By default, what TCP port does Vault replication use?
Answer(s): C
Comprehensive and Detailed in DepthVault replication ensures data consistency across clusters, using a specific port:A: 8200 - Default HTTP API port, not replication.B: 8300 - Raft protocol port, not replication.C: 8201 - Default replication port. Correct.D: 8301 - Serf protocol port, not replication.Overall Explanation from Vault Docs:"Replication occurs on TCP port 8201 by default... distinct from the API (8200) and Raft (8300) ports."
https://developer.hashicorp.com/vault/tutorials/day-one-raft/raft-reference- architecture#network-connectivity
What is the proper command to enable the AWS secrets engine at the default path?
Answer(s): B
Comprehensive and Detailed in DepthEnabling a secrets engine in Vault follows a specific syntax:A: Incorrect syntax; jumbled order.B: Correct: vault secrets enable <type> enables the AWS engine at aws/. Correct.C: Incorrect word order.D: Incorrect syntax.Overall Explanation from Vault Docs:"The command vault secrets enable <type> enables a secrets engine at its default path (e.g., aws/ for AWS)."
https://developer.hashicorp.com/vault/docs/commands/secrets
In regards to the Transit secrets engine, which of the following is true given the following command and output (select three):$ vault write encryption/encrypt/creditcard plaintext=$(base64 <<< "1234 5678 9101 1121") Key: ciphertext Value:vault:v3:cZNHVx+sxdMErXRSuDa1q/pz49fXTn1PScKfhf+PIZPvy8xKfkytpwKcbC0fF2U=
Answer(s): A,B,C
Comprehensive and Detailed in DepthA: The command uses encryption/encrypt/creditcard, indicating the Transit engine is mounted at encryption/. Correct.B: The endpoint creditcard specifies the key name used for encryption. Correct.C: The output vault:v3: shows key version 3, implying at least three versions (v1, v2, v3) after rotations. Correct.D: The default path for Transit is transit/, not encryption/. This is a custom mount, not default.Incorrect.Overall Explanation from Vault Docs:"The Transit engine encrypts data at a specified key name... Key versions (e.g., v3) indicate rotations."
https://developer.hashicorp.com/vault/docs/secrets/transit
Which of the following statements are true regarding Vault seal and unseal (select three)?
Answer(s): A,C,D
Comprehensive and Detailed in DepthA: Vault uses Shamir's Secret Sharing by default for unseal keys. Correct.B: Auto Unseal uses KMS or similar; it returns recovery keys, not unseal keys. Incorrect.C: Third-party KMS (e.g., AWS KMS) can auto-unseal Vault. Correct.D: Auto Unseal supports HA with multiple keys for redundancy. Correct.Overall Explanation from Vault Docs:"Vault uses Shamir's algorithm by default... Auto Unseal with KMS supports HA and does not return unseal keys but recovery keys."
https://developer.hashicorp.com/vault/docs/concepts/seal#seal-unseal
If Bobby is currently assigned the following policy, what additional policy can be added to ensure Bobby cannot access the data stored at secret/apps/confidential but still read all other secrets? path "secret/apps/*" { capabilities = ["create", "read", "update", "delete", "list"] }
Answer(s): A
Comprehensive and Detailed in DepthA: Denies all access to secret/apps/confidential, overriding the original policy's permissions. Correct.B: Applies to all secret/*, overly restrictive and unclear with mixed capabilities. Incorrect.C: Denies all secret/apps/*, blocking more than required. Incorrect.D: Denies subpaths under confidential, not the path itself. Incorrect.Overall Explanation from Vault Docs:"A deny capability takes precedence over any allow... Use it to restrict specific paths."
https://developer.hashicorp.com/vault/docs/concepts/policies#capabilities
Post your Comments and Discuss HashiCorp HCVA0-003 exam prep with other Community members: