Validate your Vault-Associate-002 Exam Preparation with Vault-Associate-002 Practice Test (Online & Offline) [Q62-Q79]

admin Vault-Associate-002 HashiCorp December 3, 2025

Rate this post

Validate your Vault-Associate-002 Exam Preparation with Vault-Associate-002 Practice Test (Online & Offline)

Get all the Information About HashiCorp Vault-Associate-002 Exam 2025 Practice Test Questions

NO.62 When using Integrated Storage, which of the following should you do to recover from possible data loss?

Use local storage

Enable audit device

Use snapshot

Use external storage

NO.63 Which of these are names of the replication methods available in Vault Enterprise? (Choose two.)

Disaster Recovery

Cluster sharping

Namespaces

Seal-Wrap

Performance

NO.64 The following three policies exist in Vault. What do these policies allow an organization to do?
app.hcl

callcenter.hcl

rewrap.hcl

Separates permissions allowed on actions associated with the transit secret engine

Nothing, as the minimum permissions to perform useful tasks are not present

Encrypt decrypt, and rewrap data using the transit engine all in one policy

Create a transit encryption key for encrypting, decrypting, and rewrapping encrypted data

NO.65 Why might an application be mapped to an identity entity?

To prohibit Vault administrators from revoking tokens associated with that application

To get around cloud license limitations

To allow an application deployed with multiple authentication methods have a consistent set of policies

To allow the same application in one cloud to access already provisioned Vault tokens for that application in another clo

NO.66 Vault Agent supports which of the following? (Choose two.)

Secrets Cachin

Local key/value store

Local replica of transit encryption key

Auto-unseal Vault

Auto authentication

NO.67 Which of the following statements are true about the defaultpolicy? (Choose two.)

It is one of the built-in policies

Provides a common set of permissions and is included on all tokens by default

Can not be modified or deleted

Gives a super admin permissions, similar to a root user on a Linux machine

Vault upgrade will overwrite any update you made to the defaultpolicy

NO.68 Hotspot Question
For the following statements, choose which secrets engine enables the use case.
Each answer should only be used once.

NO.69 What can be used to limit the scope of a credential breach?

Storage of secrets in a distributed ledger

Enable audit logging

Use of a short-lived dynamic secrets

Sharing credentials between applications

NO.70 You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?

A data key encrypts the blob locally, and the same key decrypts the blob locally.

To process such a large blob. Vault will temporarily store it in the storage backend.

Vault will store the blob permanently. Be sure to run Vault on a compute optimized machine.

The transit engine is not a good solution for binaries of this size.

NO.71 You are using Vault’s Transit secrets engine to encrypt your data. You want to reduce the amount of content encrypted with a single key in case the key gets compromised. How would you do this?

Use 4096-bit RSA key to encrypt the data

Upgrade to Vault Enterprise and integrate with HSM

Periodically re-key the Vault’s unseal keys

Periodically rotate the encryption key

NO.72 Which of the following is the correct option to authenticate to Vault using a token using the CLI?

A token can be used to authenticate to Vault through the API, not the CLI or the UI vault login

vault <token>

A token cannot be used to authenticate to Vault

NO.73 The vault lease renew command increments the lease time from:

The current time

The end of the lease

NO.74 Which of these are a benefit of using the Vault Agent?

Vault Agent allows for centralized configuration of application secrets engines

Vault Agent will auto-discover which authentication mechanism to use

Vault Agent will enforce minimum levels of encryption an application can use

Vault Agent will manage the lifecycle of cached tokens and leases automatically

NO.75 How many Shamir’s key shares are required to unseal a Vault instance?

All key shares

A quorum of key shares

One or more keys

The threshold number of key shares

NO.76 Which kind of token can be renewed indefinitely?

Periodic token

Orphan token

Use-limit token

Root token

All of the above

NO.77 Your organization has an initiative to reduce and ultimately remove the use of long lived X.509 certificates. Which secrets engine will best support this use case?

PKI

Key/Value secrets engine version 2, with TTL defined

Cloud KMS

Transit

NO.78 You are performing a high number of authentications in a short amount of time. You’re experiencing slow throughput for token generation. How would you solve this problem?

Increase the time-to-live on service tokens

Implement batch tokens

Establish a rate limit quota

Reduce the number of policies attached to the tokens

NO.79 Vault supports which type of configuration for source limited token?

Cloud-bound tokens

Domain-bound tokens

CIDR-bound tokens

Certificate-bound tokens

Loading …