Secrets engines Questions
Practice questions for Secrets engines topic in HashiCorp Certified: Vault Associate (003). 40 questions covering this domain.
One team asks whether a secrets engine mounted at one path can read raw storage data belonging to another secrets engine mount. Which answer is correc...
An application needs temporary AWS IAM credentials issued by Vault for a limited time. Which secrets engine best fits the use case?
A security architect wants to deliver a secret through an intermediary without exposing the actual secret material to that intermediary. Which Vault f...
A team wants credentials that Vault generates on demand and revokes automatically after a limited lifetime. Which type of secret fits this requirement...
An operator disables a secrets engine mount that has been issuing dynamic credentials. What is the direct effect?
A security team wants separate instances of the same secrets engine for two departments with different paths and policies. Is this supported?
A developer needs Vault to perform cryptographic operations while the application stores only ciphertext externally. Which secrets engine should be us...
A database team wants Vault to generate temporary usernames and passwords for applications. Which secrets engine should they use?
Which secrets engine version supports versioning and soft deletes for stored data?
A temporary database credential issued by Vault is revoked before its lease naturally expires. What should the application team expect?
A team enables KV at kv/ and again at KV/ for two experiments. How does Vault interpret those mount paths?
An operator accidentally soft-deletes version 3 of a KV v2 secret and later decides that version 3 must be permanently erased without removing the oth...
A node expects a wrapping token during bootstrapping, but sys/wrapping/lookup says the token is already invalid before the node unwraps it. According ...
A bootstrap process receives a wrapping token instead of the actual secret. What validation step is especially important before unwrapping?
A platform team wants to mount one engine at foo and another at foo/baz. What is the correct outcome?
A team wants to prevent one client from overwriting a KV v2 secret version unexpectedly. Which feature helps most directly?
Which secrets engine underpins Vault identity features such as entities and groups?
A database secrets engine is moved from ops-db/ to prod-db/. What should the operator expect?
Which statement accurately contrasts KV v1 and KV v2?
A workflow wraps an authentication response and wants to manage the lifetime of the inner Vault token without unwrapping it. Which wrap field is desig...
Sign in to see all 40 questions
Create a free account to browse all questions — completely free during our launch phase.