HashiCorp Certified: Vault Associate (003)Exam - HCVA0-003 Exam Practice Test

Question 1

What API endpoint is used to enable and configure a secrets engine?

A. /v1/sys/mounts

B. /v1/sys/init

C. /v1/sys/plugins/catalog

D. /v1/sys/config

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

You have enabled the database secrets engine at the database/ path and created the readonly role. You run vault read, and the output shown in the exhibit is returned.
Which command renews the given lease?
Exhibit:
$ vault read database/creds/readonly
lease_id database/creds/readonly/fyF5xDomnKeCHNZNQgStwBKD
lease_duration 1h
lease_renewable true
password Ala-ckirtymYaXACplHn
username v-token-readonly-6iRIcGv8tLpu816oblPY-1556567086

A. vault lease renew database/creds/readonly/fyF5xDomnKeCHNZNQgStwBKD

B. vault lease renew database/creds/readonly/

C. vault lease renew

D. Leases with the parameter lease_renewable set to true are renewed automatically.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is AWS.

A. True

B. False

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

You are the primary Vault operator. During a routine audit, an auditor requested the ability to display all secrets under a specific path in Vault without seeing the actual stored data. Which policy permits the auditor to display the stored secrets without revealing their contents?

A. path " kv/apps/* " { capabilities = [ " list " , " read " ] }

B. path " kv/+/production " { capabilities = [ " list " ] }

C. path " kv/apps/production/ " { capabilities = [ " list " ] }

D. path " kv/apps/+/ " { capabilities = [ " list " ] }

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

What command can be used to revoke all leases associated with a database role named prod-mysql?

A. vault lease revoke database/role/prod-mysql

B. vault lease revoke -prefix database/creds/prod-mysql

C. vault lease revoke database/creds/prod-mysql

D. vault revoke database/role/prod-mysql

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

You want to encrypt a credit card number using the Transit secrets engine. You enter the following command and receive an error. What can you do to ensure that the credit card number is properly encrypted and the ciphertext is returned?
$ vault write -format=json transit/encrypt/creditcards plaintext= " 1234 5678 9101 1121 " Error: * illegal base64 data at input byte 4

A. The token used to issue the encryption request does not have the appropriate permissions

B. The plain text data needs to be encoded to base64

C. The credit card number should not include spaces

D. Credit card numbers are not supported using the Transit secrets engine since it is considered sensitive data

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

All Vault instances, or clusters, include two built-in policies that are created automatically. Choose the two policies below and the correct information regarding each policy. (Select two)

A. The default policy is created automatically. This policy can be modified but not deleted

B. The default policy is created automatically. This policy cannot be modified but it can be deleted

C. The admin policy is created automatically. It provides administrative permissions but can be deleted if needed

D. The root policy is created automatically. This policy provides superuser privileges and cannot be deleted

Correct Answer: A,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

A developer has requested access to manage secrets at the path kv/apps/webapp01. You create the policy below which gives them the proper access:
path " kv/apps/webapp01 " {
capabilities = [ " read " , " create " , " update " , " list " ]
}
However, when the developer logs in to the Vault UI, they see the following screenshot and cannot access the desired secret. Why can't the developer see the secrets they need?

A. The secrets are stored under the cubbyhole secrets engine, so the developer should browse to that secrets engine

B. The policy doesn't permit list access to the paths prior to the secret so the Vault UI doesn't display the mount path

C. The Vault UI isn't enabled for the developer, therefore they will only see the default options

D. The key/value secrets engine isn't available in the Vault UI, therefore the developer should use a different Vault interface instead

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

Assuming default configurations, which of the following operations require a threshold of key shares to perform? (Select three)

A. Rotating the Vault encryption key to adhere to internal security policies

B. Generating a new root token as a break-glass procedure

C. Unsealing Vault after a scheduled maintenance to install patches

D. Creating a new set of recovery keys due to an employee leaving the organization

Correct Answer: B,C,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Your organization audited an essential application and found it isn't securely storing data. For added security, auditors recommended encrypting all data before storing it in a backend database, and the application server should not store encryption keys locally. Which secrets engine meets these requirements?

A. PKI secrets engine

B. Cubbyhole secrets engine

C. Transit secrets engine

D. SSH secrets engine

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

Which of the following are considered benefits of using policies in Vault? (Select three)

A. Policies have an implicit deny, meaning that policies are deny by default

B. Policies are assigned to a token on a 1:1 basis to eliminate conflicting policies

C. Policies provide Vault operators with role-based access control

D. Provides granular access control to paths within Vault

Correct Answer: A,C,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 12

Examine the command below. Output has been trimmed.

Which of the following statements describe the command and its output?

A. Generated token is an orphan token which can be renewed indefinitely

B. Generated token ' s TTL is 60 hours

C. Missing a default token policy

D. Configures the AppRole auth method with user specified role ID and secret ID

Correct Answer: A,B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 13

A web application uses Vault ' s transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit which of the following statements are true? Choose two correct answers.

A. The Vault administrator would need to seal the Vault server immediately

B. Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)

C. You can rotate the encryption key so that the attacker won't be able to decrypt the data

D. The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted

Correct Answer: B,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 14

You are using Vault to generate dynamic credentials for a Microsoft SQL server to perform queries for a month-end report. The report seems to be taking much longer than expected due to degradation on the underlying server, and you are afraid that Vault might automatically revoke the credentials. How can you extend the time the credentials are valid to ensure your month-end query is successful?

A. Renew the lease

B. Generate a new lease

C. Revoke the lease

D. Create a new role within the secrets engine for the database

Correct Answer: A

HashiCorp Certified: Vault Associate (003)Exam - HCVA0-003 Exam Practice Test

Latest Update

Useful Links

Contact Us