HashiCorp Certified: Vault Associate (002) - Vault-Associate-002 Free Exam Questions

A. Encryption for application data is best handled by a storage system or database engine, while storing encryption keys in Vault

B. The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault

C. The transit secrets engine ensures encryption in-transit and at-rest is enforced enterprise wide

D. Vault has an API that can be programmatically consumed by applications

A. Adding additional Vault nodes to a cluster

B. The rook token is lost

C. A keyholder joins or leaves the organization

D. Upgrading Vault Community Edition to Vault Enterprise

E. A compliance mandate to rotate the master key at a regular interval

A. Use 4096-bit RSA key to encrypt the data

B. Upgrade to Vault Enterprise and integrate with HSM

C. Periodically rotate the encryption key

D. Periodically re-key the Vault's unseal keys

A. vault lease revoke AKIAIOMQXTLW36DV7IEA

B. 575d62fe80d8

C. vault lease revoke access_key=AKIAIOWQXTLW36DV7IEA

D. vault lease revoke f3e92392-7d9c-09c8-c921-575d62fe80d8

A. Each secrets engine is isolated to its path

B. Once enabled, you cannot disable the secrets engine

C. A secrets engine cannot be enabled at multiple paths

D. Some secrets engines simply store and read data

E. You can build your own custom secrets engine

A. The Vault administrator would need to seal the Vault server immediately

B. Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)

C. You can rotate the encryption key so that the attacker won't be able to decrypt the data

D. The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted