Based on the output below, how many policies have been added to Vault? $ vault policy list base default root web-app-1automation-team
Answer(s): A
Comprehensive and Detailed In-DepthThe vault policy list command displays all policies in Vault. The output lists five policies: "base", "default", "root", "web-app-1", and "automation-team". However, "root" and "default" are built-in policies:Built-in Policies:"root": A superuser policy created by default."default": Provides common permissions, also default. "Vault has two default policies, root and default."Added Policies:"base", "web-app-1", "automation-team" are not built-in, meaning they were added. Thus, 3 policies were added.Incorrect Options:B . 4: Overcounts by including one built-in.C . 1, D. 2: Undercounts the added policies.
https://developer.hashicorp.com/vault/docs/concepts/policies#built-in-policies
Although batch and service tokens share many characteristics, which of the following are true only about batch tokens? (Select three)
Answer(s): C,D,E
Comprehensive and Detailed In-DepthBatch and service tokens differ in key ways, with these unique to batch tokens:C . Maintain a single fixed TTL: "Batch tokens maintain a single fixed TTL," non-renewable, unlike service tokens.D . Valid across clusters: "They are valid for either the primary or any secondary clusters," enhancing flexibility in replicated setups.E . Not persisted to disk: "Batch tokens are not persisted to disk," reducing exposure risk.Incorrect Options:A . Can create child tokens: "Batch tokens cannot create child tokens," unlike service tokens. B. Renewable: "Batch tokens are not renewable," a key distinction from service tokens.Batch tokens prioritize lightweight, ephemeral use.
https://developer.hashicorp.com/vault/docs/concepts/tokens#token-type-comparison
What features are offered by the Vault Agent? (Select three)
Answer(s): B,C,D
Comprehensive and Detailed In-DepthThe Vault Agent is a client-side daemon with these features:B . Templating: "Allows rendering of user-supplied templates by Vault Agent," integrating secrets into configs.C . Auto-auth: "Automatically authenticate to Vault and manage token renewal," simplifying auth workflows.D . Secret caching: "Allows client-side caching of responses," reducing Vault load.Incorrect Option:A . Auditing: Handled by Vault's audit devices, not Agent. "Auditing is typically handled by enabling audit devices."
https://developer.hashicorp.com/vault/docs/v1.16.x/agent-and-proxy/agent
You need to decrypt customer data to provide it to an application. When you run the decryption command, you get the output below. Why does the response not directly reveal the cleartext data? $ vault write transit/decrypt/phone_number ciphertext="vault:v1:tgx2vsxtlQRfyLSKvem..." Key Value--- -----plaintext aGFzaGljb3JwIGNlcnRpZmllZDogdmF1bHQgYXNzb2NpYXRl
Answer(s): B
Comprehensive and Detailed In-DepthThe Vault Transit secrets engine returns decrypted data in base64-encoded format:B . The output is base64 encoded: "All plaintext data must be base64-encoded before being encrypted by Vault. As a result, decrypted data is always base64 encoded." Users must decode it (e.g., using base64 -d) to see cleartext.Incorrect Options:A . Permission Issue: Permissions would cause an error, not encoded output. "Not because the user lacks permission."C . Wrapped Token: The output is plaintext, not a token. "Not a response wrapped token." D. Original Encryption: Irrelevant; the issue is encoding, not encryption state. This encoding ensures safe transmission of binary data.
https://developer.hashicorp.com/vault/docs/secrets/transit#usage
You are considering using HCP Vault Dedicated but are concerned about differences between a hosted version and a self-hosted deployment. Which of the following statements is true about HCPVault Dedicated?
Comprehensive and Detailed In-DepthHCP Vault Dedicated is a managed Vault service provided by HashiCorp, designed to mirror the self- hosted Vault Enterprise experience while simplifying deployment:A . Same Vault Binary: "HCP Vault Dedicated provides a similar experience to self-hosted Vault Enterprise because it uses the same Vault binary." This ensures consistency in functionality, CLI commands, APIs, and UI interactions, making it familiar to users of self-hosted Vault. The documentation confirms: "HCP Vault Dedicated uses the same binary as self-hosted Vault Enterprise, which means you will have a consistent user experience." Incorrect Options:B . Multi-Cloud Deployment: HCP Vault Dedicated is a HashiCorp-managed service, not deployable by users on any cloud provider. "It is specifically offered as a hosted solution by HashiCorp and does not support deployment on other cloud platforms." It currently supports AWS and Azure, but not full multi-cloud flexibility.C . Different CLI/APIs: The use of the same binary ensures identical CLI and API interfaces. "Does not require different CLI commands and APIs compared to self-hosted Vault Enterprise." D . Single Region Limitation: It supports multiple regions (e.g., North America, Asia, Europe). "Not limited to a single region and can be deployed across multiple regions." This consistency aids adoption for organizations transitioning to a managed solution.
https://developer.hashicorp.com/hcp/docs/vault/what-is-hcp-vault#why-hcp-vault- dedicated
Post your Comments and Discuss HashiCorp HCVA0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the HCVA0-003 content, but please register or login to continue.