2026 Latest Vault-Associate-002 Exam Dumps Recently Updated 105 Questions
HashiCorp Vault-Associate-002 Real 2026 Braindumps Mock Exam Dumps
NEW QUESTION # 18
Which of the following statements describe the CLI command below?
$ vault login -method=ldap username=mitchellh
- A. Fails because the password is not provided
- B. Generates a token which is response wrapped
- C. You will be prompted to enter the password
- D. By default, the generated token is valid for 24 hours
Answer: C
NEW QUESTION # 19
An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is AWS.
- A. False
- B. True
Answer: A
NEW QUESTION # 20
An organization would like to use a scheduler to track & revoke access granted to a job (by Vault) at completion.
What auth-associated Vault object should be tracked to enable this behavior?
- A. Token ID
- B. Lease ID
- C. Token accessor
- D. Authentication method
Answer: C
NEW QUESTION # 21
Vault Agent supports which of the following? (Choose two.)
- A. Local replica of transit encryption key
- B. Auto-unseal Vault
- C. Local key/value store
- D. Auto authentication
- E. Secrets Cachin
Answer: D,E
NEW QUESTION # 22
Which command will generate a new transit key?
- A. vault create transit/keys/my-key
- B. vault put transit/keys/my-key
- C. vault write -f transit/keys/my-key
- D. vault create -f transit/keys/my-key
Answer: C
NEW QUESTION # 23
What methods of authentication does Vault support? (Choose four.)
- A. GitHub
- B. MMSQL
- C. LDAP
- D. AppRole
- E. Nomad
- F. PostgreSQL
- G. JWT/OIDC
Answer: A,C,D,G
NEW QUESTION # 24
Which of the following statements are true about Vault policies? (Choose two.)
- A. The default policy can not be modified
- B. Vault must be restarted in order for a policy change to take an effect
- C. Policies deny by default (empty policy grants no permission)
- D. You must use YAML to define policies
- E. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault
Answer: C,E
NEW QUESTION # 25
The 'alpha' secrets are stored in the team-based paths using this convention:
secret/<team_name>/alpha. For example, secret/team01/alphaand
/secrets/team02/alpha.
Which Vault policy would not allow reading paths with the word "beta" in them, such as secrets/team01/beta?
- A.
- B. None of the above
- C.
- D.
Answer: A
NEW QUESTION # 26
What is a secret in the context of Vault?
- A. HTTP session token that provides authorization to Vault
- B. Engine responsible for logging all requests and responses
- C. Threshold of keys required to unseal the Vault
- D. Anything stored or returned that contains confidential material
Answer: D
NEW QUESTION # 27
Vault operators can create two types of groups in Vault. What are the two types?
- A. security groups
- B. internal groups
- C. user groups
- D. policy groups
- E. external groups
Answer: B,E
NEW QUESTION # 28
What environment variable overrides the CLI's default Vault server address?
- A. VAULT_ADDRESS
- B. VAULT_HTTPS_ADDRESS
- C. VAULT_HTTP_ADDRESS
- D. VAULT_ADDR
Answer: D
NEW QUESTION # 29
To make an authenticated request via the Vault HTTP API, which header would you use?
- A. The X-Vault-NamespaceHTTP Header
- B. The X-Vault-RequestHTTP Header
- C. The Content-TypeHTTP Header
- D. The X-Vault-TokenHTTP Header
Answer: D
NEW QUESTION # 30
Which of the following describes the Vault's auth method component?
- A. It dynamically generates a unique set of secrets with appropriate permissions attached
- B. It verifies a client against an internal or external system, and generates a token with rootpolicy
- C. It is responsible for durable storage of client tokens
- D. It verifies a client against an internal or external system, and generates a token with the appropriate policies attached
Answer: D
NEW QUESTION # 31
You can use a response-wrapping token more than once for as long as it has not expired.
- A. False
- B. True
Answer: A
NEW QUESTION # 32
Which statement describes the results of this command: vault kv list secret/test?
- A. List the existing key names at the "secret/test" path
- B. Output all key names from all key/value secrets engine
- C. Check the status of a specific key/value secrets engine
- D. Output all key/value secrets engines
Answer: A
NEW QUESTION # 33
Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would you recommend?
- A. SSH secrets engine
- B. Identity secrets engine
- C. Key/Value secrets engine version 2
- D. Google Cloud Secrets Engine
Answer: D
NEW QUESTION # 34
Where does the Vault Agent store its cache?
- A. In the Vault key/value store
- B. In a file encrypted using the Vault transit secret engine
- C. In memory
- D. In an unencrypted file
Answer: C
NEW QUESTION # 35
A developer mistakenly committed code that contained AWS S3 credentials into a public repository. You have been tasked with revoking the AWS S3 credential that was in the code. This credential was created using Vault's AWS secrets engine and the developer received the following output when requesting a credential from Vault.
Which Vault command will revoke the lease and remove the credential from AWS?
vault lease revoke aws/creds/s3-access/f3e92392-7d9c-09c8-c921-
- A. vault lease revoke AKIAIOMQXTLW36DV7IEA
- B. vault lease revoke f3e92392-7d9c-09c8-c921-575d62fe80d8
- C. 575d62fe80d8
- D. vault lease revoke access_key=AKIAIOWQXTLW36DV7IEA
Answer: C
NEW QUESTION # 36
......
Verified Vault-Associate-002 Exam Dumps Q&As - Provide Vault-Associate-002 with Correct Answers: https://www.pass4cram.com/Vault-Associate-002_free-download.html
Vault-Associate-002 Exam Questions | Real Vault-Associate-002 Practice Dumps: https://drive.google.com/open?id=137maDi1d1xx2lOfRPxmLxpLGzF8KpgHZ