HashiCorp Vault Associate Practice Test

Answer choices

1. A. The Transit engine automatically encrypts every internal Vault storage write
2. B. The storage backend refuses all filesystem reads from non-root operating-system users for the affected application
3. C. Every secret is separately protected only by the client's Vault token
4. D. Vault's encryption barrier protects persisted data; a backend copy alone cannot decrypt it.

Wrong-answer review

• A. The Transit engine automatically encrypts every internal Vault storage write: Vault's encryption barrier protects internal storage; Transit is an application-facing secrets engine.
• B. The storage backend refuses all filesystem reads from non-root operating-system users for the affected application: Filesystem permissions can help, but Vault's core confidentiality property is cryptographic rather than relying solely on backend ACLs.
• C. Every secret is separately protected only by the client's Vault token: Client tokens authorize requests; they are not the at-rest encryption key.

Answer choices

1. A. Use vault login with the intended auth method and its required credentials
2. B. Use vault secrets enable because login is implemented as a secrets engine
3. C. Use vault operator unseal with the user's directory password
4. D. Use vault policy write with the user's credentials as HCL

Answer choices

1. A. deny
2. B. patch
3. C. list
4. D. sudo

Answer choices

1. A. Vault immediately deletes version 2 and old ciphertext fails for the stated access path
2. B. Vault rewrites every v2 ciphertext object automatically
3. C. New encryption uses v3 while retained older versions still decrypt v2 ciphertext.
4. D. Every application must receive raw version 3 key material

Answer choices

1. A. Yes; every lease ID is interchangeable with X-Vault-Token
2. B. Yes, but only while the lease is renewable
3. C. No; a lease ID manages a leased secret, not client authentication.
4. D. Only batch-token lease IDs can be used for authentication for the affected application

Answer choices

1. A. It converts static secrets into dynamic database users by itself
2. B. It replaces the Vault server and stores the authoritative secrets database locally
3. C. Agent externalizes authentication, caching, and templating from the application.
4. D. It bypasses Vault policies because it is trusted infrastructure

Answer choices

1. A. The other nodes need new root tokens rather than unseal shares
2. B. Raft quorum automatically distributes the plaintext unseal key to sealed nodes
3. C. With Shamir, each Vault node must independently receive the required threshold of unseal shares after restart
4. D. Only standby nodes require Auto Unseal

Answer choices

1. A. The token becomes root for the excess period
2. B. Effective token lifetime is bounded by applicable maximum-TTL controls.
3. C. The requested TTL always wins because auth roles override system limits
4. D. Vault converts the token into a batch token to enforce the limit

Answer choices

1. A. Every Vault cluster uses the database secrets engine as the persistence layer under the existing configuration
2. B. The database engine is actually an auth method
3. C. The database engine only encrypts application payloads
4. D. Database engines manage credentials; Vault's persistent state goes to its storage backend.

Answer choices

1. A. Entity policies combine with token policies during request authorization.
2. B. Entity policies permanently rewrite the policy list stored in every existing token
3. C. Entity policies can only remove capabilities from a token
4. D. Entity policy changes require deleting and recreating the auth method