VA-002-P Online Practice Questions and Answers

Correct Answer: D

After authenticating, a client is issued a security token which is associated with a policy. That token is used to make a subsequent request to Vault, such as read, write, etc.

Correct Answer: A

The -prefix flag treats the ID as a prefix instead of an exact lease ID. This can revoke multiple leases simultaneously.

Correct Answer: B

Storage backends are not trusted by Vault and are only expected to render durability. The storage backend

is configured when starting the Vault server.

Reference link:- https://www.vaultproject.io/docs/internals/architecture

Correct Answer: B

The lease command groups subcommands for interacting with leases attached to secrets.

Subcommands:

renew Renews the lease of a secret

revoke Revokes leases and secrets

Using the '-prefix' flag allows you to revoke the entire tree of secrets.

Correct Answer: A

Wildcards and path segments can be used to allow access to a broader set of secrets rather than having to call out each individual secret itself. None of the other policies will allow a client to actually read the data stored at the path secrets/applications/app01/api_key

Correct Answer: C

In this particular question, a VPC endpoint can provide private connectivity to an AWS service without having to traverse the public internet. This way you hit a private endpoint for the service rather than connecting to the public endpoint. This is more of an AWS-type question, but the underlying premise still holds regardless of where your Vault cluster is deployed. If you use a public cloud KMS solution, such as AWS KMS, Azure Key Vault, GCP Cloud KMS, or AliCloud KMS, your Vault cluster will need the ability to communicate with that service to unseal itself.

Correct Answer: B

The current implementation of Terraform import can only import resources into the state. It does not

generate a configuration. Because of this, and prior to running terraform import, it is necessary to manually

write a resource configuration block for the resource to which the imported object will be mapped.

First, add the resources to the configuration file:

resource "aws_instance" "example" {

# ...instance configuration...

}

Then run the following command:

$ terraform import aws_instance.example i-abcd1234

Correct Answer: D

count is a reserved word. The count parameter on resources can simplify configurations and let you scale resources by simply incrementing a number. https://www.terraform.io/intro/examples/count.html