Vault-Associate-002 무료 덤프문제 온라인 액세스

One of the benefits of using the Vault transit secrets engine is its ability to easily rotate encryption keys. Which of these is true regarding key rotation?

• A.Encryption keys can be rotated manually by a user, or by an automated process which invokes the key rotation API
• B.Vault automatically rotates the encryption key based on a set period
• C.Vault can rotate encryption keys, but cannot enforce restrictions about the minimum encryption key version
• D.Vault does not maintain the versioned keyring

Which of the following is the correct option to authenticate to Vault using a token using the CLI?

• A.vault <token>
• B.A token cannot be used to authenticate to Vault
• C.A token can be used to authenticate to Vault through the API, not the CLI or the UI vault login

Which of the following describes the Vault's auth method component?

• A.It verifies a client against an internal or external system, and generates a token with the appropriate policies attached
• B.It dynamically generates a unique set of secrets with appropriate permissions attached
• C.It is responsible for durable storage of client tokens
• D.It verifies a client against an internal or external system, and generates a token with rootpolicy

A web application uses Vault's transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit, which of the following statements are true? (Choose two.)

• A.You can rotate the encryption key so that the attacker won't be able to decrypt the data
• B.Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)
• C.The Vault administrator would need to seal the Vault server immediately
• D.The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted

What does the following policy do?

• A.Allows a user to read data about the secret endpoint identity
• B.Grants access to a special system entity folder
• C.Nothing, this is not a valid policy
• D.Grants access for each user to a KV folder which shares their id