Free HashiCorp Vault-Associate Actual Exam Questions

Makes sense to pick D since listing usually refers to seeing all keys or paths under that prefix without accessing full secret contents. D it is.

D. Update usually means changing data, so that doesn’t fit. Sudo is more about admin privileges, so probably not needed just for viewing. Between read and list, list sounds more specific to showing all endpoints or keys under a path, which matches the question about displaying all under /secrets/apps/*. So D makes the most sense here.

Guessing B. The second command seems to rely on some prior initialization or authentication that the screenshot doesn’t indicate. If the GUI CLI doesn’t automatically handle those steps, it won’t succeed just by running that command alone. So without evidence of pre-config setup, it likely fails.

B. The second command looks like it needs some environment variables or authentication set up beforehand, which this screenshot doesn’t show. Without those, it probably won’t run successfully in the GUI CLI as is.

A imo, the lease revoke command requires the exact lease ID as shown, which matches option A fully. The others seem incomplete or just keys, not lease IDs.

Probably C since vault lease revoke just needs the lease ID, not the full path.

B makes the most sense to exclude since clients don’t set TTLs; those are controlled server-side. The phrase is weirdly worded but it seems to imply the client system controls TTL, which isn’t true. The others all relate to server or token configurations that can influence TTLs directly.

B, clients can’t set TTLs since it’s managed server-side.

Namespace is right below the password box, not in the dropdown.

The Namespace is usually a separate input below or near the password field, not inside a dropdown.

C helps reduce damage since credentials expire quickly after a breach.

C/B? Short-lived dynamic secrets (C) definitely limit how long stolen credentials are useful, but audit logging (B) can also help quickly identify and respond to breaches, indirectly limiting the impact.

It’s B. Orphan tokens aren’t linked to their parent’s expiration, so they keep working after the parent token expires. A is about usage limits, which doesn’t capture the core idea of orphan tokens being independent of the parent token lifecycle. C can be ruled out since tokens always have policies. D is incorrect because TTL generally applies to all tokens, including orphans, so they don’t last forever regardless.

C doesn’t fit because tokens always have some policy attached. D seems off since TTL usually applies to all tokens regardless. B best matches the idea that orphan tokens outlive their parent’s expiration.

I’m going with C because “vault lookup self” fits the pattern for checking your own token info easily, unlike B which usually needs a token ID. C seems more straightforward here.

I’m thinking B isn’t quite right since you usually need to provide a token ID with “vault token lookup.” C seems simpler for just checking your own token info without extra args. Could C really be the best fit?

B imo, looks like it targets a system entity, not individual user folders.

A, since it scopes access based on user IDs matching folder names, not system entities.

It’s A for me. From what I remember, the unseal process requires keys to be entered one after another on the same system. Even if the keys are held by different admins, the actual unsealing is done sequentially on one terminal. B sounds good for security but doesn’t align with how the unseal mechanism actually works, since you can’t input keys in parallel from different machines. D is definitely out because a single command with all keys isn’t usually supported. So, the simplest and most accurate choice is A—sequential input on one system.

C imo, the question mentions Shamir unseal keys, which are separate from PGP encryption. But using PGP to encrypt keys before sharing could add a layer of security. It’s not about the actual unseal process but protecting keys in transit or at rest. So maybe the focus is on securing keys, which fits C better than just who inputs them or how they’re entered. Options A and D don’t really address security properly, and B is about distribution but not encryption of the keys themselves.

It’s D. The transit engine is really meant for small to medium data sizes, not huge blobs like 2GB. Sending that much data through transit isn't practical or efficient.

It’s B because transit doesn’t store data permanently but can handle large blobs by using temporary storage in the backend during processing. That fits better than outright rejecting it as in D.

B, but yeah, needed equals sign like my-password=53cr3t to be valid.

B/C? The key-value should go as data arguments, so B is closer but missing the equal sign. C mixes up path and value, so probably not right either.

C imo, since the token details list the policies attached, you have to check those policies themselves for the exact paths. The token info doesn’t directly show paths, just policy names.

Option C, policies define access, but you need to check them for exact paths.

This one feels like it’s trying to trip you up on the “stored” part. Vault doesn’t keep the raw encryption key just sitting there in the backend storage, so B makes the most sense to me. The sealed key is stored but it’s encrypted, not the actual raw encryption key. So the statement saying it’s stored as-is is false. B.

B imo, storing the key in backend storage would be a huge security risk.

Option D looks solid because it explicitly includes both the base path secret/bar and the wildcard secret/bar/*, which means users can list the folder itself and also read all secrets inside it. Just having the wildcard alone might not grant list access on the exact path, so D covers both angles properly. This extra specificity is important for proper permissions in Vault policies.

Makes sense to include both secret/bar and secret/bar/* paths separately because listing the folder itself requires permission on the exact path, not just the wildcard. Option D covers read and list on secret/bar and all its sub-paths, so that should be the right pick here.