- (Topic 2)
An application requires a specific key/value pair to be updated in order to process a batch job. Thevalue should be either "true" or "false." However, when developers have been updating the value, sometimes they mistype the value or capitalize the value, causing the batch job not to run. What feature of a Vault policy can be used to restrict entry to the required values?

1. A. Add a deny statement for all possible misspellings of the value
2. B. Add an allowed_parameters value to the policy
3. C. Change the policy to include the list capability
4. D. Use a * wildcard at the end of the policy

Correct Answer: B

- (Topic 1)
In regards to the Transit secrets engine, which of the following is true given the following command and output (select three):
$ vault write encryption/encrypt/creditcard plaintext=$(base64 <<< "1234 5678 9101 1121") Key: ciphertext Value:
vault:v3:cZNHVx+sxdMErXRSuDa1q/pz49fXTn1PScKfhf+PIZPvy8xKfkytpwKcbC0fF2U=

1. A. The Transit secrets engine is mounted at the encryption path
2. B. The name of the keyring used to encrypt the data is creditcard
3. C. There are at least three data keys associated with this keyring
4. D. The data was written to the encryption path, which is provided by default when enabling the Transit secrets engine

Correct Answer: ABC

- (Topic 2)
Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (Select four)

1. A. HSM
2. B. Azure KMS
3. C. AWS KMS
4. D. Transit
5. E. Key Shards

Correct Answer: ABCD

- (Topic 4)
You are working on a new project and need to retrieve a secret from Vault. You log into the Vault UI and browse to the path where the secret is stored. Based on the screenshot below, what is true about the secrets stored in this path? (Select four)

1. A. The secrets are stored in a KV v1 secrets engine
2. B. The user does not have permission to delete the secret
3. C. The secrets are stored in a KV v2 secrets engine
4. D. The secrets engine is mounted at the path developers/
5. E. There are four previous versions of the secret
6. F. The user has additional permissions on the path beyond just list and read

Correct Answer: CDEF

- (Topic 4)
You have enabled the Transit secrets engine on your Vault cluster to provide an "encryption as a service" service as your team develops new applications. What is a prime use case for the Transit secrets engine?

1. A. Encrypting data before being written to an Amazon S3 bucket
2. B. Storing the encrypted data in Vault for easy retrieval
3. C. Generating dynamic SSH credentials for access to local systems
4. D. Creating X.509 certificates for a new fleet of containers

Correct Answer: A