Describe Secure Introduction of Vault Clients VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company runs a mix of AWS and on-premises workloads. They want to use a single Vault cluster and have clients authenticate using their existing corporate identity provider (Okta) for human users, while applications in AWS use IAM roles. Which set of auth methods should be enabled?

   • AEnable only AWS IAM auth method and use LDAP for human users.
   • BEnable Okta and AWS IAM auth methods.
   • CEnable Kubernetes and GitHub auth methods.
   • DEnable only Okta auth method and use tokens for AWS applications.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is it important to regularly rotate Vault tokens and certificates?

   • ATo improve Vault's performance
   • BTo reduce the storage space used by Vault
   • CTo reduce the risk of compromised credentials being used
   • DTo comply with licensing agreements
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is mutual TLS (mTLS) in the context of Vault client-server communication?

   • AThe server uses a certificate to authenticate to the client, but the client does not need a certificate
   • BBoth the client and the server present certificates to authenticate each other
   • CThe client uses a username and password to authenticate to the server
   • DThe client and server share a symmetric key for encryption
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of securely introducing Vault clients to the Vault server?

   • ATo encrypt all data stored in Vault's storage backend
   • BTo ensure that only authorized clients can communicate with Vault and access secrets
   • CTo provide a graphical interface for managing Vault policies
   • DTo automatically replicate Vault data across multiple regions
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Vault operator has just initialized a new Vault cluster in a production environment. The operator needs to securely distribute the initial root token to the two Vault administrators who will manage the cluster. Which approach best follows Vault best practices for handling the initial root token?

   • AStore the root token in the team's shared password manager and share the URL with the administrators.
   • BSplit the root token into shares and distribute each share via a secure out-of-band channel, then revoke the root token after initial setup.
   • CUse Vault's built-in root token generation feature to create a new token for each administrator.
   • DEmail the root token to each administrator using the corporate email system with encryption enabled.
   Reveal Solution Discussion Select an answer first