Clear your concepts with VA-002-P Questions Before Attempting Real exam [Q67-Q91]

VA-002-P HashiCorp

admin -

July 27, 2023

5/5 - (1 vote)

Clear your concepts with VA-002-P Questions Before Attempting Real exam

Get professional help from our VA-002-P Dumps PDF

HashiCorp VA-002-P exam is intended for IT professionals who want to validate their skills and knowledge in using HashiCorp Vault to manage secrets and protect sensitive data. It is also suitable for system administrators, DevOps engineers, security professionals, and cloud architects who work with Vault to secure their organization’s infrastructure and applications.

HashiCorp VA-002-P exam is a certification exam for individuals who want to demonstrate their proficiency in the use of HashiCorp’s Vault software. VA-002-P exam is designed to test the knowledge and skills of professionals who work with Vault on a daily basis, and it is an excellent way to show potential employers that you have the expertise needed to succeed in this field.

Q67. Beyond encryption and decryption of data, which of the following is not a function of the Vault transit secrets engine?

generate hashes and HMACs of data

sign and verify data

act as a source of random bytes

store the encrypted data securely in Vault for retrieval

Vault doesn’t store the data sent to the secrets engine.
The transit secrets engine handles cryptographic functions on data-in-transit. It can also be viewed as “cryptography as a service” or “encryption as a service”. The transit secrets engine can also sign and verify data; generate hashes and HMACs of data; and act as a source of random bytes.

Q68. From the answers below, select the advantages of using Infrastructure as Code. (select four)

Easily integrate with application workflows (GitLab Actions, Azure DevOps, CI/CD tools)

Safely test modifications using a “dry run” before applying any actual changes

Provide reusable modules for easy sharing and collaboration

Easily change and update existing infrastructure

Provide a codified workflow to develop customer-facing applications

Infrastructure as Code is not used to develop applications, but it can be used to help deploy or provision those applications to a public cloud provider or on-premises infrastructure.
All of the others are benefits to using Infrastructure as Code over the traditional way of managing infrastructure, regardless if it’s public cloud or on-premises.

Q69. The userpass auth method has the ability to access external services in order to provide authentication to Vault.

FALSE

TRUE

The userpass auth method uses a local database that cannot interact with any services outside of the Vault instance.

Q70. In regards to using a K/V v2 secrets engine, select the three correct statements below: (select three)

issuing a vault kv destroy statement permanently deletes a single version of a secret

issuing a vault kv destroy statement deletes all versions of a secret

issuing a vault kv delete statement permanently deletes the secret

issuing a vault kv metadata delete statement permanently deletes the secret

issuing a vault kv delete statement performs a soft delete

The kv delete command is like a soft delete which deletes the data for the provided path in the key/value secrets engine. If using K/V Version 2, its versioned data will not be fully removed, but marked as deleted and will no longer be available for normal get requests.
The kv destroy command permanently removes the specified versions’ data from the key/value secrets engine. If no key exists at the path, no action is taken. It does not deletes all versions of a secret.
The kv metadata delete command deletes all versions and metadata for the provided key.

Q71. Which of the following actions are performed during a terraform init? (select three)

provisions the declared resources in your configuration

download the declared providers which are supported by HashiCorp

initializes the backend configuration

initializes downloaded and/or installed providers

The terraform init command is used to initialize a working directory containing Terraform configuration files. This is the first command that should be run after writing a new Terraform configuration or cloning an existing one from version control. It is safe to run this command multiple times.

Q72. Which of the following secrets engine can generate dynamic credentials? (select three)

Azure

database

key/value

Transit

AWS

Vault has many secrets engines that can generate dynamic credentials, including AWS, Azure, and database secrets engines. The key/value secret engine is used to store data, and the transit secret engine is used to encrypt data.

Q73. Which two interfaces automatically assume the token for subsequent requests after successfully authenticating? (select two)

API

CLI

Consul

After authenticating, the UI and CLI automatically assume the token for all subsequent requests. The API, however, requires the user to extract the token from the server response after authenticating in order to send with subsequent requests.

Q74. A user has logged into the Vault user interface but cannot browse to a secret located at kv/applications/app3, however, the policy the user is bound by permits read permission to the secret.
Because of the read permission, the user should be able to read the secret in the Vault UI.

False

True

To browse Vault paths in the UI, the user must have list permissions on the mount and the paths leading up to the secret.

Q75. Which of the following commands will launch the Interactive console for Terraform interpolations?

terraform

terraform console

terraform cmdline

terraform cli

The terraform console command provides an interactive console for evaluating expressions.
https://www.terraform.io/docs/commands/console.html

Q76. When Terraform needs to be installed in a location where it does not have internet access to download the installer and upgrades, the installation is generally known as to be __________.

a private install

disconnected

non-traditional

air-gapped

A Terraform Enterprise install that is provisioned on a network that does not have Internet access is generally known as an air-gapped install. These types of installs require you to pull updates, providers, etc. from external sources vs. being able to download them directly.

Q77. Which statements best describes what the local variable assignment is doing in the following code snippet:
1. variable “subnet_details” {
2. type = list(object({
3. cidr = string
4. subnet_name = string
5. route_table_name = string
6. aznum = number
7. }))
8. }
9. locals {
10. route_tables_all = distinct([for s in var.subnet_details : s.route_table_name ])
11. }

Create a distinct list of route table name objects

Create a map of route table names to subnet names

Create a map of route table names from a list of subnet names

Create a list of route table names eliminating duplicates

route_tables_all is assigned a list of unique route table names filtered from a list of objects describing subnet details, one of those object attributes being route_table_name.

Q78. What Terraform feature is shown in the example below?
1. resource “aws_security_group” “example” {
2. name = “sg-app-web-01”
3. dynamic “ingress” {
4. for_each = var.service_ports
5. content {
6. from_port = ingress.value
7. to_port = ingress.value
8. protocol = “tcp”
9. }
10. }
11. }

data source

dynamic block

local values

conditional expression

You can dynamically construct repeatable nested blocks like ingress using a special dynamic block type, which is supported inside resource, data, provider, and provisioner blocks

Q79. Anyone can publish and share modules on the Terraform Public Module Registry, and meeting the requirements for publishing a module is extremely easy. Select from the following list all valid requirements. (select three)

The registry uses tags to identify module versions. Release tag names must be for the format x.y.z, and can optionally be prefixed with a v.

Module repositories must use this three-part name format, terraform-<PROVIDER>-<NAME>.

The module must be PCI/HIPPA compliant.

The module must be on GitHub and must be a public repo

The list below contains all the requirements for publishing a module. Meeting the requirements for publishing a module is extremely easy. The list may appear long only to ensure we’re detailed, but adhering to the requirements should happen naturally.
GitHub. The module must be on GitHub and must be a public repo. This is only a requirement for the public registry. If you’re using a private registry, you may ignore this requirement.
Named terraform-<PROVIDER>-<NAME>. Module repositories must use this three-part name format, where <NAME> reflects the type of infrastructure the module manages, and <PROVIDER> is the main provider where it creates that infrastructure. The <NAME> segment can contain additional hyphens. Examples: terraform-google-vault or terraform-aws-ec2-instance.
Repository description. The GitHub repository description is used to populate the short description of the module. This should be a simple one-sentence description of the module.
Standard module structure. The module must adhere to the standard module structure. This allows the registry to inspect your module and generate documentation, track resource usage, parse submodules and examples, and more.
x.y.z tags for releases. The registry uses tags to identify module versions. Release tag names must be a semantic version, which can optionally be prefixed with a v. For example, v1.0.4 and 0.9.2. To publish a module initially, at least one release tag must be present. Tags that don’t look like version numbers are ignored.
https://www.terraform.io/docs/registry/modules/publish.html#requirements

Q80. By default, the max TTL for a token is how many days?

14 days

32 days

31 days

7 days

The system max TTL, which is 32 days but can be changed in Vault’s configuration file.
The max TTL set on a mount using mount tuning. This value is allowed to override the system max TTL — it can be longer or shorter, and if set this value will be respected.
A value suggested by the auth method that issued the token. This might be configured on a per-role, per-group, or per-user basis. This value is allowed to be less than the mount max TTL (or, if not set, the system max TTL), but it is not allowed to be longer.
Reference link:- https://www.vaultproject.io/docs/concepts/tokens

Q81. Vault has failed to start. You inspect the log and find the error below. What needs to be changed in order to successfully start Vault?
“Error parsing config.hcl: At 1:12: illegal char”

the ” character cannot be used in the config file

fix the syntax error in the Vault configuration file

you must use single quotes vs double quotes in the config file

line 1 on the config file is blank

It implies that there is a syntax error in the configuration file. The exact location of the error in the file can be identified in the error message

Q82. When configuring a remote backend in Terraform, it might be a good idea to purposely omit some of the required arguments to ensure secrets and other relevant data are not inadvertently shared with others. What are the ways the remaining configuration can be added to Terraform so it can initialize and communicate with the backend? (select three)

directly querying HashiCorp Vault for the secrets

command-line key/value pairs

use the -backend-config=PATH to specify a separate config file

interactively on the command line

You do not need to specify every required argument in the backend configuration. Omitting certain arguments may be desirable to avoid storing secrets, such as access keys, within the main configuration. When some or all of the arguments are omitted, we call this a partial configuration.
With a partial configuration, the remaining configuration arguments must be provided as part of the initialization process. There are several ways to supply the remaining arguments:
Interactively: Terraform will interactively ask you for the required values unless interactive input is disabled. Terraform will not prompt for optional values.
File: A configuration file may be specified via the init command line. To specify a file, use the -backend-config=PATH option when running terraform init. If the file contains secrets it may be kept in a secure data store, such as Vault, in which case it must be downloaded to the local disk before running Terraform.
Command-line key/value pairs: Key/value pairs can be specified via the init command line. Note that many shells retain command-line flags in a history file, so this isn’t recommended for secrets. To specify a single key/value pair, use the -backend-config=”KEY=VALUE” option when running terraform init.

Q83. What Terraform command can be used to inspect the current state file?

terraform inspect

terraform show

terraform read

terraform state

The terraform show command is used to provide human-readable output from a state or plan file. This can be used to inspect a plan to ensure that the planned operations are expected, or to inspect the current state as Terraform sees it.
Machine-readable output can be generated by adding the -json command-line flag.
Note: When using the -json command-line flag, any sensitive values in Terraform state will be displayed in plain text.

Q84. Which of the following statements best describes the Terraform list(…) type?

a collection of unique values that do not have any secondary identifiers or ordering.

a collection of values where each is identified by a string label.

a sequence of values identified by consecutive whole numbers starting with zero.

a collection of named attributes that each have their own type.

A terraform list is a sequence of values identified by consecutive whole numbers starting with zero.
https://www.terraform.io/docs/configuration/types.html#structural-types

Q85. After issuing the command to delete a secret, you run a vault kv list command but the secret still exists. What command would permanently delete this secret from Vault?
1. $ vault kv delete kv/applications/app01
2. Success! Data deleted (if it existed) at: kv/applications/app01
3. $ vault kv list kv/applications
4. Keys
5. —-
6. app01

vault kv metadata delete kv/applications/app01

vault kv delete -all kv/applications/app01

vault kv delete -force kv/applications/app01

vault kv destroy -versions=1 kv/applications/app01

The kv metadata command has subcommands for interacting with the metadata and versions for the versioned secrets (K/V Version 2 secrets engine) at the specified path.
The kv metadata delete command deletes all versions and metadata for the provided key.
Reference link:- https://www.vaultproject.io/docs/commands/kv/metadata

Q86. In order to extend Vault beyond a data center or cloud regional boundary, what feature should be used?

plugins

secrets engine

replication

seal/unseal

snapshots

To extend Vault beyond a data center or cloud regional boundary, replication can be used. Vault supports both DR replication and Performance replication to copy data from the primary cluster to a secondary cluster safely.

Q87. Which of the following settings are configured using the configuration file? (select three)

Cluster Name

Replication

Seal Type

Auth Methods

Namespaces

Storage Backend

Audit Devices

Seal types, Storage backends, and cluster names are just a few of the configurations done via the configuration file. The others are configured within Vault itself.

Q88. What are some of the problems of how infrastructure was traditionally managed before Infrastructure as Code? (select three)

Requests for infrastructure or hardware required a ticket, increasing the time required to deploy applications

Traditional deployment methods are not able to meet the demands of the modern business where resources tend to live days to weeks, rather than months to years

Traditionally managed infrastructure can’t keep up with cyclic or elastic applications

Pointing and clicking in a management console is a scalable approach and reduces human error as businesses are moving to a multi-cloud deployment model

Businesses are making a transition where traditionally-managed infrastructure can no longer meet the demands of today’s businesses. IT organizations are quickly adopting the public cloud, which is predominantly API-driven.
To meet customer demands and save costs, application teams are architecting their applications to support a much higher level of elasticity, supporting technology like containers and public cloud resources. These resources may only live for a matter of hours; therefore the traditional method of raising a ticket to request resources is no longer a viable option Pointing and clicking in a management console is NOT scale and increases the change of human error.

Q89. When multiple arguments with single-line values appear on consecutive lines at the same nesting level, HashiCorp recommends that you:

place a space in between each line
type = “A”
ttl = “300”
zone_id = aws_route53_zone.primary.zone_id

align their equals signs
ami = “abc123”
instance_type = “t2.micro”

place all arguments using a variable at the top
ami = var.aws_ami
instance_type = var.instance_size
subnet_id = “subnet-0bb1c79de3EXAMPLE”
tags = {
Name = “HelloWorld”
}

put arguments in alphabetical order
name = “www.pythonfanclub.com”
records = [aws_eip.lb.public_ip]
type = “A”
ttl = “300”
zone_id = aws_route53_zone.primary.zone_id

HashiCorp style conventions suggest you that align the equals sign for consecutive arguments for easing readability for configurations ami = “abc123” instance_type = “t2.micro”

Q90. What could you do with the feature found in the screenshot below? (select two)

encrypt the Vault master key that is stored in memory

using a short TTL, you could encrypt data in order to place only the encrypted data in Vault

encrypt sensitive data to send to a colleague over email

use response-wrapping to protect data

Vault includes a feature called response wrapping. When requested, Vault can take the response it would have sent to an HTTP client and instead insert it into the cubbyhole of a single-use token, returning that single-use token instead.

Q91. The Terraform language supports a number of different syntaxes for comments. Select all that are supported. (select three)

/* and */

<* and *>

Terraform supports the #, //, and /*..*/ for commenting Terraform configuration files. Please use them when writing Terraform so both you and others who are using your code have a full understanding of what the code is intended to do.
https://www.terraform.io/docs/configuration/syntax.html#comments

Loading …