[ Vault Enterprise] Understand Sentinel Policies VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of Sentinel policies in Vault Enterprise?

   • ATo automatically rotate secrets based on a schedule defined in the policy
   • BTo provide fine-grained, context-aware access control that can evaluate request attributes beyond the static path and capability checks of ACL policies
   • CTo encrypt secrets at rest using a policy-driven key management approach
   • DTo replace Vault's built-in ACL policies with a more restrictive static rule set
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A Vault Enterprise administrator has written a Sentinel policy that uses the `ldap` service to check the user's group membership. The policy is intended to allow access only to users in the `admin` group. The administrator wants to test the policy locally before deploying it. The administrator has written a test file that defines a mock `ldap` service. What is the correct way to run the test?

   • ARun `vault test` with the policy and test files.
   • BRun `vault policy test` with the policy and test files.
   • CRun `sentinel test` in the directory containing the policy and test files.
   • DRun `sentinel run` with the policy and test files.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Vault Enterprise administrator is writing a Sentinel policy that imports the `sockaddr` library to check the source IP address. The policy includes the following code: ``` import "sockaddr" main = rule { sockaddr.is_contained(request.connection.remote_addr, "10.0.0.0/8") } ``` What is the purpose of the `import` statement in this policy?

   • AIt specifies the Vault paths to which the policy applies.
   • BIt defines the main rule that determines the policy's decision.
   • CIt defines a parameter that can be passed to the policy.
   • DIt imports the `sockaddr` library so that the policy can use its functions.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Vault Enterprise administrator is writing a Sentinel policy to restrict access to the `secret/prod/*` path to only requests that come from the IP address `10.0.0.0/8`. The policy includes the following code snippet: ``` import "sockaddr" main = rule { sockaddr.is_contained(request.connection.remote_addr, "10.0.0.0/8") } ``` What is the role of the `main` rule in this Sentinel policy?

   • AIt defines the parameters that can be passed to the policy when it is evaluated.
   • BIt is the entry point that returns a boolean value determining whether the request is allowed.
   • CIt imports the `sockaddr` library so that the policy can use its functions.
   • DIt specifies the Vault paths to which the policy applies.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In Vault Enterprise, how do Sentinel policies interact with ACL policies during request evaluation?

   • AACL policies are evaluated first, and if they allow, Sentinel policies are ignored
   • BBoth ACL and Sentinel policies must allow the request for it to succeed
   • CSentinel policies are evaluated first, and if they allow, ACL policies are ignored
   • DSentinel policies override ACL policies, so only Sentinel is evaluated
   Reveal Solution Discussion Select an answer first