Weekend Sale - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65percent

Welcome To DumpsPedia

VA-002-P Sample Questions Answers

Questions 4

Vault's User Interface (UI) needs to be enabled in the command line before it can be used.

Options:

A.

FALSE

B.

TRUE

Buy Now
Questions 5

Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (select four)

Options:

A.

Transit

B.

HSM

C.

AWS KMS

D.

Key Shards

E.

Azure KMS

Buy Now
Questions 6

An administrator wants to create a new KV mount for individual users to maintain their own secrets but needs a way to simplify the policy so they don't need to write a new one for each new user? With the requirements listed below, what would such a policy look like?

Requirement: Each user can perform all operations on their allocated key/value secret path

Options:

A.

path "user-kv/data/{{identity.entity.name}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}

B.

path "user-kv/data/{{identity.entity.id.name}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}

C.

path "user-kv/data/{{identity.entity.aliases.<>.id}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}

D.

path "user-kv/data/{{user}}/*" {

capabilities = [ "create", "update", "read", "delete", "list" ]

}

Buy Now
Questions 7

After decrypting data using the transit secrets engine, the plaintext output does not match the plaintext credit card number that you encrypted. Which of the following answers provides a solution?

1. $ vault write transit/decrypt/creditcard\ ciphertext="vault:v1:cZNHVx+sxdMErXRSuDa1q/pz49fXTn1PScKfhf+PIZPvy8xKfkytpwKcbC0fF2U=" \

2.

3. Key Value

4. --- -----

5. plaintext Y3JlZGl0LWNhcmQtbnVtYmVyCg==

Options:

A.

The resulting plaintext data is base64-encoded. To reveal the original plaintext, use the base64 --decode command.

B.

The data is corrupted. Execute the encryption command again using a different data key

C.

the user doesn't have permission to decrypt the data, therefore Vault returns false data so as not to reveal if the data was actually encrypted by Vault

D.

Vault is sealed, therefore the data cannot be decrypted. Unseal Vault to properly decrypt the data

Buy Now
Questions 8

You've set up multiple Vault clusters, one on-premises which is intended to be the primary cluster, and the second cluster in AWS, which was deployed to be used for performance replication. After enabling replication, developers complain that all the data they've stored in the AWS Vault cluster is missing. What happened?

Options:

A.

the data was moved to a recovery path after replication was enabled. Use the vault secrets move command to move the data back to its intended location

B.

there is a certificate mismatch after replication was enabled since Vault replication generates its own TLS certificates to ensure nodes are trusted entities

C.

the data was automatically copied to the primary cluster after replication was enabled since all writes are always forwarded to the primary cluster

D.

all of the data on the secondary cluster was deleted after replication was enabled

Buy Now
Questions 9

When configuring a remote backend in Terraform, it might be a good idea to purposely omit some of the required arguments to ensure secrets and other relevant data are not inadvertently shared with others. What are the ways the remaining configuration can be added to Terraform so it can initialize and communicate with the backend? (select three)

Options:

A.

directly querying HashiCorp Vault for the secrets

B.

command-line key/value pairs

C.

use the -backend-config=PATH to specify a separate config file

D.

interactively on the command line

Buy Now
Questions 10

Terraform Enterprise (also referred to as pTFE) requires what type of backend database for a clustered deployment?

Options:

A.

Cassandra

B.

MSSQL

C.

PostgreSQL

D.

MySQL

Buy Now
Questions 11

True or False:

When using the transit secrets engine, setting the min_decryption_version will determine the minimum key length of the data key (i.e., 2048, 4096, etc.)

Options:

A.

False

B.

True

Buy Now
Questions 12

Select the two default policies created in Vault. (select two)

Options:

A.

default

B.

vault

C.

base

D.

root

E.

admin

F.

user

Buy Now
Questions 13

What is the result of the following Vault command?

vault auth enable userpass

Options:

A.

Imports usernames and passwords from LDAP to the local database

B.

allows Vault to access usernames and passwords stored in a second Vault cluster

C.

Enables Vault to use external services to authenticate clients to Vault

D.

mounts the userpass auth method to the default path

Buy Now
Questions 14

Using the Vault CLI, what command is used to authenticate to Vault?

Options:

A.

vault creds

B.

vault user

C.

vault login

D.

vault auth

Buy Now
Questions 15

A Vault client who has read access to the path secrets/apps/app1 is having trouble viewing the secret in the user interface (UI) but can access via the API. What can be done to resolve this issue?

Options:

A.

add read permissions to the path secrets/apps

B.

modify the policy to allow the create permission

C.

remove the deny policy blocking access to the secrets/apps/app1 path

D.

add LIST to the policy so the user can browse the paths leading up to the key/value's path

Buy Now
Questions 16

Your organization has moved to AWS and has manually deployed infrastructure using the console. Recently, a decision has been made to standardize on Terraform for all deployments moving forward.

What can you do to ensure that all existing is managed by Terraform moving forward without interruption to existing services?

Options:

A.

resources that are manually deployed in the AWS console cannot be imported by Terraform

B.

using terraform import, import the existing infrastructure into your Terraform state

C.

delete the existing resources and recreate them using new a Terraform configuration so Terraform can manage them moving forward

D.

submit a ticket to AWS and ask them to export the state of all existing resources and use terraform import to import them into the state file

Buy Now
Questions 17

True or False?

terraform init cannot automatically download Community providers.

Options:

A.

False

B.

True

Buy Now
Questions 18

In order to reduce the time it takes to provision resources, Terraform uses parallelism. By default, how many resources will Terraform provision concurrently?

Options:

A.

20

B.

50

C.

5

D.

10

Buy Now
Questions 19

Which of the following allows Terraform users to apply policy as code to enforce standardized configurations for resources being deployed via infrastructure as code?

Options:

A.

functions

B.

workspaces

C.

module registry

D.

sentinel

Buy Now
Questions 20

Select two answers to complete the following sentence:

Before a new provider can be used, it must be ______ and _______.

Options:

A.

approved by HashiCorp

B.

declared in the configuration

C.

initialized

D.

uploaded to source control

Buy Now
Questions 21

What is the result of the following terraform function call?

index(["a", "b", "c"], "c")

Options:

A.

1

B.

true

C.

2

D.

0

Buy Now
Questions 22

Which TCP port does Vault replication use?

Options:

A.

8200

B.

8201

C.

8300

D.

8301

Buy Now
Questions 23

A user has created three workspaces using the command line - prod, dev, and test. The user wants to create a fourth workspace named stage. Which command will the user execute to accomplish this?

Options:

A.

terraform workspace -new stage

B.

terraform workspace -create stage

C.

terraform workspace create stage

D.

terraform workspace new stage

Buy Now
Questions 24

What feature of Vault would allow you to architect a "Vault within a Vault"?

Options:

A.

sentinel

B.

secrets engines

C.

control groups

D.

namespaces

Buy Now
Questions 25

Select all features which are exclusive to Terraform Enterprise. (select three)

Options:

A.

Audit Logs

B.

Cost Estimation

C.

Sentinel

D.

Clustering

E.

SAML/SSO

Buy Now
Questions 26

Which of the following connection types are supported by the remote-exec provisioner? (select two)

Options:

A.

rdp

B.

smb

C.

ssh

D.

winrm

Buy Now
Questions 27

True or False:

Multiple providers can be declared within a single Terraform configuration file.

Options:

A.

False

B.

True

Buy Now
Questions 28

When using providers that require the retrieval of data, such as the HashiCorp Vault provider, in what phase does Terraform actually retrieve the data required?

Options:

A.

terraform apply

B.

terraform plan

C.

terraform init

D.

terraform delete

Buy Now
Questions 29

Which of the following statements best describes the Terraform list(...) type?

Options:

A.

a collection of unique values that do not have any secondary identifiers or ordering.

B.

a collection of values where each is identified by a string label.

C.

a sequence of values identified by consecutive whole numbers starting with zero.

D.

a collection of named attributes that each have their own type.

Buy Now
Questions 30

Which of the following is not an activity associated with the Vault transit secrets engine?

Options:

A.

encrypt

B.

decrypt

C.

update

D.

rewrap

Buy Now
Questions 31

What system endpoint can you query to determine which node is the leader of a cluster?

Options:

A.

/sys/tools

B.

/sys/leader

C.

/sys/health

D.

/sys/init

Buy Now
Questions 32

Why is it a good idea to declare the required version of a provider in a Terraform configuration file?

1. terraform {

2. required_providers {

3. aws = "~> 1.0"

4. }

5. }

Options:

A.

to remove older versions of the provider

B.

to ensure that the provider version matches the version of Terraform you are using

C.

providers are released on a separate schedule from Terraform itself; therefore a newer version could introduce breaking changes

D.

to match the version number of your application being deployed via Terraform

Buy Now
Questions 33

When architecting a Vault replication configuration, why should you never terminate TLS on a front-end load balancer?

Options:

A.

If Vault detects that the traffic has been unencrypted and re-encrypted, due to the load balancer, it will automatically drop the traffic as it is no longer trusted.

B.

Vault generates self-signed mutual TLS for replication. If the LB is performing TLS termination, this will break the mutual TLS between nodes.

C.

Vault requires that only Consul service discovery can be used to direct traffic to an active Vault node.

D.

Vault replication won't work with the type of certificates that a traditional load balancer uses.

Buy Now
Questions 34

When a primary Vault cluster fails, Vault will automatically promote a secondary cluster to ensure maximum uptime.

Options:

A.

False

B.

True

Buy Now
Questions 35

In the example below, the depends_on argument creates what type of dependency?

1. esource "aws_instance" "example" {

2. ami = "ami-2757f631"

3. instance_type = "t2.micro"

4. depends_on = [aws_s3_bucket.company_data]

5. }

Options:

A.

non-dependency resource

B.

implicit dependency

C.

explicit dependency

D.

internal dependency

Buy Now
Questions 36

When Terraform needs to be installed in a location where it does not have internet access to download the installer and upgrades, the installation is generally known as to be __________.

Options:

A.

a private install

B.

disconnected

C.

non-traditional

D.

air-gapped

Buy Now
Questions 37

Your organization is running Vault open source and has decided it wants to use the Identity secrets engine. You log into Vault but are unable to find it in the list to enable. What gives?

Options:

A.

because you are running open-source and the identity secrets engine is an Enterprise feature, it is not available to enable.

B.

the identity secrets engine was deprecated in previous versions

C.

this secrets engine will be mounted by default.

D.

the policy attached to your user doesn't allow access to the Identity secrets engine.

Buy Now
Questions 38

Which of the following best describes the default local backend?

Options:

A.

The local backend stores state on the local filesystem locks the state using system APIs and performs operations locally.

B.

The local backend is the directory where resources deployed by Terraform have direct access to in order to update their current state

C.

The local backend is how Terraform connects to public cloud services, such as AWS, Azure, or GCP.

D.

The local backend is where Terraform Enterprise stores logs to be processed by a log collector

Buy Now
Questions 39

A user has created a module called "my_test_module" and committed it to GitHub. Over time, several commits have been made with updates to the module, each tagged in GitHub with an incremental version number. Which of the following lines would be required in a module configuration block in terraform to select tagged version v1.0.4?

Buy Now
Questions 40

Select the operating systems which are supported for a clustered Terraform Enterprise: (select four)

Options:

A.

Unix

B.

Amazon Linux

C.

Red Hat

D.

Ubuntu

E.

CentOS

Buy Now
Questions 41

True or False:

The terraform refresh command is used to reconcile the state Terraform knows about (via its state file) with the real-world infrastructure. If the drift is detected between the real-world infrastructure and the last known-state, it will modify the infrastructure to correct the drift.

Options:

A.

False

B.

True

Buy Now
Questions 42

What could you do with the feature found in the screenshot below? (select two)

Options:

A.

encrypt the Vault master key that is stored in memory

B.

using a short TTL, you could encrypt data in order to place only the encrypted data in Vault

C.

encrypt sensitive data to send to a colleague over email

D.

use response-wrapping to protect data

Buy Now
Questions 43

What are the primary benefits of running Vault in a production deployment over dev server mode? (select two)

Options:

A.

ability to enable auth methods

B.

persistent storage

C.

encryption via TLS

D.

faster deployment

E.

access to all of the secret engines

Buy Now
Questions 44

What is a downside to using a Terraform provider, such as the Vault provider, to interact with sensitive data, such as reading secrets from Vault?

Options:

A.

Terraform and Vault must be running on the same physical host

B.

Terraform and Vault must be running on the same version

C.

Terraform requires a unique auth method to work with Vault

D.

Secrets are persisted to the state file and plans

Buy Now
Questions 45

Environment variables can be used to set variables. The environment variables must be in the format "____"_. Select the correct prefix string from the following list.

Options:

A.

TF_VAR

B.

TF_VAR_NAME

C.

TF_ENV

D.

TF_ENV_VAR

Buy Now
Questions 46

What is the proper command to enable the AWS secrets engine at the default path?

Options:

A.

vault enable secrets aws

B.

vault secrets aws enable

C.

vault secrets enable aws

D.

vault enable aws secrets engine

Buy Now
Questions 47

True or False: You can migrate the Terraform backend but only if there are no resources currently being managed.

Options:

A.

False

B.

True

Buy Now
Questions 48

Which of the following variable declarations is going to result in an error?

Options:

A.

variable "example" {

type = object({})

}

B.

variable "example" {}

C.

variable "example" {

description = "This is a test"

type = map

default = {"one" = 1, "two" = 2, "Three" = "3"}

}

D.

variable "example" {

description = "This is a variable description"

type = list(string)

default = {}

}

Buy Now
Questions 49

Vault has failed to start. You inspect the log and find the error below. What needs to be changed in order to successfully start Vault?

"Error parsing config.hcl: At 1:12: illegal char"

Options:

A.

the " character cannot be used in the config file

B.

fix the syntax error in the Vault configuration file

C.

you must use single quotes vs double quotes in the config file

D.

line 1 on the config file is blank

Buy Now
Questions 50

Vault does not trust the storage backend.

Options:

A.

False

B.

True

Buy Now
Questions 51

Terraform has detailed logs which can be enabled by setting the _________ environmental variable.

Options:

A.

TF_LOG

B.

TF_TRACE

C.

TF_DEBUG

D.

TF_INFO

Buy Now
Questions 52

Which of the following actions are performed during a terraform init? (select three)

Options:

A.

provisions the declared resources in your configuration

B.

download the declared providers which are supported by HashiCorp

C.

initializes the backend configuration

D.

initializes downloaded and/or installed providers

Buy Now
Questions 53

What is the default method of authentication after first initializing Vault?

Options:

A.

GitHub

B.

AppRole

C.

Admin account

D.

Tokens

E.

Userpass

F.

TLS certificates

Buy Now
Questions 54

Which of the following Terraform files should be ignored by Git when committing code to a repo? (select two)

Options:

A.

output.tf

B.

terraform.tfstate

C.

terraform.tfvars

D.

variables.tf

Buy Now
Questions 55

True or False:

Once you create a KV v1 secrets engine and place data in it, there is no way to modify the mount to include the features of a KV v2 secrets engine.

Options:

A.

True

B.

False

Buy Now
Questions 56

True or False? By default, Terraform destroy will prompt for confirmation before proceeding.

Options:

A.

True

B.

False

Buy Now
Questions 57

In Terraform Enterprise, a workspace can be mapped to how many VCS repos?

Options:

A.

5

B.

3

C.

2

D.

1

Buy Now
Questions 58

A "backend" in Terraform determines how the state is loaded and how an operation such as apply is executed. Which of the following is not a supported backend type?

Options:

A.

terraform enterprise

B.

s3

C.

github

D.

consul

E.

artifactory

Buy Now
Questions 59

A user has logged into the Vault user interface but cannot browse to a secret located at kv/applications/app3, however, the policy the user is bound by permits read permission to the secret.

Because of the read permission, the user should be able to read the secret in the Vault UI.

Options:

A.

False

B.

True

Buy Now
Questions 60

By default, the max TTL for a token is how many days?

Options:

A.

14 days

B.

32 days

C.

31 days

D.

7 days

Buy Now
Exam Code: VA-002-P
Exam Name: HashiCorp Certified: Vault Associate
Last Update: Oct 9, 2024
Questions: 200
$56  $159.99
$42  $119.99
$35  $99.99
buy now VA-002-P