce/rotate < old data > This command rotates the key, creating a new version, but does not re-encrypt existing data. It's for key management, not data rewrapping. Incorrect. * B: vault write -f transit/keys/ecommerce/update < old data > There's no update endpoint in Transit for re-encrypting data. This is invalid and incorrect. * C: vault write transit/encrypt/ecommerce v1:v2 < old data > The transit/encrypt endpoint encrypts new plaintext, not existing ciphertext. The v1:v2 syntax is invalid. Incorrect. * D: vault write transit/rewrap/ecommerce ciphertext= < old data > The transit/rewrap endpoint takes existing ciphertext, decrypts it with the old key version, and re-encrypts it with the latest key version (post-rotation). This is the correct command. For example, if < old data > is vault:v1:cZNHVx+..., the output might be vault:v2:kChHZ9w4.... Overall Explanation from Vault Docs: "Vault's Transit secrets engine supports key rotation... The rewrap endpoint allows ciphertext encrypted with an older key version to be re-encrypted with the latest key version without exposing the plaintext." This operation is secure and efficient, using the keyring internally. Reference: https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit-rewrap
