Select the two paths below that would be permitted for read access based on the following Vault policy:path "secret/+/training/*" {capabilities = ["create", "read"]}
Answer(s): B,D
Comprehensive and Detailed In-DepthVault policies use path-based syntax with wildcards (+ for one segment, * for zero or more) to define permissions. The policy path "secret/+/training/*" { capabilities = ["create", "read"] } grants "create" and "read" access to paths matching this pattern.Path Analysis:The + wildcard matches exactly one segment after "secret/"."training/" must follow that segment.The * wildcard allows any number of subsequent segments (including none).Correct Paths:B . secret/cloud/training/test/exam: Matches as "cloud" fits +, followed by "training/", and "test/exam" fits *. "Permitted since + allows for cloud and * allows for test/exam." D . secret/departments/training/vault: Matches with "departments" as +, "training/", and "vault" as *. "Permitted since + allows for departments and vault is in place of *." Incorrect Paths:A . secret/business/training: Fails because there's no trailing segment after "training/" to match *."Not permitted since the wildcard is AFTER training."C . secret/departments/certification/api: Fails because "certification" replaces "training/", which is required. "Not permitted since certification does not equal training." This policy targets paths with a specific structure, ensuring precise access control.
https://developer.hashicorp.com/vault/docs/concepts/policies#policy-syntax
Which of the following features in Vault will replicate service tokens between clusters?
Answer(s): A
Comprehensive and Detailed In-DepthVault Enterprise supports replication to synchronize data across clusters, with two main types:Disaster Recovery (DR) Replication and Performance Replication. Only one replicates service tokens:A . Disaster Recovery Replication: This feature replicates critical data, including service tokens, between clusters for warm-standby failover. "DR clusters are essentially a warm-standby and do replicate tokens from the primary cluster," per the documentation. This ensures continuity in disaster scenarios.Incorrect Options:B . Performance Replication: Focuses on scaling read performance, not token replication. "Performance clusters create and maintain their own tokens. These tokens are NOT replicated." C . Vault Agent: A client-side tool for token management, not cluster replication. "It does not specifically replicate service tokens between clusters." D . Integrated Storage: A storage backend, not a replication mechanism. "It does not directly replicate service tokens between clusters."DR Replication is designed for full data consistency, including tokens, across clusters.
https://developer.hashicorp.com/vault/docs/enterprise/replication
What command can be used to update a Vault policy named web-app-1 using the command line?
Answer(s): D
Comprehensive and Detailed In-DepthTo update an existing Vault policy via the CLI, the correct command is vault policy write:D . vault policy write web-app-1 web.hcl: This command updates (or creates if it doesn't exist) the policy named "web-app-1" with the contents of "web.hcl". The documentation states: "The write keyword is used to update an existing policy with the contents of the specified file." Incorrect Options:A . vault policy create: No such subcommand exists; create is invalid. "The create keyword is not a valid subcommand."B . vault policy fmt: Formats the HCL file but doesn't update Vault. "It is used to format a policy file." C . vault policy update: Incorrect syntax; Vault uses write, not update. "There is no update command, only write."The write command's dual purpose (create or update) simplifies policy management.
https://developer.hashicorp.com/vault/docs/commands/policy/write
Your organization has many applications needing heavy read access to Vault. As these applications integrate with Vault, the primary Vault cluster's performance is negatively impacted. What feature can you use to scale the cluster and improve performance?
Comprehensive and Detailed In-DepthTo address performance issues from heavy read access, Vault Enterprise offers performance standby nodes:D . Add performance standby nodes: These nodes handle read-only requests locally, offloading the primary cluster. "Vault Enterprise offers additional features that allow HA nodes to service read-only requests on the local standby node," improving scalability and performance.Incorrect Options:A . Additional Standby Nodes: Standard HA standby nodes focus on failover, not read scaling. "May help with high availability, but not directly address performance." B . Multiple Secrets Engines: Organizes secrets but doesn't scale read performance. "Does not directly address performance issues."C . Control Groups: A resource management feature, not for scaling Vault. "Not directly related to scaling the Vault cluster."Performance standby nodes distribute read workloads effectively in Vault Enterprise.
https://developer.hashicorp.com/vault/docs/enterprise/performance-standby
When a lease is created, what actions can be performed by using only the lease ID? (Choose two)
Answer(s): A,B
Comprehensive and Detailed In-DepthA lease ID in Vault identifies a lease associated with dynamic secrets, allowing specific management actions:A . Renew the lease: "Using the lease ID, the lease can be renewed up until the maximum TTL," extending its duration without altering other properties. B . Revoke the lease: "It is possible to revoke the lease, which immediately invalidates the lease and any associated resources." This terminates the lease instantly.Incorrect Options:C . Extend the max TTL: Requires configuration changes beyond the lease ID. "This operation typically involves modifying the configuration."D . Authenticate: Lease IDs are for lease management, not authentication. "The lease ID does not have any direct relationship to authentication processes." Lease IDs enable precise control over dynamic secret lifecycles.
https://developer.hashicorp.com/vault/docs/commands/lease
Post your Comments and Discuss HashiCorp HCVA0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the HCVA0-003 content, but please register or login to continue.