- (Topic 3)
Tom is authenticating to Vault using the CLI. Which of the following commands allows Tom to authenticate using the userpass method WITHOUT logging his password to the shell history?

1. A. vault login tom
2. B. vault login -method=userpass username=tom
3. C. vault login userpass username=tom password=jerry
4. D. vault login -method=userpass username=tom password=jerry

Correct Answer: B

- (Topic 5)
How many Shamir's key shares are required to unseal a Vault instance?

1. A. All key shares
2. B. A quorum of key shares
3. C. One or more keys
4. D. The threshold number of key shares

Correct Answer: D

- (Topic 5)
Examine the command below.Output has been trimmed.

Which of the following statements describe the command and its output?

1. A. Missing a default token policy
2. B. Generated token's TTL is 60 hours
3. C. Generated token is an orphan token which can be renewed indefinitely
4. D. Configures the AppRole auth method with user specified role ID and secret ID

Correct Answer: BC

- (Topic 5)
What command creates a secret with the key "my-password" and the value "53cr3t" at path "my-secrets" within the KV secrets engine mounted at "secret"?

1. A. vault kv put secret/my-secrets/my-password 53cr3t
2. B. vault kv write secret/my-secrets/my-password 53cr3t
3. C. vault kv write 53cr3t my-secrets/my-password
4. D. vault kv put secret/my-secrets »y-password-53cr3t

Correct Answer: A

- (Topic 1)
Which of the following Vault policies will allow a Vault client to read a secret stored at secrets/applications/app01/api_key?

1. A. path "secrets/applications/" { capabilities = ["read"] allowed_parameters = { "certificate" = [] } }
2. B. path "secrets/*" { capabilities = ["list"] }
3. C. path "secrets/applications/+/api_*" { capabilities = ["read"] }
4. D. path "secrets/applications/app01/api_key/*" { capabilities = ["update", "list", "read"] }

Correct Answer: C