[Nov 22, 2025] Valid HCVA0-003 Test Answers & HashiCorp HCVA0-003 Exam PDF
Realistic HCVA0-003 Exam Dumps with Accurate & Updated Questions
HashiCorp HCVA0-003 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
NEW QUESTION # 155
An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is AWS.
- A. True
- B. False
Answer: B
Explanation:
The statement is false. An organization can authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret using more than one authentication method. The AWS auth method is one of the options, but not the only one. The AWS auth method supports two types of authentication: ec2 and iam. The ec2 type uses the signed EC2 instance identity document to authenticate the EC2 instance. The iam type uses the AWS Signature v4 algorithm to sign a request to the sts:GetCallerIdentity API and authenticate the IAM principal. However, the organization can also use other auth methods that are compatible with EC2 instances, such as AppRole, JWT/OIDC, or Kubernetes. These methods require the EC2 instance to have some sort of identity material, such as a role ID, a secret ID, a JWT token, or a service account token, that can be used to authenticate to Vault. The identity material can be provisioned to the EC2 instance using various mechanisms, such as user data, metadata service, or cloud-init scripts. The choice of the auth method depends on the use case, the security requirements, and the trade-offs between convenience and control. References: AWS - Auth Methods | Vault | HashiCorp Developer, AppRole - Auth Methods | Vault | HashiCorp Developer, JWT/OIDC
- Auth Methods | Vault | HashiCorp Developer, Kubernetes - Auth Methods | Vault | HashiCorp Developer
NEW QUESTION # 156
True or False? All Vault policies are deny by default.
- A. False
- B. True
Answer: B
Explanation:
Comprehensive and Detailed in Depth Explanation:
The statement isTrue. Vault operates on a default-deny model for policies. The HashiCorp Vault documentation states: "Vault policies implicitly deny all actions that are not explicitly permitted in the Vault policy." This ensures that access must be explicitly granted, enhancing security.
The docs elaborate: "By default, a token has no policies attached beyond the default policy (which grants minimal permissions), and any action not explicitly allowed by an attached policy is denied." This principle underpins Vault's access control, making A correct.
Reference:
HashiCorp Vault Documentation - Policies Tutorial
NEW QUESTION # 157
When creating a policy, an error was thrown:
Which statement describes the fix for this issue?
- A. sudo is not a capability
- B. You cannot have a wildcard (" * ") in the path
- C. Replace write with create in the capabilities list
Answer: C
Explanation:
The error was thrown because the policy code contains an invalid capability, "write". The valid capabilities for a policy are "create", "read", "update", "delete", "list", and "sudo". The "write" capability is not recognized by Vault and should be replaced with "create", which allows creating new secrets or overwriting existing ones. The other statements are not correct, because the wildcard (*) and the sudo capability are both valid in a policy. The wildcard matches any number of characters within a path segment, and the sudo capability allows performing certain operations that require root privileges.
:
[Policy Syntax | Vault | HashiCorp Developer]
[Policy Syntax | Vault | HashiCorp Developer]
NEW QUESTION # 158
Which of the following actions can be performed if you only had access to a token's accessor? (Select four)
- A. Look up a token's properties
- B. Renew the token
- C. Look up a token's capabilities on a path
- D. Revoke the token
- E. Retrieve the actual token ID
Answer: A,B,C,D
Explanation:
Comprehensive and Detailed In-Depth Explanation:
A token accessor allows:
* A, B, D, E: "This accessor can only be used to perform limited actions: Look up a token's properties, Look up a token's capabilities on a path, Renew the token, Revoke the token." The calling token needs permissions.
* Incorrect Option:
* C: "Not including the actual token ID."
Reference:https://developer.hashicorp.com/vault/docs/concepts/tokens#token-accessors
NEW QUESTION # 159
Tommy has written an AWS Lambda function that will perform certain tasks for the organization when data has been uploaded to an S3 bucket. Security policies for the organization do not allow Tommy to hardcode any type of credential within the Lambda code or environment variables. However, Tommy needs to retrieve a credential from Vault to write data to an on-premises database. What auth method should Tommy use in Vault to meet the requirements while not violating security policies?
- A. Userpass
- B. Token
- C. AWS
- D. AppRole
Answer: C
Explanation:
Comprehensive and Detailed in Depth Explanation:
* A:AWS auth uses IAM roles, avoiding hardcoded credentials. Correct for Lambda.
* B:Userpass requires username/password, violating policy. Incorrect.
* C:Token requires a pre-generated token, often hardcoded. Incorrect.
* D:AppRole needs RoleID/SecretID, typically hardcoded. Incorrect.
Overall Explanation from Vault Docs:
"The AWS auth method provides an automated mechanism to retrieve a Vault token for IAM principals... no manual credential provisioning required." Reference:https://developer.hashicorp.com/vault/docs/auth/aws#aws-auth-method
NEW QUESTION # 160
What command would have created the token displayed below?
$ vault token lookup hvs.nNeZ2I64ALCxuO7dqQEJGPrO
Key: policies Value: [default dev], num_uses: 5, ttl: 767h59m49s
* Key Value
* --- -----
* accessor mfvaVMFgOcXHIeqlRasroSOn
* creation_time 1604610457
* creation_ttl 768h
* display_name token
* entity_id n/a
* expire_time 2024-12-07T16:07:37.7540672-05:00
* explicit_max_ttl 0s
* id hvs.nNeZ2I64ALCxuO7dqQEJGPrO
* issue_time 2024-11-05T16:07:37.7540672-05:00
* meta <nil>
* num_uses 5
* orphan false
* path auth/token/create
* policies [default dev]
* renewable true
* ttl 767h59m49s
* type service
- A. vault token create -policy=dev
- B. vault token create -policy=dev -use-limit=5
- C. vault token create -policy=dev -ttl=768h
- D. vault token create -policy=dev -policy=default -ttl=768h
Answer: B
Explanation:
Comprehensive and Detailed in Depth Explanation:
* A:Matches dev policy and num_uses=5. TTL is system default (768h). Correct.
* B:Missing num_uses. Incorrect.
* C:Adds default policy explicitly, not needed as it's implicit. Incorrect.
* D:Missing num_uses. Incorrect.
Overall Explanation from Vault Docs:
"vault token create with -policy and -use-limit sets specific attributes... default policy is included implicitly." Reference:https://developer.hashicorp.com/vault/docs/commands/token/create#command-options
NEW QUESTION # 161
Use this screenshot to answer the question below:
Where on this page would you click to view a secret located at secret/my-secret?
- A. C
- B. E
- C. A
- D. D
- E. B
Answer: A
Explanation:
In the HashiCorp Vault UI, secrets are organized in a tree-like structure. To view a secret located at secret/my- secret, you would click on the "secret/" folder in the tree, then click on the "my-secret" file. In this screenshot, the "secret/" folder is located at option C. This folder contains the secrets that are stored in the key/value secrets engine, which is the default secrets engine in Vault. The key/value secrets engine allows you to store arbitrary secrets as key/value pairs. The key is the path of the secret, and the value is the data of the secret.
For example, the secret located at secret/my-secret has a key of "my-secret" and a value of whatever data you stored there.
:
[KV - Secrets Engines | Vault | HashiCorp Developer]
NEW QUESTION # 162
Which Vault secret engine may be used to build your own internal certificate authority?
- A. Transit
- B. PostgreSQL
- C. PKI
- D. Generic
Answer: C
Explanation:
The Vault secret engine that can be used to build your own internal certificate authority is the PKI secret engine. The PKI secret engine generates dynamic X.509 certificates on-demand, without requiring manual processes of generating private keys and CSRs, submitting to a CA, and waiting for verification and signing.
The PKI secret engine can act as a root CA or an intermediate CA, and can issue certificates for various purposes, such as TLS, code signing, email encryption, etc. The PKI secret engine can also manage the certificate lifecycle, such as rotation, revocation, renewal, and CRL generation. The PKI secret engine can also integrate with external CAs, such as Venafi or Entrust, to delegate the certificate issuance and management. References: PKI - Secrets Engines | Vault | HashiCorp Developer, Build Your Own Certificate Authority (CA) | Vault - HashiCorp Learn
NEW QUESTION # 163
If Bobby is currently assigned the following policy, what additional policy can be added to ensure Bobby cannot access the data stored at secret/apps/confidential but still read all other secrets?
path "secret/apps/*" { capabilities = ["create", "read", "update", "delete", "list"] }
- A. path "secret/apps/*" { capabilities = ["deny"] }
- B. path "secret/apps/confidential" { capabilities = ["deny"] }
- C. path "secret/apps/confidential/*" { capabilities = ["deny"] }
- D. path "secret/*" { capabilities = ["read", "deny"] }
Answer: B
Explanation:
Comprehensive and Detailed in Depth Explanation:
* A:Denies all access to secret/apps/confidential, overriding the original policy's permissions. Correct.
* B:Applies to all secret/*, overly restrictive and unclear with mixed capabilities. Incorrect.
* C:Denies all secret/apps/*, blocking more than required. Incorrect.
* D:Denies subpaths under confidential, not the path itself. Incorrect.
Overall Explanation from Vault Docs:
"A deny capability takes precedence over any allow... Use it to restrict specific paths." Reference:https://developer.hashicorp.com/vault/docs/concepts/policies#capabilities
NEW QUESTION # 164
Which of the following are replication methods available in Vault Enterprise? Choose two correct answers.
- A. Namespaces
- B. Cluster sharding
- C. Performance Replication
- D. Disaster Recovery Replication
Answer: C,D
Explanation:
The replication methods available in Vault Enterprise are performance replication and disaster recovery replication. These methods allow critical data to be replicated across clusters to support horizontally scaling and disaster recovery workloads.
* Performance replication enables a primary cluster to replicate data to one or more secondary clusters, which can handle client requests and improve performance and availability. Performance replication replicates most Vault data, such as secrets, policies, auth methods, and leases, but not tokens.
Performance secondaries generate their own tokens and leases, which are not replicated back to the primary. Performance replication also supports filtering, which allows selective replication of data based on namespaces or paths.
* Disaster recovery replication enables a primary cluster to replicate data to one or more secondary clusters, which act as standby clusters in case of a failure or outage of the primary. Disaster recovery replication replicates all Vault data, including tokens and leases, and maintains the same configuration and state as the primary. Disaster recovery secondaries do not handle client requests, but they can be promoted to a primary in a disaster recovery scenario. References: Replication - Vault Enterprise | Vault | HashiCorp Developer, Performance Replication - Vault Enterprise | Vault | HashiCorp Developer, Disaster Recovery Replication - Vault Enterprise | Vault | HashiCorp Developer
NEW QUESTION # 165
Use this screenshot to answer the question below:
When are you shown these options in the GUI?
- A. Enabling authentication methods
- B. Enabling authentication engines
- C. Enabling secret engines
- D. Enabling policies
Answer: A
Explanation:
This screenshot is shown when you are enabling authentication methods in the GUI. Authentication methods are the ways users and applications authenticate with Vault. Vault supports many different authentication methods, including username and password, GitHub, and more. You can enable one or more authentication methods from the grid of options, which are divided into three categories: Generic, Cloud, and Infra. Each option has a name, a description, and a logo. You can also enable authentication methods using the Vault CLI or API.
Enabling policies, authentication engines, and secret engines are different tasks that are not related to this screenshot. Policies are rules that govern the access to Vault resources, such as secrets, authentication methods, and audit devices. Authentication engines are components of Vault that perform authentication and assign policies to authenticated entities. Secret engines are components of Vault that store, generate, or encrypt data. These tasks have different GUI pages and options than the screenshot.
:
[Authentication | Vault | HashiCorp Developer]
[Policies | Vault | HashiCorp Developer]
[Authentication | Vault | HashiCorp Developer]
[Secrets Engines | Vault | HashiCorp Developer]
NEW QUESTION # 166
You have a CI/CD pipeline using Terraform to provision AWS resources with static privileged credentials.
Your security team requests that you use Vault to limit AWS access when needed. How can you enhance this process and increase pipeline security?
- A. Enable the aws secrets engine and configure Terraform to dynamically generate a short-lived AWS credential on each terraform apply
- B. Enable the SSH secrets engine and have Terraform generate dynamic credentials when deploying resources in AWS
- C. Store the AWS credentials in the Vault KV store and use the Vault provider to obtain these credentials on each terraform apply
- D. Enable the Transit secrets engine to encrypt the AWS credentials and have Terraform retrieve these credentials when needed
Answer: A
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The AWS secrets engine generates dynamic credentials, enhancing security. The Vault documentation states:
"The best bet here is to use the AWS secrets engine to generate dynamic credentials for your AWS account(s) when Terraform is executed. You can use the Vault provider to grab these credentials for Vault and then use the credentials as inputs for your AWS provider. In this scenario, Terraform would generate credentials only when executed, and the credentials would automatically expire when the lease expires."
-Vault Secrets: AWS
* D: Correct. Dynamic, short-lived credentials limit exposure:
"Enabling the aws secrets engine in Vault allows you to dynamically generate short-lived AWS credentials for each terraform apply."
-Vault Secrets: AWS
* A: SSH engine is unrelated to AWS.
* B: Transit encrypts data, not credentials.
* C: KV stores static credentials, less secure.
References:
Vault Secrets: AWS
Vault Provider for Terraform
NEW QUESTION # 167
Your organization has enabled the LDAP auth method on the path of corp-auth/. When you access the Vault UI, you cannot log in despite providing the correct credentials. Based on the screenshot below, what action should you take to log in?
- A. Select corp-auth from the dropdown list
- B. Change to the Namespace of corp-auth before trying to authenticate
- C. Select More Options and enter the Mount path that LDAP was enabled on (corp-auth/)
- D. Enter the username as corp-auth/bryan.krausen
Answer: C
Explanation:
Comprehensive and Detailed In-Depth Explanation:
When an auth method like LDAP is mounted at a non-default path (e.g., corp-auth/), the Vault UI requires specifying that path. The Vault documentation implies this via CLI examples, and UI behavior confirms it:
"If a backend was mounted using a non-default path, you need to provide it under the Mount Path option under More Options."
-Vault Tutorials: Getting Started UI (Implied)
* C: Correct. Clicking "More Options" and entering corp-auth/ directs the UI to the LDAP method:
"By entering the mount path, you are directing Vault to use the LDAP auth method configured on that specific path for authentication."
-Vault Auth: LDAP
* A: Dropdowns typically list methods, not paths; incorrect assumption.
* B: Username doesn't include the path in this context.
* D: Namespace is unrelated to auth mount paths.
References:
Vault Tutorials: Getting Started UI
Vault Auth: LDAP
NEW QUESTION # 168
Over a few years, you have a lot of data that has been encrypted by older versions of a Transit encryption key.
Due to compliance regulations, you have to re-encrypt the data using the newest version of the encryption key. What is the easiest way to complete this task without putting the data at risk?
- A. Create a new master key used by Vault
- B. Rotate the encryption key used to encrypt the data
- C. Decrypt the data manually and encrypt it with the latest version
- D. Use the transit rewrap feature
Answer: D
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The Transit rewrap feature re-encrypts data safely. The Vault documentation states:
"Luckily, Vault provides an easy way of re-wrapping encrypted data when a key is rotated. Using the rewrap API endpoint, a non-privileged Vault entity can send data encrypted with an older version of the key to have it re-encrypted with the latest version. The application performing the re-wrapping never interacts with the decrypted data."
-Transit Rewrap Tutorial
* C: Correct. Rewrap avoids decryption risks:
"Using the transit rewrap feature in Vault allows you to re-encrypt the data without decrypting it first."
-Transit Rewrap Tutorial
* A: Rotation doesn't re-encrypt existing data.
* B: Manual decryption exposes data.
* D: Master key changes don't affect Transit data.
References:
Transit Rewrap Tutorial
NEW QUESTION # 169
Which statement describes the results of this command: $ vault secrets enable transit
- A. Enables the transit secrets engine at secret path
- B. Requires a root token to execute the command successfully
- C. Fails because the transit secrets engine is enabled by default
- D. Enables the transit secrets engine at transit path
- E. Fails due to missing -path parameter
Answer: D
Explanation:
The command vault secrets enable transit enables the transit secrets engine at the transit path. The transit secrets engine is a secrets engine that handles cryptographic functions on data in-transit, such as encryption, decryption, signing, verification, hashing, and random bytes generation. The transit secrets engine does not store the data sent to it, but only performs the requested operations and returns the results. The transit secrets engine can also be viewed as "cryptography as a service" or "encryption as a service". The command vault secrets enable transit uses the default path of transit for the secrets engine, but this can be changed by using the -path option. For example, vault secrets enable -path=my-transit transit would enable the transit secrets engine at the my-transit path. References: Transit - Secrets Engines | Vault | HashiCorp Developer, vault secrets enable - Command | Vault | HashiCorp Developer
NEW QUESTION # 170
Which of the following vault lease operations uses a lease _ id as an argument? Choose two correct answers.
- A. create
- B. renew
- C. revoke
- D. describe
- E. revoke -prefix
Answer: B,C
Explanation:
The vault lease operations that use a lease_id as an argument are renew and revoke. The renew operation allows a client to extend the validity of a lease associated with a secret or a token. The revoke operation allows a client to terminate a lease immediately and invalidate the secret or the token. Both operations require a lease_id as an argument to identify the lease to be renewed or revoked. The lease_id can be obtained from the response of reading a secret or creating a token, or from the vault lease list command. The other operations, revoke-prefix, create, and describe, do not use a lease_id as an argument. The revoke-prefix operation allows a client to revoke all secrets or tokens generated under a given prefix. The create operation allows a client to create a new lease for a secret. The describe operation allows a client to view information about a lease, such as its TTL, policies, and metadata. References: Lease, Renew, and Revoke | Vault | HashiCorp Developer, vault lease - Command | Vault | HashiCorp Developer
NEW QUESTION # 171
Which of the following storage backends support high availability? (Select four)
- A. DynamoDB
- B. Amazon S3
- C. Consul
- D. etcd
- E. Integrated Storage (raft)
- F. In-Memory
Answer: A,C,D,E
Explanation:
Comprehensive and Detailed In-Depth Explanation:
Vault supports various storage backends, but only some are designed to providehigh availability (HA), ensuring data consistency and fault tolerance across multiple nodes. The four backends that support HA are:
* A. Consul: Consul uses a distributed key-value store with a consensus protocol, enabling HA by replicating data across nodes. The documentation notes: "Consul's distributed nature and fault-tolerant design make it a suitable option for ensuring high availability in Vault deployments."
* B. etcd: etcd employs the Raft consensus algorithm for distributed coordination, ensuring data consistency and availability. It's explicitly supported for HA in Vault: "etcd's design ensures data consistency and fault tolerance."
* C. DynamoDB: Amazon's managed NoSQL service, DynamoDB, offers replication and fault tolerance, making it HA-capable. Vault leverages these features: "DynamoDB's replication and fault tolerance mechanisms make it a robust choice."
* D. Integrated Storage (raft): Vault's built-in storage backend uses the Raft consensus algorithm, providing HA without external dependencies. "Integrated Storage (raft) supports high availability by ensuring data consistency and fault tolerance."
* Incorrect Options:
* E. Amazon S3: While S3 offers durability, it's an object store not optimized for HA in Vault's context due to latency and lack of native consensus. "It may not be the best choice for ensuring high availability of Vault data."
* F. In-Memory: This stores data in volatile memory, losing it on restart, and does not support HA.
"In-Memory storage backend does not support high availability as it is volatile." These HA-capable backends ensure Vault remains operational and consistent in multi-node setups.
Reference:https://developer.hashicorp.com/vault/docs/configuration/storage
NEW QUESTION # 172
How long does the Transit secrets engine store the resulting ciphertext by default?
- A. 32 days
- B. Transit does not store data
- C. 24 hours
- D. 30 days
Answer: B
Explanation:
Comprehensive and Detailed in Depth Explanation:
The Transit secrets engine in Vault is designed for encryption-as-a-service, not data storage. Let's evaluate:
* Option A: 24 hoursTransit doesn't store ciphertext, so no TTL applies. Incorrect.
* Option B: 30 daysNo storage means no 30-day retention. Incorrect.
* Option C: 32 daysThis aligns with token TTLs, not Transit behavior. Incorrect.
* Option D: Transit does not store dataTransit encrypts data and returns the ciphertext to the caller without persisting it in Vault. Correct.
Detailed Mechanics:
When you run vault write transit/encrypt/mykey plaintext=<base64-data>, Vault uses the named key (e.g., mykey) to encrypt the input and returns a response like vault:v1:<ciphertext>. This ciphertext is not stored in Vault's storage backend (e.g., Consul, Raft); it's the client's responsibility to save it (e.g., in a database). This stateless design keeps Vault lightweight and secure, avoiding data retention risks.
Real-World Example:
Encrypt a credit card: vault write transit/encrypt/creditcard plaintext=$(base64 <<< "1234-5678-9012-3456").
Response: ciphertext=vault:v1:<data>. You store this in your app's database; Vault retains nothing.
Overall Explanation from Vault Docs:
"Vault does NOT store any data encrypted via the transit/encrypt endpoint... The ciphertext is returned to the caller for storage elsewhere." Reference:https://developer.hashicorp.com/vault/docs/secrets/transit
NEW QUESTION # 173
You have enabled the Transit secrets engine on your Vault cluster to provide an "encryption as a service" service as your team develops new applications. What is a prime use case for the Transit secrets engine?
- A. Storing the encrypted data in Vault for easy retrieval
- B. Generating dynamic SSH credentials for access to local systems
- C. Creating X.509 certificates for a new fleet of containers
- D. Encrypting data before being written to an Amazon S3 bucket
Answer: D
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The Transit secrets engine provides encryption as a service. The Vault documentation states:
"The Transit secrets engine is used to encrypt data in transit. It does NOT store the data locally. It simply encrypts the data and returns the ciphertext to the requester. A prime use case is encrypting data before being written to an external storage service like Amazon S3."
-Vault Secrets: Transit
* A: Correct. Encrypting data for S3 is a key use case:
"Encrypting data before being written to an Amazon S3 bucket ensures that sensitive data is protected both in transit and at rest."
-Transit Tutorial
* B: Incorrect; Transit doesn't store data long-term.
* C: SSH credentials are handled by the SSH engine.
* D: X.509 certificates are managed by the PKI engine.
References:
Vault Secrets: Transit
Transit Tutorial
NEW QUESTION # 174
True or False? The userpass auth method has the ability to access external services in order to provide authentication to Vault.
- A. True
- B. False
Answer: B
Explanation:
Comprehensive and Detailed in Depth Explanation:
The statement isFalse. The HashiCorp Vault documentation clarifies: "The userpass auth method uses a local database that cannot interact with any services outside of the Vault instance." It relies solely on credentials stored within Vault, lacking the ability to integrate with external services for authentication, unlike methods like OIDC or LDAP.
Thus, B (False) is the correct answer.
Reference:
HashiCorp Vault Documentation - Userpass Auth Method
NEW QUESTION # 175
Which statement best explains the role and usage of storage backends in HashiCorp Vault?
- A. They handle the encryption of all secrets so that Vault remains completely stateless.
- B. They store only unseal keys, while all secret data remains in Vault's memory.
- C. They store Vault's persistent data, affecting the scalability and performance of managing Vault.
- D. They store only ephemeral tokens, ensuring no persistent data is ever saved.
Answer: C
Explanation:
Comprehensive and Detailed in Depth Explanation:
Storage backends in Vault are responsible for storing persistent data, impacting its operation. The HashiCorp Vault documentation states: "The storage stanza configures the storage backend, which represents the location for the durable storage of Vault's information. Each backend has pros, cons, advantages, and trade-offs. For example, some backends support high availability while others provide a more robust backup and restoration process." This includes secrets, policies, and audit logs, affecting scalability and performance.
The docs add: "Vault uses a storage backend to persist its encrypted data, configuration, and metadata." Option B is incorrect as encryption is handled by Vault, not the backend. C and D are wrong-backends store all persistent data, not just tokens or unseal keys. Thus, A is correct.
Reference:
HashiCorp Vault Documentation - Storage Backends
NEW QUESTION # 176
To secure your applications, your organization uses certificates generated by a public CA. However, this strategy has proven expensive and you have to revoke certificates even though they have additional time left.
What Vault plugin can be used to quickly generate X.509 certificates to secure your internal applications?
- A. Transit secrets engine
- B. SSH secrets engine
- C. PKI secrets engine
- D. Identity secrets engine
Answer: C
Explanation:
Comprehensive and Detailed In-Depth Explanation:
The PKI secrets engine in Vault generates dynamic X.509 certificates, acting as a certificate authority (CA) or intermediate CA. It allows quick, cost-effective certificate creation for internal applications, with configurable TTLs and revocation capabilities, avoiding reliance on expensive public CAs. For example, vault write pki
/issue/<role> generates a certificate instantly. The Identity engine (A) manages identities, not certificates. The SSH engine (C) handles SSH credentials, not X.509. The Transit engine (D) is for encryption, not certificate generation. The PKI docs highlight its suitability for this use case.
References:
PKI Secrets Engine Docs
PKI Tutorial
NEW QUESTION # 177
From the options below, select the benefits of using the PKI (x.509 certificates) secrets engine (select three):
- A. Vault can act as an intermediate CA
- B. Reduces time to get a certificate by eliminating the need to generate a private key and CSR
- C. Reducing, or eliminating certificate revocations
- D. TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time
Answer: A,B,C
NEW QUESTION # 178
Using the Vault CLI, there are several ways to create a new policy. Select the valid commands (Select three)
- A. vault policy write my-policy - << EOF
path "secret/data/*" {
capabilities = ["create", "update"]
}
EOF - B. $ cat user.hcl | vault policy write my-policy -
- C. vault policy create my-policy /tmp/policy.hcl
- D. vault policy write my-policy /tmp/policy.hcl
Answer: A,B,D
Explanation:
Comprehensive and Detailed in Depth Explanation:
Vault provides multiple valid ways to create a policy via the CLI using the vault policy write command. The HashiCorp Vault documentation states: "To write a policy, use the vault policy write command." The valid methods are:
* A: "vault policy write my-policy - << EOF ... EOF uses heredoc syntax to inline policy content, which Vault accepts directly."
* C: "vault policy write my-policy /tmp/policy.hcl writes a policy from a file, a standard method per the docs: 'The policy can be read from a file or piped from stdin.'"
* D: "cat user.hcl | vault policy write my-policy - pipes policy content from a file via stdin, another documented approach: 'You can pipe the policy content to the command using -.'" Option B, vault policy create, is invalid as no such command exists-only vault policy write is used. Thus, A, C, and D are correct.
Reference:
HashiCorp Vault Documentation - Policies: Write a Policy
NEW QUESTION # 179
What is the Vault CLI command to query information about the token the client is currently using?
- A. vault self-lookup
- B. vault token lookup
- C. vault lookup token
- D. vault lookup self
Answer: B
Explanation:
The Vault CLI command to query information about the token the client is currently using is vault token lookup. This command displays information about the token or accessor provided as an argument, or the locally authenticated token if no argument is given. The information includes the token ID, accessor, policies, TTL, creation time, and metadata. This command can be useful for debugging and auditing purposes, as well as for renewing or revoking tokens. References: token lookup - Command | Vault | HashiCorp Developer, Tokens | Vault | HashiCorp Developer
NEW QUESTION # 180
......
HCVA0-003 Exam Dumps - PDF Questions and Testing Engine: https://www.exams-boost.com/HCVA0-003-valid-materials.html
HCVA0-003 Dumps - The Sure Way To Pass Exam: https://drive.google.com/open?id=1_wpAODczjZ62c4Z8X1cLW90LScjRYmxz