A Vault admin is cleaning up after a migration. They have an old KV v2 mount at `old-secrets/` that is no longer needed. They want to ensure that no data remains and that the mount is completely removed. What command should they run?

`vault secrets tune -delete-all-versions=true old-secrets/`

`vault secrets disable old-secrets/`

`vault secrets move old-secrets/ trash/`

A company is enabling the PKI secret engine to issue certificates. They want the default certificate TTL to be 24 hours and the maximum to be 7 days. The admin runs `vault secrets enable pki`. What should they do next to set these TTLs?

Run `vault write pki/root/generate/internal default_ttl=24h max_ttl=168h`

Run `vault write pki/config/urls default_ttl=24h max_ttl=168h`

Lease TTLs are not applicable to the PKI engine.

Run `vault secrets tune -default-lease-ttl=24h -max-lease-ttl=168h pki`

An admin has a KV v2 mount at `secret/` that is used by multiple teams. One team wants to have a longer default lease TTL for their secrets, but the admin does not want to change the mount-wide setting. What should the admin do?

Tune the existing `secret/` mount to the longer TTL.

Set the TTL on each individual secret using `vault kv put -ttl=...`

Create a new KV v2 mount at a different path with the desired TTL for that team.

Use a different secret engine, such as database, for that team.

A startup wants to use Vault to store database credentials for their applications. They have decided to use the database secret engine. The admin runs `vault secrets enable database`. What is the next step to configure the engine?

Immediately run `vault read database/creds/my-role` to get credentials.

Run `vault secrets tune -default-lease-ttl=1h database` to set the lease TTL.

Configure a database connection and then create roles.

Run `vault write database/config/db1 plugin_name=postgresql-database-plugin`

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 1

Enable and Configure Secret Engines VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 16–20

16application · easy
A Vault admin is cleaning up after a migration. They have an old KV v2 mount at `old-secrets/` that is no longer needed. They want to ensure that no data remains and that the mount is completely removed. What command should they run?
Select an answer first
17application · easy
A Vault admin needs to provide a report of all enabled secret engines and their mount paths to the security team. The report should include the engine type and the mount path. Which command should the admin use to generate this report?
Select an answer first
18application · medium
A company is enabling the PKI secret engine to issue certificates. They want the default certificate TTL to be 24 hours and the maximum to be 7 days. The admin runs `vault secrets enable pki`. What should they do next to set these TTLs?
Select an answer first
19application · medium
An admin has a KV v2 mount at `secret/` that is used by multiple teams. One team wants to have a longer default lease TTL for their secrets, but the admin does not want to change the mount-wide setting. What should the admin do?
Select an answer first
20application · medium
A startup wants to use Vault to store database credentials for their applications. They have decided to use the database secret engine. The admin runs `vault secrets enable database`. What is the next step to configure the engine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.