VA-002-P Pre-Exam Practice Tests | (Updated 202 Questions)
Valid VA-002-P Exam Q&A PDF - One Year Free Update
HashiCorp VA-002-P (HashiCorp Certified: Vault Associate) Certification Exam is an excellent opportunity for professionals who work with the Vault platform to demonstrate their skills and knowledge. HashiCorp Certified: Vault Associate Exam certification is highly recognized in the industry and can open up numerous career opportunities for individuals seeking to advance their careers in cloud computing and security.
HashiCorp VA-002-P exam is a certification that authenticates an individual's skills in implementing and supporting HashiCorp Vault. VA-002-P exam is suitable for both new and experienced Vault users who are interested in validating their expertise in designing, deploying, and maintaining HashiCorp Vault.
NEW QUESTION # 89
In order to extend Vault beyond a data center or cloud regional boundary, what feature should be used?
- A. secrets engine
- B. plugins
- C. replication
- D. snapshots
- E. seal/unseal
Answer: C
Explanation:
To extend Vault beyond a data center or cloud regional boundary, replication can be used. Vault supports both DR replication and Performance replication to copy data from the primary cluster to a secondary cluster safely.
NEW QUESTION # 90
You've logged into the Vault CLI and attempted to enable an auth method, but received this error message. What can be done to resolve the error and configure Vault?
Error enabling userpass auth: Post https://127.0.0.1:8200/v1/sys/auth/userpass: http: server gave HTTP response to HTTPS client
- A. change 'userpass' to 'username and password'
- B. ask an admin to grant you permission to enable the userpass auth method
- C. set the VAULT_ADDR environment variable to HTTP
- D. restart the Vault service on this node
Answer: C
Explanation:
If you're running Vault in a non-prod environment, you can configure Vault to disable TLS.
In this case, TLS has been disabled but the default value for VAULT_ADDR is https://127.0.0.1:8200, therefore Vault is sending the request over HTTPS but Vault is responding using HTTP since TLS is disabled.
To handle this error, set the VAULT_ADDR environment variable to "http://127.0.0.1:8200".
NEW QUESTION # 91
From the options below, select the benefits of using a batch token over a service token. (select three)
- A. can be a root token
- B. lightweight and scalable
- C. used for ephemeral, high-performance workloads
- D. has accessors
- E. no storage cost for token creation
Answer: B,C,E
Explanation:
Service Tokens
Service tokens are what users will generally think of as "normal" Vault tokens. They support all features, such as renewal, revocation, creating child tokens, and more. They are correspondingly heavyweight to create and track.
Batch Tokens
Batch tokens are encrypted blobs that carry enough information for them to be used for Vault actions, but they require no storage on disk to track them. As a result, they are extremely lightweight and scalable but lack most of the flexibility and features of service tokens.
Reference link:- https://www.vaultproject.io/docs/concepts/tokens
NEW QUESTION # 92
True or False? By default, Terraform destroy will prompt for confirmation before proceeding.
- A. False
- B. True
Answer: B
Explanation:
Terraform destroy will always prompt for confirmation before executing unless passed the -auto-approve flag.
$ terraform destroy
Do you really want to destroy all resources?
Terraform will destroy all your managed infrastructure, as shown above.
There is no undo. Only 'yes' will be accepted to confirm.
Enter a value:
NEW QUESTION # 93
What are some of the features of Terraform state? (select three)
- A. inspection of cloud resources
- B. determining the correct order to destroy resources
- C. increased performance
- D. mapping configuration to real-world resources
Answer: B,C,D
Explanation:
See this page on the purpose of Terraform state and the benefits it provides.
NEW QUESTION # 94
A user creates three workspaces from the command line - prod, dev, and test. Which of the following commands will the user run to switch to the dev workspace?
- A. terraform workspace dev
- B. terraform workspace -switch dev
- C. terraform workspace select dev
- D. terraform workspace switch dev
Answer: C
Explanation:
The terraform workspace select command is used to choose a different workspace to use for further operations. https://www.terraform.io/docs/commands/workspace/select.html
NEW QUESTION # 95
Unsealing Vault creates the encryption keys, which is used to unencrypt the data on the storage backend.
- A. FALSE
- B. TRUE
Answer: A
Explanation:
Unsealing is the process of obtaining the plaintext master key necessary to read the decryption key to decrypt the data, allowing access to the Vault. The master key is used to decrypt the encryption key which can unencrypt the data on the storage backend.
NEW QUESTION # 96
What type of token does not have a TTL (time to live)?
- A. expired tokens
- B. user tokens
- C. parent tokens
- D. root tokens
- E. default tokens
- F. child tokens
Answer: D
Explanation:
Non-root tokens are associated with a TTL, which determines how long a token is valid. Root tokens are not associated with a TTL, and therefore, do not expire.
Root tokens are tokens that have the root policy attached to them. They are the only type of token within Vault that are not associated with a TTL, and therefore, do not expire.
NEW QUESTION # 97
Using multi-cloud and provider-agnostic tools provides which of the following benefits? (select two)
- A. can be used across major cloud providers and VM hypervisors
- B. increased risk due to all infrastructure relying on a single tool for management
- C. slower provisioning speed allows the operations team to catch mistakes before they are applied
- D. operations teams only need to learn and manage a single tool to manage infrastructure, regardless of where the infrastructure is deployed
Answer: A,D
Explanation:
Using a tool like Terraform can be advantageous for organizations deploying workloads across multiple public and private cloud environments. Operations teams only need to learn a single tool, single language, and can use the same tooling to enable a DevOps-like experience and workflows.
NEW QUESTION # 98
When architecting a Vault replication configuration, why should you never terminate TLS on a front-end load balancer?
- A. Vault requires that only Consul service discovery can be used to direct traffic to an active Vault node.
- B. Vault replication won't work with the type of certificates that a traditional load balancer uses.
- C. Vault generates self-signed mutual TLS for replication. If the LB is performing TLS termination, this will break the mutual TLS between nodes.
- D. If Vault detects that the traffic has been unencrypted and re-encrypted, due to the load balancer, it will automatically drop the traffic as it is no longer trusted.
Answer: C
Explanation:
For replication (port 8201), Vault generates a mutual TLS connection between nodes using self-generated certs/keys (this is different than the TLS you configure in the listener, which is particular to client requests)... server-to-server always uses this mutual TLS, even if you have TLS disabled on the listener.
Reference link:-
https://www.vaultproject.io/docs/configuration/listener/tcp
https://www.vaultproject.io/docs/concepts/ha
NEW QUESTION # 99
When using parent/child modules to deploy infrastructure, how would you export value from one module to import into another module?
For example, a module dynamically deploys an application instance or virtual machine, and you need the IP address in another module to configure a related DNS record in order to reach the newly deployed application.
- A. configure the pertinent provider's configuration with a list of possible IP addresses to use
- B. export the value using terraform export and input the value using terraform input
- C. preconfigure the IP address as a parameter in the DNS module
- D. configure an output value in the application module in order to use that value for the DNS module
Answer: D
Explanation:
Output values are like the return values of a Terraform module and have several uses such as a child module using those outputs to expose a subset of its resource attributes to a parent module.
NEW QUESTION # 100
Which flag would be used within a Terraform configuration block to identify the specific version of a provider required?
- A. required-provider
- B. required-version
- C. required_providers
- D. required_versions
Answer: C
Explanation:
For production use, you should constrain the acceptable provider versions via configuration file to ensure that new versions with breaking changes will not be automatically installed by terraform init in the future. When terraform init is run without provider version constraints, it prints a suggested version constraint string for each provider For example:
terraform {
required_providers {
aws = ">= 2.7.0"
}
}
NEW QUESTION # 101
What is the Consul Agent?
- A. a process that registers services with Consul
- B. a daemon that Vault uses to register auth methods across all of its clusters to ensure consistency among the data written to disk
- C. an agent that runs in the background to provide additional features for Consul
- D. the core process of Consul which maintains membership information, manages services, runs checks, responds to queries, and more.
Answer: D
Explanation:
The Consul agent is the core Consul process that runs the Consul service. Everything Consul does is the result of the Consul agent, which can run in either server or client mode.
Reference link:- https://www.consul.io/docs/agent
NEW QUESTION # 102
What is the purpose of using the local-exec provisioner? (select two)
- A. ensures that the resource is only executed in the local infrastructure where Terraform is deployed
- B. executes a command on the resource to invoke an update to the Terraform state
- C. to invoke a local executable
- D. to execute one or more commands on the machine running Terraform
Answer: C,D
Explanation:
The local-exec provisioner invokes a local executable after a resource is created. This invokes a process on the machine running Terraform, not on the resource.
Note that even though the resource will be fully created when the provisioner is run, there is no guarantee that it will be in an operable state - for example, system services such as sshd may not be started yet on compute resources.
NEW QUESTION # 103
Using the Vault CLI, what command is used to authenticate to Vault?
- A. vault auth
- B. vault login
- C. vault user
- D. vault creds
Answer: B
Explanation:
vault login command would be issued to log in to Vault via CLI followed by the type of login.
For example, an LDAP login would use vault login method=ldap username=<user>
NEW QUESTION # 104
Which of the following cloud providers are not supported by Vault secrets engines?
- A. GCP
- B. AliCloud
- C. Oracle
- D. AWS
- E. Azure
Answer: C
Explanation:
Vault supports AWS, Azure, Google Cloud, and Alibaba Cloud out of the box for secrets engines
NEW QUESTION # 105
An application is trying to use a secret in which the lease has expired. What can be done in order for the application to successfully request data from Vault?
- A. request the TTL be extended for the secret
- B. perform a lease renewal
- C. request a new secret and associated lease
- D. try the expired secret in hopes it hasn't been deleted yet
Answer: C
Explanation:
A lease must be renewed before it has expired. Once it has expired, it is permanently revoked and a new secret must be requested.
NEW QUESTION # 106
Which of the following policies would permit a user to generate dynamic credentials on a database?
- A. path "database/creds/read_only_role" {
capabilities = ["generate"]
} - B. path "database/creds/read_only_role" {
capabilities = ["sudo"]
} - C. path "database/creds/read_only_role" {
capabilities = ["list"]
} - D. path "database/creds/read_only_role" {
capabilities = ["read"]
}
Answer: D
Explanation:
The HTTP request is a GET which corresponds to a read capability. Thus, to grant access to generate database credentials, the policy would grant read access on the appropriate path.
NEW QUESTION # 107
Which of the following statements best describes the Terraform list(...) type?
- A. a collection of named attributes that each have their own type.
- B. a collection of unique values that do not have any secondary identifiers or ordering.
- C. a collection of values where each is identified by a string label.
- D. a sequence of values identified by consecutive whole numbers starting with zero.
Answer: D
Explanation:
A terraform list is a sequence of values identified by consecutive whole numbers starting with zero.
https://www.terraform.io/docs/configuration/types.html#structural-types
NEW QUESTION # 108
After encrypting data using the transit secrets engine, you've received the following output. Which of the following is true based upon the output?
1. Key Value
2. --- -----
3. ciphertext vault:v2:45f9zW6cglbrzCjI0yCyC6DBYtSBSxnMgUn9B5aHcGEit71xefPEmmjMbrk3
- A. this is the second version of the encrypted data
- B. similar to the KV secrets engine, the transit secrets engine was enabled using the transit v2 option
- C. the data is stored in Vault using a KV v2 secrets engine
- D. the original encryption key has been rotated at least once
Answer: D
Explanation:
When data is encrypted using Vault, the resulting ciphertext is prepended by the version of the key used to encrypt it. In this case, the version is v2, which means that the encryption key was rotated at least one time. Any data that was encrypted with the original key would have been prepended with vault:v1 To rotate a key, use the command vault write -f transit/keys/<key name>/rotate Reference link:- https://learn.hashicorp.com/vault/encryption-as-a-service/eaas-transit
NEW QUESTION # 109
Which of the following is an invalid variable name?
- A. instance_name
- B. var1
- C. count
- D. web
Answer: C
Explanation:
count is a reserved word. The count parameter on resources can simplify configurations and let you scale resources by simply incrementing a number.
https://www.terraform.io/intro/examples/count.html
NEW QUESTION # 110
Which of the following settings are configured using the configuration file? (select three)
- A. Auth Methods
- B. Namespaces
- C. Replication
- D. Seal Type
- E. Storage Backend
- F. Audit Devices
- G. Cluster Name
Answer: D,E,G
Explanation:
Seal types, Storage backends, and cluster names are just a few of the configurations done via the configuration file. The others are configured within Vault itself.
NEW QUESTION # 111
Which is not a benefit of running HashiCorp Vault in your environment?
- A. Consolidate static, long-lived passwords used throughout your organization
- B. Act as root or intermediate certificate authority to automate the generation of PKI certificates
- C. The ability to generate dynamic secrets for applications and resource access
- D. Integrate with your code repository to pull secrets when deploying your applications
Answer: D
Explanation:
Vault does not integrate with any VCS (Version Control System) to checkout or read code. However, It can use GitHub as an auth method.
NEW QUESTION # 112
......
HashiCorp VA-002-P exam is a certification exam for those who are looking to become certified in Vault Associate. VA-002-P exam is designed to test your knowledge and understanding of the Vault tool, which is a popular open-source tool for managing secrets.
HashiCorp Certified: Vault Associate Exam Free Update Certification Sample Questions: https://www.braindumpquiz.com/VA-002-P-exam-material.html
Trend for HashiCorp VA-002-P pdf dumps before actual exam: https://drive.google.com/open?id=1a8-mJ4bg_zBrfsxuJdZPR6cXMSLg8ML1