[ Vault Enterprise] Understand Sentinel Policies VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Vault Enterprise administrator is developing a Sentinel policy that uses the `ldap` service to check the user's group membership. The administrator wants to test the policy with a mock LDAP user. Which approach should the administrator use to test the policy?

   • AWrite a test file that defines a mock `ldap` service and run `sentinel test`.
   • BUse the `vault write sys/policies/egp` command with a `-test` flag.
   • CAttach the policy to a test path and use a real LDAP user to test it.
   • DUse the `vault policy test` command with a mock LDAP user.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Vault Enterprise administrator has written a Sentinel policy to enforce that only requests from the `engineering` team can write to `secret/eng/*`. The policy uses the `ldap` service to check the user's team. Before deploying the policy to production, the administrator wants to test it locally. Which tool should the administrator use?

   • AThe `vault read sys/policies/egp` command to review the policy.
   • BThe `vault write sys/policies/egp` command with a dry-run flag.
   • CThe `sentinel test` command with a test file.
   • DThe `vault policy test` command with a mock request.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Vault Enterprise administrator is writing a Sentinel policy that uses a parameter to specify the allowed IP range. The policy includes the following code: ``` import "sockaddr" parameter "allowed_cidr" { default = "10.0.0.0/8" } main = rule { sockaddr.is_contained(request.connection.remote_addr, parameters.allowed_cidr) } ``` What is the purpose of the `parameter` block in this policy?

   • AIt defines the main rule that determines the policy's decision.
   • BIt imports the `sockaddr` library for use in the policy.
   • CIt specifies the Vault paths to which the policy applies.
   • DIt defines a configurable value that can be overridden when the policy is evaluated.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which Vault edition includes support for Sentinel policies?

   • AVault Open Source
   • BVault Standard
   • CVault Community Edition
   • DVault Enterprise
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which Vault CLI command is used to attach a Sentinel policy to a specific path?

   • Avault policy attach
   • Bvault sentinel attach
   • Cvault policy apply
   • Dvault write sys/policies/sentinel/path
   Reveal Solution Discussion Select an answer first