[ Vault Enterprise] Define Control Groups and Describe Their Basic Workflow VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which parameter in a Vault policy is used to specify the required number of approvals for a control group?

   • Acontrol_group
   • Brequired_approvals
   • Capproval_count
   • Dquorum
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What happens when a user attempts to read a secret that is protected by a control group?

   • AThe user is prompted to enter a second authentication factor
   • BThe request is placed in a pending state and a control group token is returned
   • CThe request is immediately denied and logged
   • DThe secret is returned but with a warning that it is sensitive
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Vault Enterprise administrator is configuring a control group for a secret path. The requirement is that any read must be approved by at least one member of the 'security-team' group and one member of the 'network-team' group. The administrator has defined a control group with two factors, each with approvals = 1. What happens if a user who is a member of both groups attempts to read the secret?

   • AThe user cannot approve either factor because they are the requester, not an approver.
   • BThe request is denied because the same user cannot satisfy both factors.
   • CThe request is completed immediately because the user is a member of both groups and the control group is satisfied.
   • DThe user can approve both factors themselves, so the request is completed without any other approver.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Vault operator attempts to read a secret that is protected by a control group requiring three approvals. The operator receives a response containing a control group token and a list of approvers. What is the correct next step in the workflow?

   • AThe operator must immediately retry the read with the control group token as the Vault token.
   • BThe operator must wait for the required number of approvers to authorize the request using the control group token, then the original request can be completed.
   • CThe operator must delete the control group token and create a new one with a higher TTL to bypass the approval requirement.
   • DThe operator must escalate the request to a Vault root token to override the control group.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An approver receives a control group token and wants to authorize a pending request. Which Vault CLI command should the approver use?

   • Avault write auth/token/approve accessor=<token>
   • Bvault write sys/control-group/authorize accessor=<token>
   • Cvault read sys/control-group/authorize accessor=<token>
   • Dvault token create -policy=control-group -accessor=<token>
   Reveal Solution Discussion Select an answer first