A company runs a long-lived service on a VM that authenticates to Vault using AppRole. They use Vault Agent with auto-auth and a file sink. The service must have a valid token at all times, but the VM may be restarted unexpectedly. Which configuration ensures the token remains valid across restarts?

Set 'exit_after_auth' to false and rely on the agent's renewal process.

Configure the agent to run as a systemd service with 'Restart=always' and auto-auth enabled.

Use a periodic token with a short TTL and rely on the agent to renew it.

Set the token TTL to a very long value, such as 30 days.

A company runs Vault Agent on a fleet of VMs to authenticate to Vault using the AWS method. They need to minimize the risk of token exposure while ensuring high availability. They also want to avoid storing any long-lived credentials on the VMs. Which approach best meets these requirements?

Use the AppRole method with a secret ID delivered via a secure channel.

Use a Vault token with a long TTL and store it in a file sink.

Use static AWS access keys in the auto-auth configuration.

Use the instance profile's temporary credentials via the metadata service.

A security policy requires that Vault Agent tokens are not stored in environment variables. Which Vault Agent feature should be used instead?

File sink with restrictive permissions.

The 'token' field in the auto-auth configuration.

The 'vault agent' command with the '-output-token' flag.

How does Vault Agent handle graceful shutdown to ensure token availability is not disrupted?

It revokes the token and cleans up before exiting

It stops accepting new requests but continues to serve existing ones until they complete

It immediately terminates all processes, leaving the token sink empty

It waits for the token to expire before shutting down

HashiCorp Certified:Vault Operations Professional

Domain 8Objective 1

Securely Configure Auto-Auth and Token Sink VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Configure Vault Agent domain, which makes up ~5% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

4concepts

Questions 16–19

16application · medium
A company runs a long-lived service on a VM that authenticates to Vault using AppRole. They use Vault Agent with auto-auth and a file sink. The service must have a valid token at all times, but the VM may be restarted unexpectedly. Which configuration ensures the token remains valid across restarts?
Select an answer first
17expert · medium
A company runs Vault Agent on a fleet of VMs to authenticate to Vault using the AWS method. They need to minimize the risk of token exposure while ensuring high availability. They also want to avoid storing any long-lived credentials on the VMs. Which approach best meets these requirements?
Select an answer first
18application · medium
A security policy requires that Vault Agent tokens are not stored in environment variables. Which Vault Agent feature should be used instead?
Select an answer first
19foundation · medium
How does Vault Agent handle graceful shutdown to ensure token availability is not disrupted?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

Securely Configure Auto-Auth and Token Sink VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–19

A company runs Vault Agent on a fleet of VMs to authenticate to Vault using the AWS method. They need to minimize the risk of token exposure while ensuring high availability. They also want to avoid storing any long-lived credentials on the VMs. Which approach best meets these requirements?

A security policy requires that Vault Agent tokens are not stored in environment variables. Which Vault Agent feature should be used instead?

How does Vault Agent handle graceful shutdown to ensure token availability is not disrupted?

Keep studying — Configure Vault Agent