HashiCorp Certified: Vault Associate (002) practice questions

1. Question 1 of 25

   What command creates a secret with the key "my-password" and the value "53cr3t" at path "my-secrets" within the KV secrets engine mounted at "secret"?

   • Avault kv put secret/my-secrets/my-password 53cr3t
   • Bvault kv write secret/my-secrets/my-password 53cr3t
   • Cvault kv write 53cr3t my-secrets/my-password
   • Dvault kv put secret/my-secrets my-password-53cr3t

   Show answer

   Correct answer: D

   How others answered

   • D80%
   • A20%

   Explanation

   Answer is A wrong. vault kv put secret/my-secret/my-password test Failed to parse K=V data: invalid key/value pair "test": format must be key=value vault kv put secret/my-secret/my-password user=test I have tested on my local machine. Thanks

   Adapted from community discussion by bunnyjoel · 2024-03-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. B

      bunnyjoel

      2024-03-24

      4 upvotes

      The answer is D with modification vault kv put secret/my-secret password=53cr3t

   2. S

      Stokvisss

      2024-11-29

      Selected D3 upvotes

      The answer is D, the dash '-' should be an equals sign '=' though

   3. B

      bunnyjoel

      2024-03-24

      2 upvotes

      Answer is A wrong. vault kv put secret/my-secret/my-password test Failed to parse K=V data: invalid key/value pair "test": format must be key=value vault kv put secret/my-secret/my-password user=test I have tested on my local machine. Thanks

   4. B

      BinMahamood

      2025-04-08

      Selected D1 upvote

      root@templatevm:~# vault kv put secret/my-secrets my-passw ord=53cret ===== Secret Path ===== secret/data/my-secrets ======= Metadata ======= Key Value --- ----- created_time 2025-04-08T12:10:27.918814027Z custom_metadata deletion_time n/a destroyed false version 1

2. Question 2 of 25

   Which of the following statements describe the CLI command below? $ vault login -method=ldap username=mitchellh

   • AGenerates a token which is response wrapped
   • BYou will be prompted to enter the password
   • CBy default, the generated token is valid for 24 hours
   • DFails because the password is not provided

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. D

      daz_rekka

      2024-07-16

      Selected B2 upvotes

      As shown here https://developer.hashicorp.com/vault/docs/auth/ldap#authentication you will be prompted to enter the password for mitchellh.

3. Question 3 of 25

   The following three policies exist in Vault What do these policies allow an organization to do? app.hcl

   

   callcenter.hcl

   

   rewrap.hcl

   

   • ASeparates permissions allowed on actions associated with the transit secret engine
   • BNothing, as the minimum permissions to perform useful tasks are not present
   • CEncrypt decrypt, and rewrap data using the transit engine all in one policy
   • DCreate a transit encryption key for encrypting, decrypting, and rewrapping encrypted data

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   C The most accurate statement describing what these policies allow the organization to do is C: "Encrypt, decrypt, and rewrap data using the transit engine all in one policy."

   Adapted from community discussion by gixejod225 · 2024-10-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. G

      gixejod225

      2024-10-04

      2 upvotes

      C The most accurate statement describing what these policies allow the organization to do is C: "Encrypt, decrypt, and rewrap data using the transit engine all in one policy."

4. Question 4 of 25

   Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would you recommend?

   • AGoogle Cloud Secrets Engine
   • BIdentity secrets engine
   • CKey/Value secrets engine version 2
   • DSSH secrets engine

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. S

      sadi123

      2025-02-02

      Selected A1 upvote

      The Google Cloud Secrets Engine in Vault allows dynamic creation of short-lived GCP IAM credentials. This is ideal for provisioning VMs securely in a CI/CD pipeline because: It avoids storing long-lived credentials in pipeline configs. Credentials can be automatically revoked after use. It integrates directly with GCP IAM to create temporary service account keys.

5. Question 5 of 25

   Which of the following cannot define the maximum time-to-live (TTL) for a token?

   • ABy the authentication method
   • BBy the client system
   • CBy the mount endpoint configuration
   • DA parent token TTL
   • ESystem max TTL

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. D

      daz_rekka

      2024-07-17

      Selected B1 upvote

      Authentication Method allows you set it. Mount Endpoint Configuration too as per https://developer.hashicorp.com/vault/api-docs/system/mounts#tune-mount-configuration and D & E clearly allow you define TTL for a token.

6. Question 6 of 25

   What are orphan tokens?

   • AOrphan tokens are tokens with a use limit so you can set the number of uses when you create them
   • BOrphan tokens are not children of their parent; therefore, orphan tokens do not expire when their parent does
   • COrphan tokens are tokens with no policies attached
   • DOrphan tokens do not expire when their own max TTL is reached

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. D

      daz_rekka

      2024-07-16

      Selected B1 upvote

      https://developer.hashicorp.com/vault/docs/commands/token/create#orphan

7. Question 7 of 25

   The vault lease renew command increments the lease time from:

   • AThe current time
   • BThe end of the lease

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. D

      daz_rekka

      2024-07-14

      Selected A2 upvotes

      Clearly stated here Increments are from the current time: https://developer.hashicorp.com/vault/docs/concepts/lease#lease-durations-and-renewal

8. Question 8 of 25

   When using Integrated Storage, which of the following should you do to recover from possible data loss?

   • AFailover to a standby node
   • BUse snapshot
   • CUse audit logs
   • DUse server logs

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. D

      daz_rekka

      2024-07-17

      Selected B1 upvote

      https://developer.hashicorp.com/vault/docs/commands/operator/raft#snapshot

9. Question 9 of 25

   How many Shamir’s key shares are required to unseal a Vault instance?

   • AAll key shares
   • BA quorum of key shares
   • COne or more keys
   • DThe threshold number of key shares

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Supporting references

   • HashiCorp documentation

   View community discussion1

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

   1. D

      daz_rekka

      2024-07-17

      Selected D1 upvote

      https://developer.hashicorp.com/vault/docs/internals/rotation#key-rotation

10. Question 10 of 25

    Which of these are a benefit of using the Vault Agent?

    • AVault Agent allows for centralized configuration of application secrets engines
    • BVault Agent will auto-discover which authentication mechanism to use
    • CVault Agent will enforce minimum levels of encryption an application can use
    • DVault Agent will manage the lifecycle of cached tokens and leases automatically

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Supporting references

    • HashiCorp documentation

    View community discussion1

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-17

       Selected D1 upvote

       Vault Agent performs this using https://developer.hashicorp.com/vault/docs/agent-and-proxy/autoauth

11. Question 11 of 25

    Vault supports which type of configuration for source limited token?

    • ACloud-bound tokens
    • BDomain-bound tokens
    • CCIDR-bound tokens
    • DCertificate-bound tokens

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Supporting references

    • HashiCorp documentation

    View community discussion1

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-17

       Selected C1 upvote

       https://developer.hashicorp.com/vault/docs/concepts/tokens#cidr-bound-tokens

12. Question 12 of 25

    Select 2

    Which of the following are replication methods available in Vault Enterprise? (Choose two.)

    • ACluster sharding
    • BNamespaces
    • CPerformance Replication
    • DDisaster Recovery Replication

    Show answer

    Correct answer: C, D

    How others answered

    • CD100%

    Supporting references

    • HashiCorp documentation
    • HashiCorp documentation

    View community discussion1

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-17

       Selected C, D2 upvotes

       https://developer.hashicorp.com/vault/tutorials/enterprise/performance-replication https://developer.hashicorp.com/vault/tutorials/enterprise/disaster-recovery

13. Question 13 of 25

    Examine the command below. Output has been trimmed.

    

    Which of the following statements describe the command and its output?

    • AMissing a default token policy
    • BGenerated token’s TTL is 60 hours
    • CGenerated token is an orphan token which can be renewed indefinitely
    • DConfigures the AppRole auth method with user specified role ID and secret ID

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • A50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Supporting references

    • HashiCorp documentation

    View community discussion3

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. N

       nginx_aws

       2024-10-09

       Selected D1 upvote

       This statement is partially correct. The command is indeed using the AppRole authentication method to log in with a specified role ID and secret ID. However, it’s not configuring the AppRole auth method; it’s using it to authenticate and obtain a token. Configuration of AppRole involves setting up roles and associated policies, which is not what this command is doing. So, based on the information provided, the accurate description of the command and its output is not fully captured by any of the listed statements. The closest accurate statement is D, but it should be noted that the command is for authentication, not configuration.

    2. D

       daz_rekka

       2024-07-22

       Selected D1 upvote

       Correct statement as per https://developer.hashicorp.com/vault/docs/auth/approle#authentication and https://developer.hashicorp.com/vault/docs/auth/approle#credentials-constraints

    3. 3

       3fac4ef

       2024-09-04

       1 upvote

       auth/my-path/login API endpoint is used for authentication, but not configuring custom/static role_id/secret_id, so the right answer here should be A, since default policy is missing from the output. Answer A

14. Question 14 of 25

    You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?

    • AA data key encrypts the blob locally, and the same key decrypts the blob locally.
    • BTo process such a large blob. Vault will temporarily store it in the storage backend.
    • CVault will store the blob permanently. Be sure to run Vault on a compute optimized machine.
    • DThe transit engine is not a good solution for binaries of this size.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Supporting references

    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-14

       Selected A2 upvotes

       Answer: A https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit#additional-discussion-bring-your-own-key

    2. M

       Mark1000

       2024-07-22

       1 upvote

       A https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit

15. Question 15 of 25

    Select 2

    The key/value v2 secrets engine is enabled at secret/. See the following policy:

    

    Which of the following operations are permitted by this policy? (Choose two.)

    • Avault kv get secret/webapp1
    • Bvault kv put secret/webapp1 apikey-"ABCDEFGHIDK123W"
    • Cvault kv metadata get secret/webapp1
    • Dvault kv delete secret/super-secret
    • Evault kv list secret/super-secret

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

    Explanation

    The KV Put and KV Get operations require the read, create, and update capabilities granted in the first part of the policy so A & B are correct. Metadata is not one of the listed capabilities in the first section of the policy so C is wrong. The deny in the second part of the policy prevents D & E.

    Adapted from community discussion by daz_rekka · 2024-07-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-17

       Selected A, B2 upvotes

       The KV Put and KV Get operations require the read, create, and update capabilities granted in the first part of the policy so A & B are correct. Metadata is not one of the listed capabilities in the first section of the policy so C is wrong. The deny in the second part of the policy prevents D & E.

16. Question 16 of 25

    Select 2

    A web application uses Vault’s transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit, which of the following statements are true? (Choose two.)

    • AYou can rotate the encryption key so that the attacker won't be able to decrypt the data
    • BThe keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted B. The Vault administrator would need to seal the Vault server immediately
    • CEven if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)

    Show answer

    Correct answer: B, C

    How others answered

    • BC100%

    Supporting references

    • HashiCorp documentation
    • HashiCorp documentation
    • HashiCorp documentation

    View community discussion3

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. A

       agueda

       2024-12-07

       Selected B, C1 upvote

       B (first) and C A > if you just rotate the encryption key, the attacker could use previous version of the key to decrypt (if he had access to the keyring) B (second) > Sealing the Vault doesn't make sense. I f the attacker has the decryption key also, sealing the Vault wouldn't make a difference. The right approach is to rotate the key and move foward the min_decryption_version

    2. M

       Mark1000

       2024-07-29

       2 upvotes

       B(first) and C B(first): https://developer.hashicorp.com/vault/docs/secrets/transit C: https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit

    3. 3

       3fac4ef

       2024-09-04

       1 upvote

       B and C https://developer.hashicorp.com/vault/api-docs/secret/transit#min_decryption_version

17. Question 17 of 25

    The Vault encryption key is stored in Vault’s backend storage.

    • ATrue
    • BFalse

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Vault stores it's own encryption key in it's own storage backend. The root key created during the Unseal step is the key to decrypt that key and not known to Vault or kept in the Storage Backend by design. https://developer.hashicorp.com/vault/docs/concepts/seal#why

    Adapted from community discussion by daz_rekka · 2024-07-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-17

       Selected A2 upvotes

       Vault stores it's own encryption key in it's own storage backend. The root key created during the Unseal step is the key to decrypt that key and not known to Vault or kept in the Storage Backend by design. https://developer.hashicorp.com/vault/docs/concepts/seal#why

    2. A

       ad873cf

       2024-06-29

       1 upvote

       Vault stores the encrypted master key (and all its data) within its own storage backend, that is to say it does not store anything on the transit vault cluster but just uses it to decrypt the key.

18. Question 18 of 25

    An organization would like to use a scheduler to track & revoke access granted to a job (by Vault) at completion. What auth-associated Vault object should be tracked to enable this behavior?

    • AToken accessor
    • BToken ID
    • CLease ID
    • DAuthentication method

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Supporting references

    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. A

       agueda

       2024-12-07

       Selected A1 upvote

       By the phrasing of the question, I understand that the job is granted access to Vault to read secrets, so the job has a token to access Vault. And the question is "What auth-associated Vault object...?", and Lease ID is not an auth-associated Vault object. So answer is A, you need the Token Accessor to revoke a token

    2. D

       daz_rekka

       2024-07-17

       Selected A1 upvote

       Described here https://developer.hashicorp.com/vault/docs/concepts/tokens#token-accessors

19. Question 19 of 25

    Vault Agent allows client-side caching of tokens and leases. If the agent is shut down, those tokens and leases cached will be revoked.

    • ATrue
    • BFalse

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Supporting references

    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. A

       agueda

       2024-06-12

       Selected B1 upvote

       B False https://developer.hashicorp.com/vault/docs/agent-and-proxy/agent/caching#renewal-management " Note that shutting down the agent does not indicate revocations of the secrets, instead it only means that renewal responsibility for all the valid unrevoked secrets are no longer performed by the Vault agent."

    2. M

       Mark1000

       2024-02-05

       1 upvote

       B Asked IA tool: In HashiCorp Vault, the Vault Agent is a tool that helps automate the obtaining and renewal of Vault access tokens. If the Vault Agent is stopped abruptly, tokens and leases that were granted by Vault will remain valid until they expire according to the configured time to live (TTL).

20. Question 20 of 25

    Select 3

    What attributes are unique to batch tokens? (Choose three.)

    • ACannot be renewed
    • BAre not persisted
    • CCan be periodic
    • DHave a set time-to-live (TTL)
    • EAre persisted

    Show answer

    Correct answer: A, B, D

    How others answered

    • ABD75%
    • ACD25%

    Explanation

    I think you have marked option C instead of B, although the link clearly indicates B (I think it was just a mistake in the marking)

    Adapted from community discussion by Mark1000 · 2024-08-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. M

       Mark1000

       2024-08-05

       2 upvotes

       I think you have marked option C instead of B, although the link clearly indicates B (I think it was just a mistake in the marking)

21. Question 21 of 25

    You have manually created some usernames and passwords for a Microsoft SQL database on Azure, and need to store these credentials in Vault. What secrets engine should you use for this?

    • AMSSQL database secrets engine
    • BKey/Value secrets engine version 2
    • CAzure secrets engine
    • DTransit engine

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    B is correct as you manually created credentials and didn't originally enable the Database Secrets Engine with the MSSQL plugin to create dynamic ones.

    Adapted from community discussion by daz_rekka · 2024-07-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-18

       Selected B2 upvotes

       B is correct as you manually created credentials and didn't originally enable the Database Secrets Engine with the MSSQL plugin to create dynamic ones.

22. Question 22 of 25

    To create a non-root token with time-to-live (TTL) set to 30 minutes but with no max TTL which flag would you use?

    • A-ttl=30n
    • B-explicit-max-ttl=0
    • C-orphan
    • DNone of the above

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Supporting references

    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-18

       Selected A1 upvote

       Assuming the "n" is a typo and should be "m" for minutes A is correct. https://developer.hashicorp.com/vault/docs/concepts/duration-format#m

    2. M

       Mark1000

       2024-08-05

       1 upvote

       A ( -ttl=30m) The answer B can be misleading, but first we would not define the TTL of 30 minutes, and it should be noted that if the max-ttl flag is specified it automatically defines it as explicit_max_ttl = 0s, therefore it is not necessary to define

23. Question 23 of 25

    Select 2

    Which of the following statements are true about the default policy? (Choose two.)

    • AIt is one of the built-in policies
    • BProvides a common set of permissions and is included on all tokens by default
    • CCan not be modified or deleted
    • DGives a super admin permissions, similar to a root user on a Linux machine
    • EVault upgrade will overwrite any update you made to the default policy

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

    Supporting references

    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-18

       Selected A, B1 upvote

       https://developer.hashicorp.com/vault/docs/concepts/policies#built-in-policies

    2. M

       Mark1000

       2024-08-05

       1 upvote

       AB https://developer.hashicorp.com/vault/docs/concepts/policies#default-policy

24. Question 24 of 25

    You can build a high availability Vault cluster with any storage backend.

    • ATrue
    • BFalse

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Supporting references

    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-16

       Selected B2 upvotes

       Only RAFT/Integrated Storage & Consul backend storage support clustering.

    2. M

       Mark1000

       2024-07-22

       2 upvotes

       B And DinamoDB, Etcd, FoundationDB and other also supported https://developer.hashicorp.com/vault/docs/configuration/storage You can check one by one

25. Question 25 of 25

    Select 2

    When enabling auto-unseal, how do you specify the seal type? (Choose two.)

    • ASet the VAULT_SEAL_TYPE environment variable
    • BUse the /sys/seal endpoint on the Vault API
    • CCreate a seal block in the server configuration file
    • DConfigure in the storage block of the server configuration file
    • EUse the vault operator command

    Show answer

    Correct answer: C, E

    How others answered

    • CE75%
    • AD25%

    Supporting references

    • HashiCorp documentation
    • HashiCorp documentation

    View community discussion2

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by VA-002 or CertExamHQ.

    1. D

       daz_rekka

       2024-07-19

       Selected C, E3 upvotes

       https://developer.hashicorp.com/vault/docs/concepts/seal#auto-unseal & https://developer.hashicorp.com/vault/docs/commands/operator/init

    2. M

       Mark1000

       2024-08-05

       1 upvote

       CE https://developer.hashicorp.com/vault/docs/commands/operator/init This section explains it in detail: Migration from shamir to auto unseal To migrate from Shamir keys to Auto Unseal, take your server cluster offline and update the seal configuration with the appropriate seal configuration. Bring your server back up and leave the rest of the nodes offline if using multi-server mode, then run the unseal process with the -migrate flag and bring the rest of the cluster online. All unseal commands must specify the -migrate flag. Once the required threshold of unseal keys are entered, unseal keys will be migrated to recovery keys. $ vault operator unseal -migrate

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

VA-002 practice, question 1 of 25