A Vault administrator has been asked to remove a legacy KV v1 mount at `legacy/` because the application that used it has been decommissioned. The admin wants to ensure the mount is completely removed, including all its data. What command should they run?

`vault secrets disable legacy/`

`vault secrets tune -delete-all-versions=true legacy/`

A company wants to use Vault to generate dynamic AWS IAM credentials. They have already configured AWS credentials in Vault. The admin runs `vault secrets enable -path=aws aws`. What is the next step to start generating credentials?

Immediately run `vault read aws/creds/my-role` to generate credentials.

Configure the AWS secret engine connection and then create a role.

Run `vault secrets tune -default-lease-ttl=1h aws` to set the lease TTL.

Run `vault write aws/config/root` with the AWS secret key.

A Vault admin has been asked to remove a database secret engine that was enabled at `db/` for a temporary project. The project is over, and the admin wants to ensure that all generated credentials and the engine configuration are completely removed. What should the admin do?

Run `vault secrets move db/ archive/`

Run `vault secrets tune -default-lease-ttl=0 db/`

Run `vault secrets disable db/`

Run `vault delete db/roles/*` to delete all roles.

An organization is enabling the Transit secret engine for encryption-as-a-service. They want to set a default lease TTL of 5 minutes and a max lease TTL of 30 minutes for the engine. The admin runs `vault secrets enable -path=transit transit`. What should they do next to set the lease TTLs?

Run `vault secrets enable -path=transit -default-lease-ttl=5m -max-lease-ttl=30m transit`

Lease TTLs are not applicable to the Transit engine.

Run `vault write transit/config lease_ttl=5m max_lease_ttl=30m`

Run `vault secrets tune -default-lease-ttl=5m -max-lease-ttl=30m transit`

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 1

Enable and Configure Secret Engines VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 26–30

26application · easy
A Vault administrator has been asked to remove a legacy KV v1 mount at `legacy/` because the application that used it has been decommissioned. The admin wants to ensure the mount is completely removed, including all its data. What command should they run?
Select an answer first
27application · easy
A Vault admin needs to verify which secret engines are currently enabled and at which paths. They suspect that a colleague may have enabled an extra database engine at a non-standard path. What command should they run to see all enabled engines and their mount paths?
Select an answer first
28application · medium
A company wants to use Vault to generate dynamic AWS IAM credentials. They have already configured AWS credentials in Vault. The admin runs `vault secrets enable -path=aws aws`. What is the next step to start generating credentials?
Select an answer first
29application · easy
A Vault admin has been asked to remove a database secret engine that was enabled at `db/` for a temporary project. The project is over, and the admin wants to ensure that all generated credentials and the engine configuration are completely removed. What should the admin do?
Select an answer first
30application · medium
An organization is enabling the Transit secret engine for encryption-as-a-service. They want to set a default lease TTL of 5 minutes and a max lease TTL of 30 minutes for the engine. The admin runs `vault secrets enable -path=transit transit`. What should they do next to set the lease TTLs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.