A new Vault administrator is writing a CURL command (shown below) to retrieve a secret stored in a KV v2 secrets engine at secret/audio/soundbooth but is receiving an error. What could be the cause of the error?$ curl \--header "X-Vault-Token: hvs.rffHw0iXqkRo19b2cjf93DM39WjpbN3J" \ https://vault.unlimited.com:8200/v1/secret/audio/soundbooth
Answer(s): B
Comprehensive and Detailed in DepthThe error occurs because the CURL command uses the wrong endpoint for a KV v2 secrets engine. The HashiCorp Vault documentation states: "The KVv2 store uses a prefixed API, which is different from the version 1 API. Writing and reading versions are prefixed with the data/ path." For KV v2, the correct endpoint to retrieve a secret is /v1/secret/data/audio/soundbooth, not /v1/secret/audio/soundbooth, which applies to KV v1.The docs explain: "In KV v2, the data/ prefix is required when accessing secrets via the API to distinguish data operations from metadata or versioning tasks." Option A (VAULT_ADDR) is irrelevant for API calls, as it's CLI-specific. Option C (token UI restriction) is incorrect--tokens apply universally. Option D misinterprets v1 as the API version, not the engine version. Thus, B is correct.
HashiCorp Vault Documentation - KV v2: ACL Rules
Which of the following is not an action associated with the Transit secrets engine when interacting with data?
Answer(s): D
Comprehensive and Detailed in DepthThe Transit secrets engine focuses on cryptographic operations, not data storage or modification. The HashiCorp Vault documentation states: "The transit secrets engine handles cryptographic functions on data in-transit. Vault doesn't store the data sent to the secrets engine. It can also be viewed as `cryptography as a service' or `encryption as a service'. The transit secrets engine can also sign and verify data; generate hashes and HMACs of data; and act as a source of random bytes." It further notes: "You can, however, rewrap data when the key has been rotated to ensure data is encrypted with the latest version." Supported actions include encrypt, decrypt, and rewrap, but update is not a function, as Transit doesn't store or modify data. Thus, D is correct.
HashiCorp Vault Documentation - Transit Secrets Engine
After a client has authenticated to Vault, what security feature is used to make all subsequent calls?
Answer(s): F
Comprehensive and Detailed in DepthAfter authentication, Vault uses tokens for all subsequent calls. The HashiCorp Vault documentation states: "After authenticating, a client is issued a service token which is associated with a policy. That token is used to make all subsequent requests to Vault." Tokens serve as the primary security feature for authorizing and authenticating requests.The docs elaborate: "Tokens are the core method for authentication within Vault. Once authenticated, the client uses this token to access secrets and perform operations according to the attached policies." Other options like ldap, pgp, path, key shard, and listener are unrelated to this role. Thus, F is correct.
HashiCorp Vault Documentation - Authentication Concepts
Which two characters can be used when writing a policy to reflect a wildcard or path segment? (Select two)
Answer(s): C,F
Comprehensive and Detailed in DepthVault policies use specific characters for wildcards and path segments. The HashiCorp Vault documentation states: "The plus sign (+) can be used to denote a path segment and can be used in the middle of a path. The splat (*) can be used as a wildcard but can only be used at the very end of a path." These are the only characters designated for such purposes in policy syntax. The docs add: "For example, secret/data/* matches all paths under secret/data/, while secret/+/foo matches a single segment like secret/bar/foo." &, @, $, and # have no special meaning in Vault policies. Thus, C (*) and F (+) are correct.
HashiCorp Vault Documentation - Policies: Policy Syntax
Beyond encryption and decryption of data, which of the following is not a function of the Transit secrets engine?
Answer(s): C
Comprehensive and Detailed in DepthThe Transit secrets engine focuses on cryptographic operations, not storage. The HashiCorp Vault documentation states: "The transit secrets engine handles cryptographic functions on data in-transit. Vault doesn't store the data sent to the secrets engine. It can also be viewed as `cryptography as a service' or `encryption as a service'. The transit secrets engine can also sign and verify data; generate hashes and HMACs of data; and act as a source of random bytes." It emphasizes: "Vault does not store the data sent to the secrets engine," making store the encrypted data (C) incorrect. Generate hashes/HMACs (A), sign/verify (B), and random bytes (D) are all supported functions. Thus, C is correct.
Post your Comments and Discuss HashiCorp HCVA0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the HCVA0-003 content, but please register or login to continue.