Securely Configure Auto-Auth and Token Sink VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · medium

   In a Vault Agent configuration file, which block is used to define the authentication method and its parameters for auto-auth?

   • Avault { address = "..." }
   • Blistener { ... }
   • Ctemplate { ... }
   • Dauto_auth { method { ... } }
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Vault Agent is configured with auto-auth using the AppRole method and a file sink. The agent logs show 'token is not renewable' errors. What is the most likely cause?

   • AThe agent is using the wrong AppRole role ID.
   • BThe AppRole token has a TTL that is too short.
   • CThe AppRole role has 'period' set to 0.
   • DThe token sink is not configured correctly.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A team uses Vault Agent to authenticate to Vault using the Kubernetes method. They want to use a specific service account token for authentication. Which configuration should they use?

   • ASet the 'service_account_token_path' parameter to the path of the service account token file.
   • BSet the 'token' parameter to the service account token.
   • CSet the 'role' parameter to the service account name.
   • DSet the 'kubernetes_ca_cert' parameter to the path of the CA certificate.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A security team requires that Vault Agent tokens be rotated frequently and that the token file be readable only by the application. They also want to minimize the time the token is valid if the agent is compromised. Which configuration best meets these requirements?

   • AUse a one-time token and have the application re-authenticate each time.
   • BSet a long token TTL to reduce renewal frequency, with a file sink using 0644 permissions.
   • CUse a periodic token with a long period and a file sink using 0600 permissions.
   • DSet a short token TTL and rely on the agent to renew it, with a file sink using 0600 permissions.
   Reveal Solution Discussion Select an answer first
6. 10foundation · medium

   Why should Vault tokens not be written to application logs?

   • ALogs are encrypted, making the token unusable
   • BTokens are too long to be logged efficiently
   • CLogs are often accessible to a wider audience and can be retained for long periods
   • DTokens become invalid if they are written to logs
   Reveal Solution Discussion Select an answer first