[Mar 07, 2026] Vault-Associate-002 Practice Exam Dumps - 99% Marks In HashiCorp Exam
Updated Verified Vault-Associate-002 Q&As - Pass Guarantee or Full Refund
NEW QUESTION # 59
How many Shamir's key shares are required to unseal a Vault instance?
- A. A quorum of key shares
- B. All key shares
- C. One or more keys
- D. The threshold number of key shares
Answer: D
NEW QUESTION # 60
Which of these is not a benefit of dynamic secrets?
- A. Supports systems which do not natively provide a method of expiring credentials
- B. Ensures that administrators can see every password used
- C. Replaces cumbersome password rotation tools and practices
- D. Minimizes damage of credentials leaking
Answer: B
NEW QUESTION # 61
When using Integrated Storage, which of the following should you do to recover from possible data loss?
- A. Use audit logs
- B. Use snapshot
- C. Use server logs
- D. Failover to a standby node
Answer: B
NEW QUESTION # 62
Which Vault secret engine may be used to build your own internal certificate authority?
- A. Transit
- B. PostgreSQL
- C. PKI
- D. Generic
Answer: C
NEW QUESTION # 63
An authentication method should be selected for a use case based on:
- A. The cloud provider for which the client is located on
- B. Compatibility with the secret engine which is to be used
- C. The auth method that best establishes the identity of the client
- D. The strongest available cryptographic hash for the use case
Answer: C
NEW QUESTION # 64
The vault lease renew command increments the lease time from:
- A. The end of the lease
- B. The current time
Answer: B
NEW QUESTION # 65
The 'alpha' secrets are stored in the team-based paths using this convention:
secret/<team_name>/alpha. For example, secret/team01/alphaand
/secrets/team02/alpha.
Which Vault policy would not allow reading paths with the word "beta" in them, such as secrets/team01/beta?
- A. None of the above
- B.
- C.
- D.
Answer: D
NEW QUESTION # 66
What is the Vault CLI command to query information about the token the client is currently using?
- A. vault self lookup
- B. vault lookup self
- C. vault token lookup
- D. vault lookup token
Answer: C
NEW QUESTION # 67
Which statement describes the results of this command: vault kv list secret/test?
- A. Output all key names from all key/value secrets engine
- B. Output all key/value secrets engines
- C. Check the status of a specific key/value secrets engine
- D. List the existing key names at the "secret/test" path
Answer: D
NEW QUESTION # 68
Which endpoint can be used to list all tokens?
- A. /secrets/kv
- B. /auth/token/list
- C. /auth/token/accessors
- D. /kv/secrets
Answer: C
NEW QUESTION # 69
One of the benefits of using the Vault transit secrets engine is its ability to easily rotate encryption keys. Which of these is true regarding key rotation?
- A. Encryption keys can be rotated manually by a user, or by an automated process which invokes the key rotation API
- B. Vault does not maintain the versioned keyring
- C. Vault automatically rotates the encryption key based on a set period
- D. Vault can rotate encryption keys, but cannot enforce restrictions about the minimum encryption key version
Answer: A
NEW QUESTION # 70
To encrypt your secret with the transit secrets engine, you must send the Base32-encoded plaintext to Vault.
- A. False
- B. True
Answer: A
NEW QUESTION # 71
You can use a response-wrapping token more than once for as long as it has not expired.
- A. False
- B. True
Answer: A
NEW QUESTION # 72
A user successfully logs into Vault with the following cURL command:
curl --request POST --data @payload.json
http://127.0.0.1:8200/v1/auth/ldap/login/mitchellh
The response will include what information?
- A. access_key and policies
- B. client_token and policies
- C. access_key and secrets available
- D. client_token and secrets available
Answer: B
NEW QUESTION # 73
What is true of Vault tokens? Choose TWO correct answers.
- A. Vault tokens are also known as unseal keys
- B. Vault tokens are required for every Vault call
- C. Vault tokens are the core method for authentication in Vault
- D. Vault token IDs always begin with "s." such as s.E7rOurS2n7m2Dt5409jWxR87
- E. Vault tokens are generated by every authentication method login
Answer: C,E
NEW QUESTION # 74
Examine the command below. Output has been trimmed.
Which of the following statements describe the command and its output?
- A. Generated token is an orphan token which can be renewed indefinitely
- B. Generated token's TTL is 60 hours
- C. Missing a default token policy
- D. Configures the AppRole auth method with user specified role ID and secret ID
Answer: D
NEW QUESTION # 75
Which statement is true about an orphan token?
- A. It is not persisted
- B. It has a use limit
- C. It does not expire when its parent does
- D. It does not have a max time-to-live (TTL)
Answer: C
NEW QUESTION # 76
Use this screenshot to answer the question below:
Which statement describes this AppRole auth method configuration?
- A. It is enabled at "App1" path
- B. Generates multiple tokens with TTL set to 5 minutes
- C. Generates batch tokens with TTL set to 5 minutes
- D. It is enabled at "auth_approle_f23dd79f" path
Answer: C
NEW QUESTION # 77
Which statement describes the results of this command: $ vault secrets enable - version=2 kv(Choose two.)
- A. The -versionis an invalid flag
- B. Enables the secrets engine at path kv/
- C. Enables K/V v2 secrets engine
- D. Enables the secrets engine at path kv2/
- E. Enables K/V v1 secrets engine
Answer: B,C
NEW QUESTION # 78
What command creates a secret with the key "my-password" and the value "53cr3t" at path "my- secrets" within the KV secrets engine mounted at "secret"?
- A. vault kv put secret/my-secrets/my-password 53cr3t
- B. vault kv write secret/my-secrets/my-password 53cr3t
- C. vault kv write 53cr3t my-secrets/my-password
- D. vault kv put secret/my-secrets my-password-53cr3t
Answer: A
NEW QUESTION # 79
The mechanism to associate an authentication method with access to specific secrets is by specifying a/an:
- A. Accessor
- B. Secret
- C. Policy
- D. Token
Answer: C
NEW QUESTION # 80
Use this screenshot to answer the question below:
Where on this page would you click to view a secret located at secret/my-secret?
- A. Option C
- B. Option A
- C. Option E
- D. Option D
- E. Option B
Answer: D
NEW QUESTION # 81
What does the following policy do?
- A. Allows a user to read data about the secret endpoint identity
- B. Grants access to a special system entity folder
- C. Grants access for each user to a KV folder which shares their id
- D. Nothing, this is not a valid policy
Answer: C
NEW QUESTION # 82
Which of the following cannot define the maximum time-to-live (TTL) for a token?
- A. By the mount endpoint configuration
- B. System max TTL
- C. By the authentication method
- D. A parent token TTL
- E. By the client system
Answer: E
NEW QUESTION # 83
Which statements correctly describe the command below. Choose TWO correct answers.
vault write transit/decrypt/password \
ciphertext=vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13ok481zoCmHnSeD X9vyf7w==
- A. Decrypts the ciphertext if the token permits
- B. Returns the ciphertext
- C. Requires sudo capability on the transit/decrypt/password path
- D. Returns an error due to missing encryption key name
- E. Returns base64-encoded plaintext
Answer: A,E
NEW QUESTION # 84
......
Vault-Associate-002 Real Valid Brain Dumps With 105 Questions: https://www.2pass4sure.com/HashiCorp-Certification/Vault-Associate-002-actual-exam-braindumps.html
Vault-Associate-002 Certification with Actual Questions: https://drive.google.com/open?id=1931Y9g3lb2fO4sHIZgNDSqjcLAKZyBom