A Vault admin has a temporary Transit engine at `transit-temp/` that was used for a short-term project. The project is complete, and the admin wants to remove the engine and all its keys. What command should they run?

`vault secrets tune -default-lease-ttl=0 transit-temp/`

`vault secrets move transit-temp/ archive/`

`vault delete transit-temp/keys/*`

`vault secrets disable transit-temp/`

A Vault admin wants to check if a specific secret engine, such as the AWS engine, is enabled at the path `aws/`. They also want to see the default lease TTL for that mount. Which command should they run?

`vault secrets enable -path=aws aws`

`vault secrets list` and look for the `aws/` entry

A company is enabling the database secret engine for a PostgreSQL instance. They want the generated database credentials to expire after 15 minutes, but the maximum allowed lease must be 1 hour. The admin runs `vault secrets enable database`. What should they do next to meet the requirement?

Run `vault write database/config/postgres lease_ttl=15m max_lease_ttl=1h`

Run `vault secrets tune -default-lease-ttl=15m -max-lease-ttl=1h database`

Run `vault secrets enable -path=database -default-lease-ttl=15m -max-lease-ttl=1h database`

Run `vault write database/roles/myrole default_ttl=15m max_ttl=1h`

A company is enabling the RabbitMQ secret engine to generate dynamic credentials. They want the default lease TTL to be 10 minutes and the max to be 1 hour. The admin runs `vault secrets enable rabbitmq`. What should they do next to set the TTLs?

Run `vault secrets tune -default-lease-ttl=10m -max-lease-ttl=1h rabbitmq`

Run `vault secrets enable -path=rabbitmq -default-lease-ttl=10m -max-lease-ttl=1h rabbitmq`

Lease TTLs are not applicable to the RabbitMQ engine.

Run `vault write rabbitmq/config/connection lease_ttl=10m max_lease_ttl=1h`

An organization has an existing KV v2 mount at `secret/` that is used by multiple applications. The security team wants to reduce the default lease TTL from 30 minutes to 10 minutes for this mount, but they do not want to affect other mounts. What should the admin do?

Disable and re-enable the `secret/` mount with the new TTL

Run `vault write secret/config default_lease_ttl=10m`

Run `vault secrets tune -default-lease-ttl=10m` (without a path)

Run `vault secrets tune -default-lease-ttl=10m secret/`

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 1

Enable and Configure Secret Engines VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 21–25

21application · easy
A Vault admin has a temporary Transit engine at `transit-temp/` that was used for a short-term project. The project is complete, and the admin wants to remove the engine and all its keys. What command should they run?
Select an answer first
22application · easy
A Vault admin wants to check if a specific secret engine, such as the AWS engine, is enabled at the path `aws/`. They also want to see the default lease TTL for that mount. Which command should they run?
Select an answer first
23application · medium
A company is enabling the database secret engine for a PostgreSQL instance. They want the generated database credentials to expire after 15 minutes, but the maximum allowed lease must be 1 hour. The admin runs `vault secrets enable database`. What should they do next to meet the requirement?
Select an answer first
24application · medium
A company is enabling the RabbitMQ secret engine to generate dynamic credentials. They want the default lease TTL to be 10 minutes and the max to be 1 hour. The admin runs `vault secrets enable rabbitmq`. What should they do next to set the TTLs?
Select an answer first
25application · medium
An organization has an existing KV v2 mount at `secret/` that is used by multiple applications. The security team wants to reduce the default lease TTL from 30 minutes to 10 minutes for this mount, but they do not want to affect other mounts. What should the admin do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.