[ Vault Enterprise] Define Control Groups and Describe Their Basic Workflow VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Vault Enterprise administrator is troubleshooting a control group request that is stuck in a pending state. The required number of approvals has been received, but the original request has not completed. What is the most likely cause?

   • AThe control group requires approvals from multiple factors, and only one factor's approvals were received.
   • BThe control group token has expired before all approvals were received.
   • CThe original requester's token has been revoked, so the request cannot be completed.
   • DThe approvers used the wrong accessor when authorizing, so the approvals were not recorded against the correct request.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Where is a control group defined in Vault Enterprise?

   • AIn the auth method's configuration using the 'control_group' field
   • BIn a policy file using the 'control_group' parameter
   • CIn the Vault configuration file under the 'control_group' stanza
   • DIn the secret engine's configuration using the 'control_group' parameter
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A Vault Enterprise administrator is designing a control group for a highly sensitive production secret. The policy requires two approvals from the 'security-team' group. The team has 10 members, but the administrator is concerned about availability: if one approver is unavailable, the request could be delayed. What is the best way to address this concern while still enforcing the two-approval requirement?

   • ASet a longer TTL on the control group token to give approvers more time to respond.
   • BIncrease the number of members in the security-team group to reduce the chance that two are unavailable simultaneously.
   • CReduce the required approvals to one to speed up the process.
   • DCreate a second control group on the same path with a different group that also requires two approvals.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user attempts to read a secret protected by a control group that requires two approvals. The user receives a control group token. Later, one approver authorizes the request, but the second approver has not yet acted. What is the current status of the original request?

   • AThe request is automatically completed because one approval is sufficient for any control group.
   • BThe request is completed but the secret is returned only to the approver, not the original user.
   • CThe request is still pending and will only complete after the second approver authorizes it.
   • DThe request is denied and the user must start over with a new request.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Vault Enterprise administrator needs to ensure that a production database credential cannot be read by a single operator. The security team requires that at least two different senior engineers must approve any read of that secret. The administrator has already created a policy that grants read access to the secret path. What must the administrator do to enforce the two-person approval requirement?

   • AEnable a second factor on the senior engineers' tokens so that each read requires an additional OTP.
   • BCreate a new policy that denies read access unless the request originates from a senior engineer's token.
   • CAdd a control group block to the existing policy that requires two approvals from the senior-engineers group.
   • DConfigure a Vault namespace that requires two senior engineers to be present in the same group before read access is granted.
   Reveal Solution Discussion Select an answer first