Free HashiCorp Vault-Associate-002 Exam 2026 Practice Materials Collection
Vault-Associate-002 Exam Info and Free Practice Test All-in-One Exam Guide May-2026
NEW QUESTION # 32
An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is AWS.
- A. False
- B. True
Answer: A
NEW QUESTION # 33
Running the second command in the GUI CU will succeed.
- A. False
- B. True
Answer: A
NEW QUESTION # 34
Which statements correctly describe the command below. Choose TWO correct answers.
vault write transit/decrypt/password \
ciphertext=vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13ok481zoCmHnSeD X9vyf7w==
- A. Returns the ciphertext
- B. Requires sudo capability on the transit/decrypt/password path
- C. Returns an error due to missing encryption key name
- D. Decrypts the ciphertext if the token permits
- E. Returns base64-encoded plaintext
Answer: D,E
NEW QUESTION # 35
Which of the following cannot define the maximum time-to-live (TTL) for a token?
- A. By the authentication method
- B. System max TTL
- C. By the mount endpoint configuration
- D. By the client system
- E. A parent token TTL
Answer: D
NEW QUESTION # 36
Which statement describes the results of this command: $ vault secrets enable transit?
- A. Fails due to missing -path parameter
- B. Requires a root token to execute the command successfully
- C. Enables the transit secrets engine at transit path
- D. Enables the transit secrets engine at secret path
- E. Fails because the transit secrets engine is enabled by default
Answer: C
NEW QUESTION # 37
Which statement is true about an orphan token?
- A. It does not expire when its parent does
- B. It has a use limit
- C. It does not have a max time-to-live (TTL)
- D. It is not persisted
Answer: A
NEW QUESTION # 38
Which command will generate a new transit key?
- A. vault put transit/keys/my-key
- B. vault write -f transit/keys/my-key
- C. vault create -f transit/keys/my-key
- D. vault create transit/keys/my-key
Answer: B
NEW QUESTION # 39
Which of the following describes usage of an identity group?
- A. Limit the policies that would otherwise apply to an entity in the group
- B. When they want to revoke the credentials for a whole set of entities simultaneously
- C. Consistently apply the same set of policies to a collection of entities
- D. Audit token usage
Answer: C
NEW QUESTION # 40
Which of the following is the correct option to authenticate to Vault using a token using the CLI?
- A. vault <token>
- B. A token can be used to authenticate to Vault through the API, not the CLI or the UI vault login
- C. A token cannot be used to authenticate to Vault
Answer: A
NEW QUESTION # 41
What methods of authentication does Vault support? (Choose four.)
- A. MMSQL
- B. AppRole
- C. PostgreSQL
- D. JWT/OIDC
- E. LDAP
- F. Nomad
- G. GitHub
Answer: B,D,E,G
NEW QUESTION # 42
Which of the following statements are true about the defaultpolicy? (Choose two.)
- A. Gives a super admin permissions, similar to a root user on a Linux machine
- B. Provides a common set of permissions and is included on all tokens by default
- C. Vault upgrade will overwrite any update you made to the defaultpolicy
- D. It is one of the built-in policies
- E. Can not be modified or deleted
Answer: B,D
NEW QUESTION # 43
You manage two Vault dusters: "vaultduster1.acme.corp" and "vaultduster2.acme.corp". You want to write a secret to the first Vaultcluster vaultcluster1.acme.corp and run vault kv put secret/foo value='bar'. The command times out and the error references the Vault cluster, "vaultcluster2.acme.corp".
You run the command again with the following address flag:
vault kv put -address='https://vaultcluster1.acme.corp' secret/foo
value='bar'
The command completes successfully. You find that the terminal session defines the environment variable VAULT_ADDR='https://vaultcluster2.acxe.corp:8200' Why was the second attempt successful?
- A. Vault listener is misconfigured
- B. VAULT_CLUSTER_ADDRneeds to be provided
- C. Environment variables take precedence over flags
- D. Flags take precedence over environment variables
Answer: D
NEW QUESTION # 44
Which of the following storage backends supports high availability?
- A. Azure Storage Container
- B. Manta
- C. Consul
- D. Amazon S3
Answer: C
NEW QUESTION # 45
When looking at Vault token details, which key helps you find the paths the token is able to access?
- A. Path
- B. Policies
- C. Accessor
- D. Meta
Answer: B
NEW QUESTION # 46
Which kind of token can be renewed indefinitely?
- A. Use-limit token
- B. Orphan token
- C. Root token
- D. All of the above
- E. Periodic token
Answer: E
NEW QUESTION # 47
You are performing a high number of authentications in a short amount of time. You're experiencing slow throughput for token generation. How would you solve this problem?
- A. Reduce the number of policies attached to the tokens
- B. Implement batch tokens
- C. Increase the time-to-live on service tokens
- D. Establish a rate limit quota
Answer: B
NEW QUESTION # 48
Use this screenshot to answer the question below:
When are you shown these options in the GUI?
- A. Enabling policies
- B. Enabling authentication methods
- C. Enabling authentication engines
- D. Enabling secret engines
Answer: D
NEW QUESTION # 49
Which of the following describes the Vault's auth method component?
- A. It verifies a client against an internal or external system, and generates a token with the appropriate policies attached
- B. It is responsible for durable storage of client tokens
- C. It dynamically generates a unique set of secrets with appropriate permissions attached
- D. It verifies a client against an internal or external system, and generates a token with rootpolicy
Answer: A
NEW QUESTION # 50
The vault lease renew command increments the lease time from:
- A. The end of the lease
- B. The current time
Answer: B
NEW QUESTION # 51
Which is not true of Vault tokens?
- A. Vault tokens map to information including polices the token holder has, TTL and max usage, metadata, creation and last renewal time, and more
- B. Vault tokens are generated by every authentication method login
- C. Vault tokens are the core method for authentication in Vault
- D. Vault tokens are required for every Vault call
Answer: D
NEW QUESTION # 52
Use this screenshot to answer the question below:
Which statement describes this AppRole auth method configuration?
- A. Generates batch tokens with TTL set to 5 minutes
- B. Generates multiple tokens with TTL set to 5 minutes
- C. It is enabled at "auth_approle_f23dd79f" path
- D. It is enabled at "App1" path
Answer: A
NEW QUESTION # 53
You have been tasked with writing a policy that will allow read permissions for all secrets at path secret/bar. The users that are assigned this policy should also be able to list the secrets. What should this policy look like?
- A.
- B.
- C.
- D.
Answer: C
NEW QUESTION # 54
What environment variable overrides the CLI's default Vault server address?
- A. VAULT_HTTP_ADDRESS
- B. VAULT_ADDRESS
- C. VAULT_ADDR
- D. VAULT_HTTPS_ADDRESS
Answer: C
NEW QUESTION # 55
A user successfully logs into Vault with the following cURL command:
curl --request POST --data @payload.json
http://127.0.0.1:8200/v1/auth/ldap/login/mitchellh
The response will include what information?
- A. client_token and secrets available
- B. access_key and secrets available
- C. access_key and policies
- D. client_token and policies
Answer: D
NEW QUESTION # 56
When using Integrated Storage, which of the following should you do to recover from possible data loss?
- A. Failover to a standby node
- B. Use audit logs
- C. Use snapshot
- D. Use server logs
Answer: C
NEW QUESTION # 57
......
Pass HashiCorp Vault-Associate-002 Actual Free Exam Q&As Updated Dump: https://actualtests.prep4away.com/HashiCorp-certification/braindumps.Vault-Associate-002.ete.file.html