Describe Secure Introduction of Vault Clients VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Vault administrator needs to introduce a new application server to Vault. The server is already enrolled in the corporate Active Directory and has a valid machine certificate issued by the internal CA. The administrator wants to use a method that leverages the existing certificate for authentication. Which Vault authentication method should be configured?

   • ATLS certificate authentication
   • BAppRole authentication
   • CCloud metadata authentication
   • DLDAP authentication
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a best practice for securely distributing and using the initial root token?

   • AUse it only for initial setup and then revoke or rotate it
   • BKeep it in the Vault configuration file for automatic use
   • CShare it with all application developers so they can access secrets
   • DStore it in a shared team document for easy access
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A Vault cluster was initialized with 5 unseal key shares and a threshold of 3. The organization uses auto-unseal with a cloud KMS. The security team wants to ensure that the recovery keys are protected and that the root token is not used for routine operations. Which combination of practices best meets these requirements?

   • AKeep recovery keys in a single safe and use the root token for all administrative tasks.
   • BStore recovery keys in the cloud KMS and use the root token for all administrative tasks.
   • CDistribute recovery key shares to multiple trusted individuals and use the root token only for initial setup.
   • DUse the unseal keys as recovery keys and share them with all administrators.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Vault administrator is configuring a new Vault cluster and wants to ensure that all client communication is protected from eavesdropping and tampering. Which configuration is essential to meet this requirement?

   • AUse a firewall to restrict access to the Vault API port to trusted IP addresses.
   • BRequire clients to use the same Vault token for all requests.
   • CEnable TLS on the Vault server's listener and configure clients to use HTTPS.
   • DSet the Vault server to bind to localhost only.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How is the initial root token generated in Vault?

   • AIt is provided by the Vault license key
   • BIt is derived from the Vault server's hostname
   • CIt is created by the first client that authenticates to Vault
   • DIt is generated automatically during the first unseal and displayed on the operator's terminal
   Reveal Solution Discussion Select an answer first