- (Topic 1)
Which of the following is NOT a valid way in which a lease can be revoked in Vault?

1. A. Using the user interface (UI)
2. B. Automatically when the TTL or Max-TTL expires
3. C. Using the API to call the /v1/sys/leases endpoint
4. D. Via the CLI using the vault token command

Correct Answer: D

- (Topic 4)
What is the primary role of the Vault Security Operator (VSO) in a Kubernetes environment?

1. A. Managing Vault server deployments and auto-scaling Vault instances in Kubernetes
2. B. Enforcing Kubernetes network policies for Vault communication
3. C. Automating the injection and lifecycle management of Vault secrets for Kubernetes workloads
4. D. Replacing Kubernetes Secrets with a built-in alternative that does not require Vault

Correct Answer: C

- (Topic 1)
True or False? All dynamic secrets in Vault are required to have a lease.

1. A. True
2. B. False

Correct Answer: A

- (Topic 1)
Below is a list of parent and child tokens and their associated TTL. Which token(s) will be revoked first?

1. A. hvs.y4fUERqCtUV0xsQjWLJar5qX - TTL: 4 hours
2. B. hvs.FNiIFU14RUxxUYAl4ErLfPVR - TTL: 6 hours
3. C. hvs.Jw9LMpu7oCQgxiKbjfyzyg75 - TTL: 4 hours (child of B)
4. D. hvs.3IrlhEvcerEGbae11YQf9FvI - TTL: 3 hours
5. E. hvs.hOpweMVFvqfvoVnNgvZq8jLS - TTL: 5 hours (child of D)

Correct Answer: D

- (Topic 1)
Which of the following secrets engines does NOT issue a lease upon a read request?

1. A. KV
2. B. Consul
3. C. Database
4. D. AWS

Correct Answer: A