How can Vault be used to programmatically obtain a generated code for MFA, somewhat similar to Google Authenticator?
Answer(s): C
The TOTP secrets engine generates time-based credentials according to the TOTP standard. The secrets engine can also be used to generate a new key and validate passwords generated by that key. The TOTP secrets engine can act as both a generator (like Google Authenticator) and a provider (like the Google.com sign-in service).As a GeneratorThe TOTP secrets engine can act as a TOTP code generator. In this mode, it can replace traditional TOTP generators like Google Authenticator. It provides an added layer of security since the ability to generate codes is guarded by policies and the entire process is audited.
https://www.vaultproject.io/docs/secrets/totp
From the unseal options listed below, select the options you can use if you're deploying Vault on- premises. (select four)
Answer(s): A,B,D,E
Certificates are not a valid unseal option for HashiCorp Vault.
In regards to the transit secrets engine, which of the following is true given the following command and output: (select three)1. $ vault write encryption/encrypt/creditcard plaintext=$(base64 <<< "1234 5678 9101 1121")2. Key Value3. --- -----4. ciphertext vault:v3:cZNHVx+sxdMErXRSuDa1q/pz49fXTn1PScKfhf+PIZPvy8xKfkytpwKcbC0fF2U=
Answer(s): A,B,D
The encryption key used to encrypt the plaintext is regarded as a data key. This data key needs to be protected so that your encrypted data cannot be decrypted comfortably by an unauthorized party. In this case, data has been encrypted by specifying the keyring name creditcard.
After encrypting data using the transit secrets engine, you've received the following output. Which of the following is true based upon the output?1. Key Value2. --- -----3. ciphertext vault:v2:45f9zW6cglbrzCjI0yCyC6DBYtSBSxnMgUn9B5aHcGEit71xefPEmmjMbrk3
Answer(s): A
When data is encrypted using Vault, the resulting ciphertext is prepended by the version of the key used to encrypt it. In this case, the version is v2, which means that the encryption key was rotated at least one time. Any data that was encrypted with the original key would have been prepended with vault:v1To rotate a key, use the command vault write -f transit/keys/<key name>/rotate
https://learn.hashicorp.com/vault/encryption-as-a-service/eaas-transit
Post your Comments and Discuss HashiCorp VA-002-P exam with other Community members:
Bruno commented on October 10, 2023 PDF is Vault, EXM is Teraform. UNITED STATES upvote
Our website is free, but we have to fight against bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the VA-002-P content, but please register or login to continue.