HashiCorp Certified: Vault Associate (003) - Blueprint Practice Exam 1

1. A child token must remain independent of its original parent's revocation tree. Which token property addresses this requirement?
2. A client successfully authenticates to Vault but cannot read a particular secret. What does this demonstrate?
3. A company evaluates Vault performance replication and disaster recovery replication. What is the important distinction?
4. A deployment system must hand a sensitive response to another process without directly exposing it in the handoff channel. Which feature supports a short-lived, single-use handoff?
5. A developer configures VAULT_ADDR to point the CLI at a production cluster. What does that variable control?
6. A developer stores a manually managed password in KV v2 and expects lease expiry to rotate the external password. What is the mistake?
7. A Kubernetes team wants selected Vault values synchronized into Kubernetes Secrets using declarative custom resources. Which component fits?
8. A legacy service reads its database password from a local configuration file and cannot call Vault directly. Which capability can help?
9. A person authenticates to Vault through two approved methods. The team wants to represent that person consistently and associate their identities. Which feature fits?
10. A renewable service token reaches its maximum allowed lifetime. What should the client be prepared to do?
11. A security operator has a token accessor but not the token value. What is a legitimate use of the accessor?
12. A self-managed Vault deployment must continue serving requests if its active node fails. Which design addresses node availability?
13. A self-managed Vault server starts in a sealed state. Which statement explains the limitation?
14. A service uses Vault Agent auto-auth with renewable credentials. What responsibility can the agent reduce for the application?
15. A Shamir-sealed Vault cluster requires three of five key shares to unseal. How many distinct valid shares meet that threshold?
16. A short-lived task needs a lightweight token that does not require per-token persistence and will not be renewed. Which type is designed for this pattern?
17. A team considers using Vault's development server for production secrets. What is the main concern?
18. A team finishes initial Vault setup and begins routine application use. What should it do with the initial root token?
19. A team synchronizes secrets from Vault into Kubernetes Secrets. Which security consideration remains essential?
20. A transit key is rotated to a new version. What normally happens to existing ciphertext when older key versions remain permitted?
21. A Vault cluster uses auto-unseal with an external KMS. What operational dependency must be considered?
22. A Vault cluster uses integrated storage. What should the team plan for when protecting recovery capability?
23. A Vault deployment serves applications running on AWS. The team wants applications to use established workload identities instead of distributing static Vault credentials. Which method is a suitable candidate?
24. A Vault token has no policy granting access to a requested path. What is the normal authorization result?
25. A worker still needs its renewable dynamic secret shortly before expiry. What should it do?
26. An administrator enables an auth method at a custom mount path. A user attempts the method's default login path and receives a missing-path error. What should be checked first?
27. An application can read a KV v2 secret using the CLI but a custom HTTP client gets denied at secret/payments. Which detail should the developer verify?
28. An application needs a unique short-lived database login for each job rather than sharing one fixed password. Which engine category fits?
29. An application needs ciphertext updated to the latest transit key version without receiving plaintext in the migration process. Which operation fits?
30. An application needs to read an existing KV v2 secret at secret/data/payments and must not modify it. Which policy capability is appropriate on that data path?
31. An application receives dynamic database credentials and an associated lease ID. What does the lease represent?
32. An application wants Vault to perform cryptographic operations while it stores the resulting ciphertext in its own database. Which engine fits?
33. An engineer signs in to Vault using a corporate identity provider, while a batch process authenticates without a human browser session. What should guide their authentication methods?
34. An incident involves one set of dynamically issued database credentials. What is the appropriate Vault lifecycle operation when immediate invalidation is needed?
35. An operator disables a secrets engine mount that has issued dynamic credentials. What important effect should be anticipated?
36. An operator enables two instances of the same secrets engine at different mount paths. How should the instances be understood?
37. An operator must view a list of child names at an allowed path but must not read secret values. Which capability should be evaluated?
38. An operator soft-deletes a KV v2 secret version and later needs its value. Which distinction matters?
39. Two applicable policies both match a requested Vault path. One explicitly denies the operation. What is the effect of that deny?
40. Two clients update the same KV v2 secret. The team wants to reject writes based on a stale version. Which feature fits?

Comments — 0