A DevOps team runs a batch processing application on a Linux VM that needs to authenticate to Vault using an AWS IAM role. They configure Vault Agent with an auto-auth block using the AWS method. The application reads the token from a file sink. Which additional configuration is essential to ensure the token file is only readable by the application's service account?

Place the token sink file in a directory with 0700 permissions.

Use the 'exit_after_auth' option to stop the agent after writing the token.

Set the 'token' field in the sink configuration to a pre-shared secret.

Set the file sink's 'file_mode' to 0600 and ensure the agent runs as the service account.

A team wants to use Vault Agent to authenticate to Vault using an AWS IAM role. They have configured the AWS auth method in Vault. What must they provide in the auto-auth configuration?

The Vault role name and the AWS region.

The AWS access key and secret key.

The IAM role name and the Vault role name.

The AWS IAM role ARN and the Vault mount path.

What does Vault Agent do when the auto-auth token is nearing expiration?

It stops all operations and requires manual intervention

It automatically renews the token using the configured auth method

It sends an alert to the operator to renew the token manually

It writes a new token to the sink only after the old one expires

What is the purpose of a token sink in Vault Agent auto-auth?

To write the authenticated token to a file or other destination for client applications

To encrypt the token before it is used by Vault Agent

To revoke the token when it is no longer needed

To store the Vault token in memory for the agent's own use

A Vault Agent is configured with auto-auth using the Kubernetes method. The agent is running in a pod that is terminated and restarted. What happens to the token sink file?

The file is locked and cannot be accessed until the pod is deleted.

The file persists because it is written to a persistent volume.

The file is overwritten with a new token when the agent restarts.

The file is deleted because the pod's filesystem is ephemeral.

HashiCorp Certified:Vault Operations Professional

Domain 8Objective 1

Securely Configure Auto-Auth and Token Sink VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Part of the Configure Vault Agent domain, which makes up ~5% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

4concepts

Questions 1–5

1application · medium
A DevOps team runs a batch processing application on a Linux VM that needs to authenticate to Vault using an AWS IAM role. They configure Vault Agent with an auto-auth block using the AWS method. The application reads the token from a file sink. Which additional configuration is essential to ensure the token file is only readable by the application's service account?
Select an answer first
2application · medium
A team wants to use Vault Agent to authenticate to Vault using an AWS IAM role. They have configured the AWS auth method in Vault. What must they provide in the auto-auth configuration?
Select an answer first
3foundation · medium
What does Vault Agent do when the auto-auth token is nearing expiration?
Select an answer first
4foundation · medium
What is the purpose of a token sink in Vault Agent auto-auth?
Select an answer first
5application · medium
A Vault Agent is configured with auto-auth using the Kubernetes method. The agent is running in a pod that is terminated and restarted. What happens to the token sink file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.