Access To HashiCorp Certified: Vault Associate VA-002-P Practice Exam

test2022-07-18T06:52:18+00:00

If you are worried about your VA-002-P HashiCorp Certified: Vault Associate exam, FreeTestShare provides VA-002-P Practice Exam to help you prepare for your exam easily. Our professionals have created a series of VA-002-P Practice Exam for candidates who want to ensure that they receive the maximum possible score on the actual exam. By completing them, you can ensure that you have a firm grip on the syllabus content, which increases your confidence and improves your time management skills, which will help you complete the test easily. VA-002-P Practice Exam is quite beneficial in ensuring memorable success in the HashiCorp Certified: Vault Associate exam.

To put your skills to the test, try free VA-002-P practice exam!

Page 1 of 6

1. You've logged into the Vault CLI and attempted to enable an auth method, but received this error message.

What can be done to resolve the error and configure Vault?

Error enabling userpass auth: Post https://127.0.0.1:8200/v1/sys/auth/userpass: http: server gave HTTP response to HTTPS client

change 'userpass' to 'username and password'

restart the Vault service on this node

set the VAULT_ADDR environment variable to HTTP

ask an admin to grant you permission to enable the userpass auth method

2. Beyond encryption and decryption of data, which of the following is not a function of the Vault transit secrets engine?

generate hashes and HMACs of data

sign and verify data

act as a source of random bytes

store the encrypted data securely in Vault for retrieval

3. You've hit the URL for the Vault UI, but you're presented with this screen.

Why doesn't Vault present you with a way to log in?

a vault policy is preventing you from logging in

the vault configuration file has an incorrect configuration

the consul storage backend was not configured correctly

vault needs to be initialized before it can be used

4. After logging into the Vault UI, a user complains that they cannot enable Replication.

Why would the replication configuration be missing?

replication wasn't configured in the Vault configuration file

replication hasn't been enabled

Vault is running an open-source version

replication configuration isn't available in the UI

5. $ vault

your SSH client doesn't support autocompletion

the SSH session needs to be restarted upon installation

you don't have the permissions to use autocomplete

you didn't use -force when enabling the feature

6. }

this ensures that all Terraform providers are above a certain version to match the application being deployed

the user wants to ensure that the application being deployed is a minimum version of 0.12

versions before Terraform 0.12 were not approved by HashiCorp to be used in production

Terraform 0.12 introduced substantial changes to the syntax used to write Terraform configuration

7. Which of the following terraform subcommands could be used to remove the lock on the state for the current configuration?

unlock

Removing the lock on a state file is not possible

force-unlock

state-unlock

8. Which of the following commands will remove all secrets at a specific path?

vault lease revoke -prefix <path>

vault delete lease -all <path>

vault lease revoke -all <path>

vault revoke -all <path>

9. True or False:

When using the transit secrets engine, setting the min_decryption_version will determine the minimum key length of the data key (i.e., 2048, 4096, etc.)

False

True

10. Which three interfaces can be used to access Vault? (select three)

JSON

CLI

RPC

API

Consul

Page 2 of 6

11. While Terraform is generally written using the HashiCorp Configuration Language (HCL), what another syntax can Terraform be expressed in?

JSON

XML

TypeScript

YAML

12. Anyone can publish and share modules on the Terraform Public Module Registry, and meeting the requirements for publishing a module is extremely easy.

Select from the following list all valid requirements. (select three)

The registry uses tags to identify module versions. Release tag names must be for the format x.y.z, and can optionally be prefixed with a v.

Module repositories must use this three-part name format, terraform-<PROVIDER>-<NAME>.

The module must be PCI/HIPPA compliant.

The module must be on GitHub and must be a public repo

13. Which type of Vault replication copies all data from Vault, including K/V data, policies, and client tokens?

DR replication

performance replication

failover replication

online replication

14. Select all features which are exclusive to Terraform Enterprise. (select three)

Audit Logs

Cost Estimation

Sentinel

Clustering

SAML/SSO

15. By default, how long does the transit secrets engine store the resulting ciphertext?

24 hours

32 days

transit does not store data

30 days

16. During a terraform apply, a resource is successfully created but eventually fails during provisioning.

What happens to the resource?

Terraform attempts to provide the resource up to three times before exiting with an error

the terraform plan is rolled back and all provisioned resources are removed

it is automatically deleted

the resource is marked as tainted

17. Terraform has been successfully initialized! Where are these plugins downloaded to?

/etc/terraform/plugins

The .terraform.plugins directory in the directory terraform init was executed in.

The .terraform.d directory in the directory terraform init was executed in.

The .terraform/plugins directory in the directory terraform init was executed in.

18. To prepare for day-to-day operations, the root token should be safety saved outside of Vault in order to administer Vault

False

True

19. Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (select four)

Transit

HSM

AWS KMS

Key Shards

Azure KMS

20. What system endpoint can you query to determine which node is the leader of a cluster?

/sys/tools

/sys/leader

/sys/health

/sys/init

Page 3 of 6

21. Which auth method is ideal for machine to machine authentication?

GitHub

UserPass

AppRole

Okta

22. In regards to deploying resources in multi-cloud environments, what are some of the benefits of using Terraform rather than a provider's native tooling? (select three)

Terraform simplifies management and orchestration, helping operators build large-scale, multi-cloud infrastructure

Terraform can help businesses deploy applications on multiple clouds and on-premises infrastructure

Terraform can manage cross-cloud dependencies

Terraform is not cloud-agnostic and can be used to deploy resources across a single public cloud

23. Which of the following best describes a token accessor?

a value that acts as a reference to a token which can be used to perform limited actions against the token

a token used for Consul to access Vault auth methods

describes the value associated with the tokens TTL

a value that describes which clients have access to the attached token

24. argument for alternative configurations.

Fill in the blank in the error message with the correct string from the list below.

label

version

alias

multi

25. Which of the following best describes the default local backend?

The local backend stores state on the local filesystem locks the state using system APIs and performs operations locally.

The local backend is the directory where resources deployed by Terraform have direct access to in order to update their current state

The local backend is how Terraform connects to public cloud services, such as AWS, Azure, or GC

The local backend is where Terraform Enterprise stores logs to be processed by a log collector

26. A user has created three workspaces using the command line - prod, dev, and test. The user wants to create a fourth workspace named stage.

Which command will the user execute to accomplish this?

terraform workspace -new stage

terraform workspace -create stage

terraform workspace create stage

terraform workspace new stage

27. Select all Operating Systems that Terraform is available for. (select five)

Linux

Windows

Unix

FreeBSD

Solaris

macOS

28. A "backend" in Terraform determines how the state is loaded and how an operation such as apply is executed.

Which of the following is not a supported backend type?

terraform enterprise

github

consul

artifactory

29. }

1.2.9

1.3.1

1.3.0

1.2.3

30. }

aws_eip will be created first aws_instance will be created second

no resources will be created

aws_instance will be created first aws_eip will be created second

resources will be created simultaneously

Page 4 of 6

31. Your organization has moved to AWS and has manually deployed infrastructure using the console. Recently, a decision has been made to standardize on Terraform for all deployments moving forward.

What can you do to ensure that all existing is managed by Terraform moving forward without interruption to existing services?

resources that are manually deployed in the AWS console cannot be imported by Terraform

using terraform import, import the existing infrastructure into your Terraform state

delete the existing resources and recreate them using new a Terraform configuration so Terraform can manage them moving forward

submit a ticket to AWS and ask them to export the state of all existing resources and use terraform import to import them into the state file

32. In terraform, most resource dependencies are handled automatically.

Which of the following statements describes best how terraform resource dependencies are handled?

The terraform binary contains a built-in reference map of all defined Terraform resource dependencies. Updates to this dependency map are reflected in terraform versions. To ensure you are working with the latest resource dependency map you much be running the latest version of Terraform.

Terraform analyses any expressions within a resource block to find references to other objects and treats those references as implicit ordering requirements when creating, updating, or destroying resources.

Resource dependencies are identified and maintained in a file called resource. dependencies. Each terraform provider is required to maintain a list of all resource dependencies for the provider and it's included with the plugin during initialization when terraform init is executed. The file is located in the terraform.d folder.

Resource dependencies are handled automatically by the depends_on meta_argument, which is set to true by default.

33. plaintext Y3JlZGl0LWNhcmQtbnVtYmVyCg==

The resulting plaintext data is base64-encoded. To reveal the original plaintext, use the base64 --decode command.

The data is corrupted. Execute the encryption command again using a different data key

the user doesn't have permission to decrypt the data, therefore Vault returns false data so as not to reveal if the data was actually encrypted by Vault

Vault is sealed, therefore the data cannot be decrypted. Unseal Vault to properly decrypt the data

34. http://127.0.0.1:8200/v1/sys/tools/random/164

a random string of 164 characters

a random token valid for 164 uses

None

a secured secret based on 164 bytes of data

35. When multiple engineers start deploying infrastructure using the same state file, what is a feature of remote state storage that is critical to ensure the state does not become corrupt?

state locking

object storage

encryption

workspaces

36. In order to extend a Consul storage backend, Consul nodes should be provisioned across multiple data centers or cloud regions.

True

False

37. What is a downside to using a Terraform provider, such as the Vault provider, to interact with sensitive data, such as reading secrets from Vault?

Terraform and Vault must be running on the same physical host

Terraform and Vault must be running on the same version

Terraform requires a unique auth method to work with Vault

Secrets are persisted to the state file and plans

38. When Terraform needs to be installed in a location where it does not have internet access to download the installer and upgrades, the installation is generally known as to be __________.

a private install

disconnected

non-traditional

air-gapped

39. When multiple arguments with single-line values appear on consecutive lines at the same nesting level, HashiCorp recommends that you:

place a space in between each line type = "A" ttl = "300" zone_id = aws_route53_zone.primary.zone_id

align their equals signs ami = "abc123" instance_type = "t2.micro"

place all arguments using a variable at the top ami = var.aws_ami instance_type = var.instance_size subnet_id = "subnet-0bb1c79de3EXAMPLE" tags = { Name = "HelloWorld" }

put arguments in alphabetical order name = "www.pythonfanclub.com" records = [aws_eip.lb.public_ip] type = "A" ttl = "300" zone_id = aws_route53_zone.primary.zone_id

40. True or False?

terraform init cannot automatically download Community providers.

False

True

Page 5 of 6

41. After executing a terraform apply, you notice that a resource has a tilde (~) next to it.

What does this infer?

the resource will be destroyed and recreated

the resource will be created

Terraform can't determine how to proceed due to a problem with the state file

the resource will be updated in place

42. Select the policies below that permit you to create a new entry of foo=bar at the path /secrets/apps/my_secret (select three)

path "secrets/apps/my_secret" { capabilities = ["create"] allowed_parameters = { "foo" = [] } }

path "secrets/+/my_secret" { capabilities = ["create"] allowed_parameters = { "*" = ["bar"] } }

path "secrets/apps/my_secret" { capabilities = ["update"] }

path "secrets/apps/*" { capabilities = ["create"] allowed_parameters = { "foo" = ["bar", "zip"] } }

43. Which flag would be used within a Terraform configuration block to identify the specific version of a provider required?

required-provider

required_versions

required_providers

required-version

44. What happens when a terraform plan is executed?

the backend is initialized and the working directory is prepped

creates an execution plan and determines what changes are required to achieve the desired state in the configuration files.

applies the changes required in the target infrastructure in order to reach the desired configuration

reconciles the state Terraform knows about with the real-world infrastructure

45. Which of the following Terraform files should be ignored by Git when committing code to a repo? (select two)

output.tf

terraform.tfstate

terraform.tfvars

variables.tf

46. Select the two default policies created in Vault. (select two)

default

vault

base

root

admin

user

47. Select the answer below that completes the following statement:

Terraform Cloud can be managed from the CLI but requires __________?

a TOTP token

a username and password

authentication using MFA

an API token

48. Unsealing Vault creates the encryption keys, which is used to unencrypt the data on the storage backend.

FALSE

TRUE

49. True or False? When using the Terraform provider for Vault, the tight integration between these HashiCorp tools provides the ability to mask secrets in the terraform plan and state files.

False

True

50. Which Terraform command will force a marked resource to be destroyed and recreated on the next apply?

terraform fmt

terraform destroy

terraform taint

terraform refresh

Page 6 of 6

51. True or False:

Once you create a KV v1 secrets engine and place data in it, there is no way to modify the mount to include the features of a KV v2 secrets engine.

True

False

52. A Vault client who has read access to the path secrets/apps/app1 is having trouble viewing the secret in the user interface (UI) but can access via the API.

What can be done to resolve this issue?

add read permissions to the path secrets/apps

modify the policy to allow the create permission

remove the deny policy blocking access to the secrets/apps/app1 path

add LIST to the policy so the user can browse the paths leading up to the key/value's path