Pass the HashiCorp HashiCorp Security Automation Certification VA-002-P Questions and answers with CertsForce

Viewing page 2 out of 6 pages
Viewing questions 11-20 out of questions
Questions # 11:

An administrator wants to create a new KV mount for individual users to maintain their own secrets but needs a way to simplify the policy so they don't need to write a new one for each new user? With the requirements listed below, what would such a policy look like?

Requirement: Each user can perform all operations on their allocated key/value secret path

Options:

A.

path "user-kv/data/{{identity.entity.name}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}


B.

path "user-kv/data/{{identity.entity.id.name}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}


C.

path "user-kv/data/{{identity.entity.aliases.<>.id}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}


D.

path "user-kv/data/{{user}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}


Expert Solution
Questions # 12:

True or False:

State is a requirement for Terraform to function.

Options:

A.

True


B.

False


Expert Solution
Questions # 13:

During a terraform apply, a resource is successfully created but eventually fails during provisioning. What happens to the resource?

Options:

A.

Terraform attempts to provide the resource up to three times before exiting with an error


B.

the terraform plan is rolled back and all provisioned resources are removed


C.

it is automatically deleted


D.

the resource is marked as tainted


Expert Solution
Questions # 14:

By default, how long does the transit secrets engine store the resulting ciphertext?

Options:

A.

24 hours


B.

32 days


C.

transit does not store data


D.

30 days


Expert Solution
Questions # 15:

What happens when a terraform plan is executed?

Options:

A.

the backend is initialized and the working directory is prepped


B.

creates an execution plan and determines what changes are required to achieve the desired state in the configuration files.


C.

applies the changes required in the target infrastructure in order to reach the desired configuration


D.

reconciles the state Terraform knows about with the real-world infrastructure


Expert Solution
Questions # 16:

Why is it a good idea to declare the required version of a provider in a Terraform configuration file?

1. terraform {

2. required_providers {

3. aws = "~> 1.0"

4. }

5. }

Options:

A.

to remove older versions of the provider


B.

to ensure that the provider version matches the version of Terraform you are using


C.

providers are released on a separate schedule from Terraform itself; therefore a newer version could introduce breaking changes


D.

to match the version number of your application being deployed via Terraform


Expert Solution
Questions # 17:

What is the default method of authentication after first initializing Vault?

Options:

A.

GitHub


B.

AppRole


C.

Admin account


D.

Tokens


E.

Userpass


F.

TLS certificates


Expert Solution
Questions # 18:

What is the result of the following Vault command?

vault auth enable userpass

Options:

A.

Imports usernames and passwords from LDAP to the local database


B.

allows Vault to access usernames and passwords stored in a second Vault cluster


C.

Enables Vault to use external services to authenticate clients to Vault


D.

mounts the userpass auth method to the default path


Expert Solution
Questions # 19:

Which of the following is not an activity associated with the Vault transit secrets engine?

Options:

A.

encrypt


B.

decrypt


C.

update


D.

rewrap


Expert Solution
Questions # 20:

From the unseal options listed below, select the options you can use if you're deploying Vault on-premises. (select four)

Options:

A.

transit


B.

AWS KMS


C.

certificates


D.

key shards


E.

HSM PKCS11


Expert Solution
Viewing page 2 out of 6 pages
Viewing questions 11-20 out of questions