- (Topic 1)
You??ve set up multiple Vault clusters, one on-premises intended to be the primary cluster, and the second cluster in AWS, which was deployed for performance replication. After enabling replication, developers complain that all the data they??ve stored in the AWS Vault cluster is missing. What happened?

1. A. There is a certificate mismatch after replication was enabled since Vault replication generates its own TLS certificates to ensure nodes are trusted entities
2. B. All of the data on the secondary cluster was deleted after replication was enabled
3. C. The data was automatically copied to the primary cluster after replication was enabled since all writes are always forwarded to the primary cluster
4. D. The data was moved to a recovery path after replication was enable
5. E. Use the vault secrets move command to move the data back to its intended location

Correct Answer: B

- (Topic 3)
After setting up a new HashiCorp Vault server with the default configurations, which method can be used to unseal Vault?

1. A. Log on to each Vault node and provide the root token
2. B. Running vault operator init to regenerate unseal keys and automatically unseal the Vault
3. C. Submit a threshold of unseal keys to reconstruct the root key
4. D. Restart the Vault service, which will automatically unseal it

Correct Answer: C

- (Topic 4)
Why are short-lived, dynamic secrets in Vault more secure than long-lived, static credentials?

1. A. They provide better performance by caching credentials for longer durations
2. B. They are created on-demand and expire after a short period, minimizing the risk of credential leakage
3. C. They eliminate the need for authentication, allowing seamless access to Vault-managed systems
4. D. They automatically rotate on a set schedule, reducing the need for manual intervention

Correct Answer: B

- (Topic 4)
True or False? After rotating a transit encryption key, all data encrypted with the previous version must be rewrapped or re-encrypted with the new key.

1. A. True
2. B. False

Correct Answer: B

- (Topic 2)
Which of the following best describes the function of the Vault Secrets Operator in a Kubernetes environment?

1. A. It replaces the Kubernetes secrets API entirely and operates purely as a certificate authority for all workloads.
2. B. It is a standalone Vault server that automatically applies security policies and rotates root tokens.
3. C. It continuously reconciles and synchronizes secrets from Vault to Kubernetes, ensuring secrets are always updated
4. D. It provides an interface to dynamically provision Kubernetes clusters through Vault??s infrastructure secrets.

Correct Answer: C