Question 1

What is the default TTL for tokens in Vault if one is not specified?

Options :

A : 24 hours (1 day)

B : 15 minutes

C : 768 hours (32 days)

D : 60 minutes (1 hour)

Answer: C

Question 2

All Vault instances, or clusters, include two built-in policies that are created automatically. Choose the two policies below and the correct information regarding each policy. (Select two)

Options :

A : The root policy is created automatically. This policy provides superuser privileges and cannot be deleted

B : The admin policy is created automatically. It provides administrative permissions but can be deleted if needed

C : The default policy is created automatically. This policy can be modified but not deleted

D : The default policy is created automatically. This policy cannot be modified but it can be deleted

Answer: A,C

Question 3

You are using Vault's Transit secrets engine to encrypt your dat a. You want to reduce the amount of content encrypted with a single key in case the key gets compromised. How would you do this?

Options :

A : Use 4096-bit RSA key to encrypt the data

B : Upgrade to Vault Enterprise and integrate with HSM

C : Periodically re-key the Vault-s unseal keys

D : Periodically rotate the encryption key

Answer: D

Question 4

You have a 2GB Base64 binary large object (blob) that needs to be encrypted.How will the Transit secrets engine manage the encryption lifecycle for a large blob?

Options :

A : A data key encrypts the blob locally, and the same key decrypts the blob locally.

B : Vault will store the blob permanently. Be sure to run Vault on a compute-optimized machine.

C : The Transit engine is not a good solution for binaries of this size.

D : To process such a large blob, Vault will temporarily store it in the storage backend.

Answer: A

Question 5

Although batch and service tokens share many characteristics, which of the following are true only about batch tokens? (Select three)

Options :

A : Can create child tokens

B : Are renewable up until the max TTL

C : Maintain a single fixed TTL

D : They are valid for either the primary or any secondary clusters

E : They are not persisted to disk

Answer: C,D,E