Select the two default policies created in Vault. (Select two)
Correct Answer: A,D
Comprehensive and Detailed in Depth Explanation: Vault creates two default policies upon initialization: root and default . The HashiCorp Vault documentation states: " Vault creates two default policies, root and default. The root policy cannot be deleted or modified. The default policy is attached to all tokens, by default, however, this action can be modified if needed. " The root policy grants unrestricted access for administrative tasks, while the default policy provides basic permissions for all tokens unless overridden. Policies like user , admin , base , and vault are not default; they must be explicitly created by users if needed. Thus, A (root) and D (default) are the correct selections. Reference: HashiCorp Vault Documentation - Policies: Built-in Policies
Question 67
What is true about the output of the following command (select three)?
Correct Answer: A,D,E
Comprehensive and Detailed in Depth Explanation: The command initializes Vault, splitting the master key into 3 shares (threshold 2) and encrypting each with PGP keys for Jane, John, and Student01. Let's analyze: * Option A: The admin never sees all the unseal keys and cannot unseal Vault by themselvesWith - pgp-keys, Vault encrypts each share with a user's public PGP key. The admin (initializer) sees only encrypted outputs (e.g., Key 1: <encrypted>), not plaintext keys. Since 2 shares are needed and no single entity gets all, the admin can't unseal alone. Correct.Vault Docs Insight:"The initializer receives encrypted keys... never sees all plaintext keys, enhancing security." (Directly stated.) * Option B: All three users, Jane/John/Student01, will receive all unseal keys and canunseal Vault Each user gets one encrypted share (e.g., Jane gets Key 1, John Key 2). No user receives all shares- only one, decryptable with their private key. Unsealing requires collaboration (2 of 3), so this is false. Incorrect.Vault Docs Insight:"Each PGP key encrypts one share... No single user gets all keys." (Distribution is per-user.) * Option C: The admin will receive the unseal keys and be able to unseal Vault themselvesWithout PGP, the admin gets plaintext keys. With -pgp-keys, they get encrypted keys they can't decrypt (lacking private keys). Threshold=2 means collaboration is required. Incorrect.Vault Docs Insight:"Using PGP keys ensures the initializer cannot unseal alone..." (Security feature.) * Option D: The keys will be returned encryptedThe -pgp-keys flag encrypts each share with the corresponding public key. Output shows encrypted blobs (e.g., base64-encoded PGP ciphertext), not plaintext. Correct.Vault Docs Insight:"Vault will generate the unseal keys and encrypt them using the given PGP keys..." (Explicit behavior.) * Option E: Each individual can only decrypt their own unseal key using their private PGP key Each share is encrypted with one user's public key (e.g., Jane's key encrypts Key 1). Only Jane's private key decrypts it. This ensures secure distribution. Correct.Vault Docs Insight:"Only the owner of the corresponding private key can decrypt the value..." (PGP security.) Detailed Mechanics: Command: vault operator init -key-shares=3 -key-threshold=2 -pgp-keys="jane.pgp,john.pgp,student01.pgp". Vault generates 3 shares via Shamir's Secret Sharing, encrypts each (Key 1 with jane.pgp, etc.), and outputs encrypted strings. Unsealing requires 2 decrypted shares combined via vault operator unseal. PGP ensures the admin can't access plaintext, enforcing split knowledge. Real-World Example: Output: Key 1: <encrypted-jane>, Key 2: <encrypted-john>, Key 3: <encrypted-student01>. Jane decrypts Key 1 with gpg -d, John decrypts Key 2. They submit via UI or CLI to unseal. Overall Explanation from Vault Docs: "Vault can optionally be initialized using PGP keys. In this mode, Vault will generate the unseal keys and immediately encrypt them using the given users' public PGP keys. Only the owner of the corresponding private key is able to decrypt the value... The initializer never sees all plaintext keys and cannot unseal Vault alone." This enhances security by distributing trust. Reference:https://developer.hashicorp.com/vault/docs/commands/operator/init#pgp-keys
Question 68
Without logging into another interface, what feature can Chad use to execute a simple CLI command to enable a new secrets engine?
Correct Answer: A
Comprehensive and Detailed in Depth Explanation: The Vault UI includes a feature allowing CLI commands to be executed directly within the interface, known as the CLI emulation or REPL (Read-Eval-Print Loop) terminal. The HashiCorp Vault documentation states: "The Vault GUI includes an advanced mode that uses a read-eval-print loop (REPL) terminal to mimic basic create/read/update/delete/list (CRUDL) commands for users who are more familiar with the Vault CLI than the GUI." This feature enables Chad to run a command like vault secrets enable <engine> without switching to a separate CLI, fulfilling the requirement. The documentation under "Explore the Vault UI" adds: "This terminal allows users to execute Vault CLI commands directly from the web interface, enhancing usability for those accustomed to CLI workflows." Options like user information (B), client count details (C), and access management (D) do not provide CLI execution capabilities. Thus, A is correct. Reference: HashiCorp Vault Documentation - Getting Started UI: Explore the Vault UI
Question 69
Your organization has enabled the LDAP auth method on the path of corp-auth/. When you access the Vault UI, you cannot log in despite providing the correct credentials. Based on the screenshot below, what action should you take to log in?
Correct Answer: C
Comprehensive and Detailed In-Depth Explanation: When an auth method like LDAP is mounted at a non-default path (e.g., corp-auth/), the Vault UI requires specifying that path. The Vault documentation implies this via CLI examples, and UI behavior confirms it: " If a backend was mounted using a non-default path, you need to provide it under the Mount Path option under More Options. " - Vault Tutorials: Getting Started UI (Implied) * C : Correct. Clicking "More Options" and entering corp-auth/ directs the UI to the LDAP method: " By entering the mount path, you are directing Vault to use the LDAP auth method configured on that specific path for authentication. " - Vault Auth: LDAP * A : Dropdowns typically list methods, not paths; incorrect assumption. * B : Username doesn't include the path in this context. * D : Namespace is unrelated to auth mount paths. References: Vault Tutorials: Getting Started UI Vault Auth: LDAP
Question 70
You have been tasked with writing a policy that will allow read permissions for all secrets at path secret/bar. The users that are assigned this policy should also be able to list the secrets. What should this policy look like?
Correct Answer: C
This policy would allow read permissions for all secrets at path secret/bar, as well as list permissions for the secret/bar/ path. The list permission is required to be able to see the names of the secrets under a given path 1 . The wildcard ( ) character matches any number of characters within a single path segment, while the slash (/) character matches the end of the path 2 . Therefore, the policy would grant read access to any secret that starts with secret/bar/, such as secret/bar/foo or secret/bar/baz, but not to secret/bar itself. To grant list access to secret/bar, the policy needs to specify the exact path with a slash at the end. This policy follows the principle of least privilege, which means that it only grants the minimum permissions necessary for the users to perform their tasks 3 . The other options are not correct because they either grant too much or too little permissions. Option A would grant both read and list permissions to all secrets under secret/bar, which is more than what is required. Option B would grant list permissions to all secrets under secret/bar, but only read permissions to secret/bar itself, which is not what is required. Option D would use an invalid character (+) in the policy, which would cause an error. : Policy Syntax | Vault | HashiCorp Developer Policy Syntax | Vault | HashiCorp Developer Policies | Vault | HashiCorp Developer
