Get Apr-2026 updated Vault-Associate-002 Certification Exam Sample Questions
Vault-Associate-002 Study Guide Cover to Cover as Literally
NEW QUESTION # 29
Vault supports which type of configuration for source limited token?
- A. CIDR-bound tokens
- B. Cloud-bound tokens
- C. Domain-bound tokens
- D. Certificate-bound tokens
Answer: A
NEW QUESTION # 30
What does the following policy do?
- A. Allows a user to read data about the secret endpoint identity
- B. Grants access to a special system entity folder
- C. Grants access for each user to a KV folder which shares their id
- D. Nothing, this is not a valid policy
Answer: C
NEW QUESTION # 31
Which of the following is a machine-oriented Vault authentication backend?
- A. GitHub
- B. Okta
- C. Transit
- D. AppRole
Answer: D
NEW QUESTION # 32
One of the benefits of using the Vault transit secrets engine is its ability to easily rotate encryption keys. Which of these is true regarding key rotation?
- A. Encryption keys can be rotated manually by a user, or by an automated process which invokes the key rotation API
- B. Vault can rotate encryption keys, but cannot enforce restrictions about the minimum encryption key version
- C. Vault does not maintain the versioned keyring
- D. Vault automatically rotates the encryption key based on a set period
Answer: A
NEW QUESTION # 33
What attributes are unique to batch tokens? (Choose three.)
- A. Are not persisted
- B. Cannot be renewed
- C. Can be periodic
- D. Are persisted
- E. Have a set time-to-live (TTL)
Answer: A,B,E
NEW QUESTION # 34
You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?
- A. Vault will store the blob permanently. Be sure to run Vault on a compute optimized machine.
- B. A data key encrypts the blob locally, and the same key decrypts the blob locally.
- C. The transit engine is not a good solution for binaries of this size.
- D. To process such a large blob. Vault will temporarily store it in the storage backend.
Answer: C
NEW QUESTION # 35
Use this screenshot to answer the question below:
When are you shown these options in the GUI?
- A. Enabling authentication engines
- B. Enabling authentication methods
- C. Enabling policies
- D. Enabling secret engines
Answer: D
NEW QUESTION # 36
Which statement describes the results of this command: vault kv list secret/test?
- A. Output all key names from all key/value secrets engine
- B. Output all key/value secrets engines
- C. Check the status of a specific key/value secrets engine
- D. List the existing key names at the "secret/test" path
Answer: D
NEW QUESTION # 37
Using the Vault CLI, what command is used to authenticate to Vault?
- A. vault user
- B. vault auth
- C. vault login
- D. vault creds
Answer: C
NEW QUESTION # 38
Hotspot Question
For the following statements, choose which secrets engine enables the use case.
Each answer should only be used once.
Answer:
Explanation:
NEW QUESTION # 39
When enabling auto-unseal, how do you specify the seal type? (Choose two.)
- A. Use the /sys/sealendpoint on the Vault API
- B. Configure in the storageblock of the server configuration file
- C. Create a sealblock in the server configuration file
- D. Use the vaultoperatorcommand
- E. Set the VAULT_SEAL_TYPEenvironment variable
Answer: C,D
NEW QUESTION # 40
Which statement describes the results of this command: $ vault secrets enable transit?
- A. Fails because the transit secrets engine is enabled by default
- B. Fails due to missing -path parameter
- C. Enables the transit secrets engine at transit path
- D. Requires a root token to execute the command successfully
- E. Enables the transit secrets engine at secret path
Answer: C
NEW QUESTION # 41
Which statement describes the results of this command: $ vault secrets enable - version=2 kv(Choose two.)
- A. Enables the secrets engine at path kv2/
- B. Enables K/V v1 secrets engine
- C. Enables K/V v2 secrets engine
- D. The -versionis an invalid flag
- E. Enables the secrets engine at path kv/
Answer: C,E
NEW QUESTION # 42
Use this screenshot to answer the question below:
Which statement describes this AppRole auth method configuration?
- A. Generates multiple tokens with TTL set to 5 minutes
- B. It is enabled at "auth_approle_f23dd79f" path
- C. Generates batch tokens with TTL set to 5 minutes
- D. It is enabled at "App1" path
Answer: C
NEW QUESTION # 43
When using Integrated Storage, which of the following should you do to recover from possible data loss?
- A. Use snapshot
- B. Use local storage
- C. Use external storage
- D. Enable audit device
Answer: A
NEW QUESTION # 44
Which of the following statements are true about Vault policies? (Choose two.)
- A. You must use YAML to define policies
- B. The default policy can not be modified
- C. Vault must be restarted in order for a policy change to take an effect
- D. Policies deny by default (empty policy grants no permission)
- E. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault
Answer: D,E
NEW QUESTION # 45
An organization would like to use a scheduler to track & revoke access granted to a job (by Vault) at completion.
What auth-associated Vault object should be tracked to enable this behavior?
- A. Token accessor
- B. Authentication method
- C. Lease ID
- D. Token ID
Answer: A
NEW QUESTION # 46
Why might an application be mapped to an identity entity?
- A. To prohibit Vault administrators from revoking tokens associated with that application
- B. To allow the same application in one cloud to access already provisioned Vault tokens for that application in another clo
- C. To get around cloud license limitations
- D. To allow an application deployed with multiple authentication methods have a consistent set of policies
Answer: D
NEW QUESTION # 47
Which of the following is a reason to rekey a Vault cluster? (Choose two.)
- A. The rook token is lost
- B. A keyholder joins or leaves the organization
- C. A compliance mandate to rotate the master key at a regular interval
- D. Adding additional Vault nodes to a cluster
- E. Upgrading Vault Community Edition to Vault Enterprise
Answer: B,C
NEW QUESTION # 48
What can be used to limit the scope of a credential breach?
- A. Use of a short-lived dynamic secrets
- B. Sharing credentials between applications
- C. Storage of secrets in a distributed ledger
- D. Enable audit logging
Answer: A
NEW QUESTION # 49
What information is required to revoke a Vault lease?
- A. Secret ID
- B. User ID
- C. Lease ID
- D. Token ID
Answer: C
NEW QUESTION # 50
You manage two Vault dusters: "vaultduster1.acme.corp" and "vaultduster2.acme.corp". You want to write a secret to the first Vaultcluster vaultcluster1.acme.corp and run vault kv put secret/foo value='bar'. The command times out and the error references the Vault cluster, "vaultcluster2.acme.corp".
You run the command again with the following address flag:
vault kv put -address='https://vaultcluster1.acme.corp' secret/foo
value='bar'
The command completes successfully. You find that the terminal session defines the environment variable VAULT_ADDR='https://vaultcluster2.acxe.corp:8200' Why was the second attempt successful?
- A. Environment variables take precedence over flags
- B. Flags take precedence over environment variables
- C. VAULT_CLUSTER_ADDRneeds to be provided
- D. Vault listener is misconfigured
Answer: B
NEW QUESTION # 51
What command creates a secret with the key "my-password" and the value "53cr3t" at path "my- secrets" within the KV secrets engine mounted at "secret"?
- A. vault kv put secret/my-secrets my-password-53cr3t
- B. vault kv put secret/my-secrets/my-password 53cr3t
- C. vault kv write 53cr3t my-secrets/my-password
- D. vault kv write secret/my-secrets/my-password 53cr3t
Answer: B
NEW QUESTION # 52
What is the Vault CLI command to query information about the token the client is currently using?
- A. vault lookup self
- B. vault token lookup
- C. vault lookup token
- D. vault self lookup
Answer: B
NEW QUESTION # 53
You have manually created some usernames and passwords for a Microsoft SQL database on Azure, and need to store these credentials in Vault. What secrets engine should you use for this?
- A. Azure secrets engine
- B. Key/Value secrets engine version 2
- C. MSSQL database secrets engine
- D. Transit engine
Answer: B
NEW QUESTION # 54
......
100% Real & Accurate Vault-Associate-002 Questions and Answers with Free and Fast Updates: https://examschief.vce4plus.com/HashiCorp/Vault-Associate-002-valid-vce-dumps.html