- (Topic 1)
Tommy has written an AWS Lambda function that will perform certain tasks for the organization when data has been uploaded to an S3 bucket. Security policies for the organization do not allow Tommy to hardcode any type of credential within the Lambda code or environment variables. However, Tommy needs to retrieve a credential from Vault to write data to an on-premises database. What auth method should Tommy use in Vault to meet the requirements while not violating security policies?

1. A. AWS
2. B. Userpass
3. C. Token
4. D. AppRole

Correct Answer: A

- (Topic 4)
To protect the sensitive data stored in Vault, what key is used to encrypt the data before it is written to the storage backend?

1. A. Recovery key
2. B. Encryption key
3. C. Unseal key
4. D. Root key

Correct Answer: B

- (Topic 1)
Select the policies below that permit you to create a new entry of environment=prod at the path /secrets/apps/my_secret (select three).

1. A. path "secrets/+/my_secret" { capabilities = ["create"] allowed_parameters = { "*" = [] } }
2. B. path "secrets/apps/my_secret" { capabilities = ["update"] }
3. C. path "secrets/apps/my_secret" { capabilities = ["create"] allowed_parameters = { "environment" = [] } }
4. D. path "secrets/apps/*" { capabilities = ["create"] allowed_parameters = { "environment" = ["dev", "test", "qa", "prod"] } }

Correct Answer: ACD

- (Topic 1)
What is the difference between the TTL and the Max TTL (select two)?

1. A. The TTL defines when the token will expire and be revoked
2. B. The TTL defines when another token will be generated
3. C. The Max TTL defines the timeframe for which a token cannot be used
4. D. The Max TTL defines the maximum timeframe for which a token can be renewed

Correct Answer: AD

- (Topic 4)
A developer team requests integration of their legacy application with Vault to encrypt and decrypt data for a backend database. They cannot modify the application for Vault authentication. What is the best way to achieve this integration?

1. A. Enable the Transit secrets engine and configure the secrets engine to send data directly to the legacy app
2. B. Have the app team call the Vault API to encrypt and decrypt the required data
3. C. Enable and configure the Kubernetes auth method to allow the application to authenticate to Vault using a JWT
4. D. Run the Vault Agent on the application server(s) and use the Auto Auth feature to manage the tokens

Correct Answer: D