Skip to content

Secrets engines Questions

Practice questions for Secrets engines topic in HashiCorp Certified: Vault Associate (003). 40 questions covering this domain.

40 questions12 easy20 medium8 hard
Q1
hard

One team asks whether a secrets engine mounted at one path can read raw storage data belonging to another secrets engine mount. Which answer is correc...

Q2
medium

An application needs temporary AWS IAM credentials issued by Vault for a limited time. Which secrets engine best fits the use case?

Q3
medium

A security architect wants to deliver a secret through an intermediary without exposing the actual secret material to that intermediary. Which Vault f...

Q4
easy

A team wants credentials that Vault generates on demand and revokes automatically after a limited lifetime. Which type of secret fits this requirement...

Q5
medium

An operator disables a secrets engine mount that has been issuing dynamic credentials. What is the direct effect?

Q6
medium

A security team wants separate instances of the same secrets engine for two departments with different paths and policies. Is this supported?

Q7
medium

A developer needs Vault to perform cryptographic operations while the application stores only ciphertext externally. Which secrets engine should be us...

Q8
easy

A database team wants Vault to generate temporary usernames and passwords for applications. Which secrets engine should they use?

Q9
easy

Which secrets engine version supports versioning and soft deletes for stored data?

Q10
hard

A temporary database credential issued by Vault is revoked before its lease naturally expires. What should the application team expect?

Q11
easy

A team enables KV at kv/ and again at KV/ for two experiments. How does Vault interpret those mount paths?

Q12
hard

An operator accidentally soft-deletes version 3 of a KV v2 secret and later decides that version 3 must be permanently erased without removing the oth...

Q13
hard

A node expects a wrapping token during bootstrapping, but sys/wrapping/lookup says the token is already invalid before the node unwraps it. According ...

Q14
medium

A bootstrap process receives a wrapping token instead of the actual secret. What validation step is especially important before unwrapping?

Q15
medium

A platform team wants to mount one engine at foo and another at foo/baz. What is the correct outcome?

Q16
easy

A team wants to prevent one client from overwriting a KV v2 secret version unexpectedly. Which feature helps most directly?

Q17
easy

Which secrets engine underpins Vault identity features such as entities and groups?

Q18
medium

A database secrets engine is moved from ops-db/ to prod-db/. What should the operator expect?

Q19
medium

Which statement accurately contrasts KV v1 and KV v2?

Q20
medium

A workflow wraps an authentication response and wants to manage the lifetime of the inner Vault token without unwrapping it. Which wrap field is desig...

Sign in to see all 40 questions

Create a free account to browse all questions — completely free during our launch phase.