What command can be used to revoke all leases associated with a database role named prod-mysql?
Answer(s): B
Comprehensive and Detailed In-DepthTo revoke all leases tied to a specific database role like prod-mysql, the correct command leverages the -prefix flag:B . vault lease revoke -prefix database/creds/prod-mysql: This command revokes all leases with the prefix database/creds/prod-mysql, which corresponds to credentials generated by the prod-mysql role in the database secrets engine. "To immediately revoke all leases associated with a specific role, the user can run the command vault lease revoke -prefix database/creds/prod-mysql," ensuring targeted revocation without affecting other roles.Incorrect Options:A . vault lease revoke database/role/prod-mysql: Incorrect path; roles are at database/roles/, not leases. "Does not specify the correct path for revoking leases." C . vault revoke: Missing lease subcommand; incorrect syntax. "Does not follow the correct syntax for revoking leases."D . vault lease revoke database/creds/prod-mysql: Targets a single lease, not all, without -prefix. "Does not include the -prefix flag to revoke all leases." The -prefix approach ensures comprehensive lease cleanup for the role.
https://developer.hashicorp.com/vault/docs/commands/lease/revoke#examples
Jarrad is an AWS engineer and has provisioned a new EC2 instance running MySQL since his application requires a specific MySQL version. He wants to integrate Vault into his workflow but is new to Vault. What secrets engine should Jarrad use to integrate this new database running in AWS?
Comprehensive and Detailed In-DepthFor integrating a MySQL database on an EC2 instance with Vault, the database secrets engine is the appropriate choice:B . database: "The 'database' secrets engine in Vault is specifically designed for integrating with databases like MySQL." It generates dynamic credentials, manages rotations, and supports MySQL plugins, ideal for Jarrad's use case. "To manage the database resource, the database secrets engine should be used, specifically with the MySQL plugin."Incorrect Options:A . azure: For Azure-specific credential management, not databases. "Used for generating Azure service principal credentials."C . kv: Stores static secrets, not dynamic database credentials. "Used for storing arbitrary secrets in a key-value pair format."D . aws: Manages AWS credentials, not database integration. "Used for generating AWS access keys." The database engine's MySQL support is agnostic to the hosting platform (EC2 vs. RDS), focusing on the database itself.
https://developer.hashicorp.com/vault/docs/secrets/databases/mysql-maria
Suzy is a Vault user that needs to create and replace values at the path secrets/automation/apps/chef. Does the following policy permit her the permissions to do so? textCollapseWrapCopy path "secrets/automation/apps/chef" {capabilities = ["create", "read", "list"]}
Answer(s): A
Comprehensive and Detailed In-DepthThe policy grants specific capabilities, but not all required for Suzy's needs:A . No, Denied Actions: The policy allows "create", "read", "list" at secrets/automation/apps/chef. "Create" permits adding new key-value pairs, but "replace" (updating existing values) requires the "update" capability, which is missing. "If Suzy needs to create AND replace values (update), she needs both create and update capabilities."Incorrect Option:B . Yes: Incorrect, as "update" is omitted. "Does not include the update capability, which is required for replacing values."Without "update", Suzy can create but not replace values, limiting her ability.
https://developer.hashicorp.com/vault/docs/concepts/policies
What API endpoint is used to enable and configure a secrets engine?
Comprehensive and Detailed In-DepthThe correct API endpoint for managing secrets engines is:B . /v1/sys/mounts: "The /sys/mounts endpoint is used to manage secrets engines in Vault." It enables and configures secrets engines by mounting them at specific paths, per the documentation.Incorrect Options:A . /v1/sys/init: For Vault initialization, not secrets engines. "Used for initializing the Vault server." C . /v1/sys/config: Manages system-wide settings, not engines. "Used for system-wide configurations."D . /v1/sys/plugins/catalog: Manages plugins, not engine mounting. "Related to managing plugins and their catalog."This endpoint is central to Vault's secrets engine lifecycle.
https://developer.hashicorp.com/vault/api-docs/system/mounts
Tanner manages a data processing application and needs to be sure the data being processed is encrypted so it is securely stored post-processing. Which secrets engines can encrypt data? (Select three)
Answer(s): A,B,D
Comprehensive and Detailed In-DepthVault offers secrets engines for encryption:A . transit: "Designed specifically for encryption and decryption operations," ideal for securing data at rest.B . KMIP: "Integrates with external Key Management Systems that support the KMIP protocol," enabling encryption via external keys.D . transform: "Used for data transformation operations, including encryption and decryption," with custom pipelines.Incorrect Option:C . SSH: "Used for dynamic SSH key generation and management," not general data encryption."Only the Transit and Transform secrets engines can encrypt/decrypt data," with KMIP adding external key support.
https://developer.hashicorp.com/vault/docs/secrets/transit, https://developer.hashicorp.com/vault/docs/secrets/transform
Post your Comments and Discuss HashiCorp HCVA0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the HCVA0-003 content, but please register or login to continue.