[Dec 28, 2022] HashiCorp VA-002-P Exam Dumps Are Essential To Get Good Marks [Q24-Q44]

NO.24 Complete the following sentence:
For the local state, the workspaces are stored directly in a…

a file called terraform.tfstate

directory called terraform.workspaces.tfstate

directory called terraform.tfstate.d

a file called terraform.tfstate.backup

NO.25 True or False: When encrypting data with the transit secrets engine, Vault always stores the ciphertext in a dedicated KV store along with the associated encryption key.

False

True

NO.26 An administrator wants to create a new KV mount for individual users to maintain their own secrets but needs a way to simplify the policy so they don’t need to write a new one for each new user? With the requirements listed below, what would such a policy look like?
Requirement: Each user can perform all operations on their allocated key/value secret path

path “user-kv/data/{{identity.entity.name}}/*” {
capabilities = [ “create”, “update”, “read”, “delete”, “list” ]
}

path “user-kv/data/{{identity.entity.id.name}}/*” {
capabilities = [ “create”, “update”, “read”, “delete”, “list” ]
}

path “user-kv/data/{{identity.entity.aliases.<<mount accessor>>.id}}/*” { capabilities = [ “create”, “update”, “read”, “delete”, “list” ]
}

path “user-kv/data/{{user}}/*” {
capabilities = [ “create”, “update”, “read”, “delete”, “list” ]
}

NO.27 After enabling the vault to autocomplete feature, you type vault and press the tab button, but nothing happens. Why doesn’t vault display the available completions?
1. $ vault -autocomplete-install
2. $ vault

your SSH client doesn’t support autocompletion

the SSH session needs to be restarted upon installation

you don’t have the permissions to use autocomplete

you didn’t use -force when enabling the feature

NO.28 In regards to the transit secrets engine, which of the following is true given the following command and output: (select three)
1. $ vault write encryption/encrypt/creditcard plaintext=$(base64 <<< “1234 5678 9101 1121”)
2. Key Value
3. — —–
4. ciphertext vault:v3:cZNHVx+sxdMErXRSuDa1q/pz49fXTn1PScKfhf+PIZPvy8xKfkytpwKcbC0fF2U=

there are at least three data keys associated with this keyring

the name of the keyring used to encrypt the data is creditcard

the data was written to the encryption path, which is provided by default when enabling the transit secrets engine

the transit secrets engine is mounted at the encryption path

NO.29 When architecting a Vault replication configuration, why should you never terminate TLS on a front-end load balancer?

If Vault detects that the traffic has been unencrypted and re-encrypted, due to the load balancer, it will automatically drop the traffic as it is no longer trusted.

Vault generates self-signed mutual TLS for replication. If the LB is performing TLS termination, this will break the mutual TLS between nodes.

Vault requires that only Consul service discovery can be used to direct traffic to an active Vault node.

Vault replication won’t work with the type of certificates that a traditional load balancer uses.

NO.30 What is a downside to using a Terraform provider, such as the Vault provider, to interact with sensitive data, such as reading secrets from Vault?

Terraform and Vault must be running on the same physical host

Terraform and Vault must be running on the same version

Terraform requires a unique auth method to work with Vault

Secrets are persisted to the state file and plans

NO.31 When Terraform needs to be installed in a location where it does not have internet access to download the installer and upgrades, the installation is generally known as to be __________.

a private install

disconnected

non-traditional

air-gapped

NO.32 Which of the following represents a feature of Terraform Cloud that is NOT free to customers?

private module registry

VCS integration

roles and team management

workspace management

NO.33 Which of the following is considered a Terraform plugin?

Terraform logic

Terraform language

Terraform tooling

Terraform provider

NO.34 After creating a dynamic credential on a database, the DBA accidentally deletes the credentials on the database itself. When attempting to remove the lease, Vault returns an error stating that the credential cannot be found. What command can be run to coerce Vault to remove the secret?

vault lease -renew

vault lease revoke -force -prefix <lease_path>

vault revoke -apply

vault lease revoke -enforce

NO.35 True or False:
Similar to how Vault works with databases and cloud providers, the Active Directory secrets engine dynamically generates the account and password for the requesting Vault client.

False

True

NO.36 The userpass auth method has the ability to access external services in order to provide authentication to Vault.

FALSE

TRUE

NO.37 What are some of the features of Terraform state? (select three)

inspection of cloud resources

increased performance

mapping configuration to real-world resources

determining the correct order to destroy resources

NO.38 A Vault client who has read access to the path secrets/apps/app1 is having trouble viewing the secret in the user interface (UI) but can access via the API. What can be done to resolve this issue?

add read permissions to the path secrets/apps

modify the policy to allow the create permission

remove the deny policy blocking access to the secrets/apps/app1 path

add LIST to the policy so the user can browse the paths leading up to the key/value’s path

NO.39 What is the result of the following terraform function call?
zipmap([“a”, “b”], [1, 2])

{
“a”,
“b”,
“1”,
“2”,
}

[
“a”,
“b”,
“1”,
“2”,
]

{
“a” = 1
“b” = 2
}

[
“a” = 1
“b” = 2
]

NO.40 Vault’s User Interface (UI) needs to be enabled in the command line before it can be used.

FALSE

TRUE

NO.41 An application is trying to use a secret in which the lease has expired. What can be done in order for the application to successfully request data from Vault?

request a new secret and associated lease

try the expired secret in hopes it hasn’t been deleted yet

request the TTL be extended for the secret

perform a lease renewal

NO.42 What command is used to renew a token, if permitted?

vault operator token renew

vault token update

vault new <token-id>

vault update token

vault token renew

vault renew token <token-id>

NO.43 You’ve deployed Vault in your production environment and are curious to understand metrics on your Vault cluster, such as the number of writes to the backend, the status of WALs, and the seal status. What feature would you configure in order to view these metrics?

audit device

telemetry

nothing to configure, these are available in the Vault log found on the OS

enable logs for each individual secrets engines

NO.44 Your organization is running Vault open source and has decided it wants to use the Identity secrets engine. You log into Vault but are unable to find it in the list to enable. What gives?