Online Access Free HCVA0-003 Practice Test

Which of the following secrets engines does NOT issue a lease upon a read request?

• A.Database
• B.Consul
• C.KV
• D.AWS

You have multiple Kubernetes pods that need frequent access to Vault to retrieve credentials for establishing connectivity to a backend database. You enable the Kubernetes auth method in Vault. What resource do you need to create within Kubernetes to complete this configuration?

• A.An AppRole role_id and secret_id
• B.Username and password for kubectl
• C.A Vault token for authentication
• D.k8s service account token

Which of the following policies would permit a user to generate dynamic credentials on a database?

• A.path " database/creds/read_only_role " { capabilities = [ " list " ] }
• B.path " database/creds/read_only_role " { capabilities = [ " read " ] }
• C.path " database/creds/read_only_role " { capabilities = [ " generate " ] }
• D.path " database/creds/read_only_role " { capabilities = [ " update " ] }

A system starts up 1000+ containers, all requiring connection to Vault upon its initial setup.
Which strategy will reduce I/O traffic to the storage backend?

• A.Use single-use tokens.
• B.Use batch tokens.
• C.Use Kubernetes auth method.
• D.Use service tokens with short TTL.
• E.Use AppRole auth method.

Your co-worker has asked you to perform certain operations in Vault and has provided you with a token accessor (not the token itself). What Vault operations would you be allowed to perform using only the provided accessor? (Select three)

• A.Create child tokens associated with the same policies as the related token
• B.Lookup properties of the token, such as the TTL, policies, and metadata
• C.Renew the token to extend the TTL
• D.Revoke the token in Vault to make it invalid