- (Topic 4)
A security architect is designing a solution to address the "Secret Zero" problem for a Kubernetes-based application that needs to authenticate to HashiCorp Vault. Which approach correctly leverages Vault features to solve this challenge?

1. A. Store the Vault root token in a ConfigMap and mount it to all containers that require access to sensitive information
2. B. Generate a long-lived token during deployment and store it as an environment variable within each container that needs to access Vault
3. C. Configure the Kubernetes auth method in Vault and enable applications to authenticate without pre-shared secrets
4. D. Implement a custom sidecar container that uses AppRole role-id and secret-id each time the application needs to access Vault

Correct Answer: C

- (Topic 1)
True or False? The Vault Secrets Operator does NOT encrypt client cache, such as Vault tokens and leases, by default in Kubernetes Secrets.

1. A. True
2. B. False

Correct Answer: A

- (Topic 1)
What could you do with the feature found in the screenshot below (select two)?

1. A. Using a short TTL, you could encrypt data in order to place only the encrypted data in Vault
2. B. Encrypt the Vault master key that is stored in memory
3. C. Encrypt sensitive data to send to a colleague over email
4. D. Use response-wrapping to protect data

Correct Answer: CD

- (Topic 4)
A Fintech company is using Vault to store its static long-lived credentials so automated processes can quickly retrieve secrets. A user needs to add a new static secret for a new automated job. What CLI commands can be used to store a new static credential? (Select two)

1. A. vault kv put kv/training/certification/vault @secrets.txt
2. B. vault kv write kv/training/certification/vault key=username value=bryan
3. C. vault kv create kv/training/certification/vault @secrets.txt
4. D. vault kv put -mount=secret creds passcode=my-long-passcode

Correct Answer: AD

- (Topic 1)
After decrypting data using the Transit secrets engine, the plaintext output does not match the plaintext credit card number that you encrypted. Which of the following answers provides a solution?
$ vault write transit/decrypt/creditcard ciphertext="vault:v1:cZNHVx+sxdMEr......." Key: plaintext Value: Y3JlZGl0LWNhcmQtbnVtYmVyCg==

1. A. Vault is sealed, therefore the data cannot be decrypte
2. B. Unseal Vault to properly decrypt the data
3. C. The user doesn??t have permission to decrypt the data, therefore Vault returns false data
4. D. The resulting plaintext data is base64-encode
5. E. To reveal the original plaintext, use the base64 --decode command
6. F. The data is corrupte
7. G. Execute the encryption command again using a different data key

Correct Answer: C