Online Access Free HCVA0-003 Practice Test

True or False? All dynamic secrets in Vault are required to have a lease.

• A.True
• B.False

You have a new team member on the Vault operations team. Their first task is to rotate the encryption key in Vault as part of the organization's security policy. However, when they log in, they get an access denied error when attempting to rotate the key. The policy being used is below. Why can't the user rotate the encryption key?
path "auth/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "sys/rotate" {
capabilities = ["read", "update"]
}

• A.The policy requires sudo privileges since it is a root-protected path
• B.The policy should include sys/rotate/<name of key> as part of the path
• C.The policy doesn't include create privileges so a new encryption key can't be created
• D.The encryption key has a minimum TTL, therefore the key cannot be rotated until that time expires

You have a CI/CD pipeline using Terraform to provision AWS resources with static privileged credentials.
Your security team requests that you use Vault to limit AWS access when needed. How can you enhance this process and increase pipeline security?

• A.Enable the Transit secrets engine to encrypt the AWS credentials and have Terraform retrieve these credentials when needed
• B.Enable the aws secrets engine and configure Terraform to dynamically generate a short-lived AWS credential on each terraform apply
• C.Store the AWS credentials in the Vault KV store and use the Vault provider to obtain these credentials on each terraform apply
• D.Enable the SSH secrets engine and have Terraform generate dynamic credentials when deploying resources in AWS

True or False? Once the minimum decryption version is set on an encryption key, older versions of the key are removed from Vault and are no longer available for decryption operations.

• A.True
• B.False

True or False? Once you create a KV v1 secrets engine and place data in it, there is no way to modify the mount to include the features of a KV v2 secrets engine.

• A.True
• B.False