[Jun 19, 2026] Get New Vault-Associate-002 Certification Practice Test Questions Exam Dumps [Q62-Q82]

[Jun 19, 2026] Get New Vault-Associate-002 Certification Practice Test Questions Exam Dumps

Real Vault-Associate-002 Exam Dumps Questions Valid Vault-Associate-002 Dumps PDF

NEW QUESTION # 62
What information is required to revoke a Vault lease?

A. User ID
B. Token ID
C. Secret ID
D. Lease ID

Answer: D

NEW QUESTION # 63
Which of the following statements are true about the defaultpolicy? (Choose two.)

A. Provides a common set of permissions and is included on all tokens by default
B. Can not be modified or deleted
C. Gives a super admin permissions, similar to a root user on a Linux machine
D. Vault upgrade will overwrite any update you made to the defaultpolicy
E. It is one of the built-in policies

Answer: A,E

NEW QUESTION # 64
What are orphan tokens?

A. Orphan tokens do not expire when their own max TTL is reached
B. Orphan tokens are tokens with no policies attached
C. Orphan tokens are tokens with a use limit so you can set the number of uses when you create them
D. Orphan tokens are not children of their parent; therefore, orphan tokens do not expire when their parent does

Answer: D

NEW QUESTION # 65
Vault operators can create two types of groups in Vault. What are the two types?

A. policy groups
B. user groups
C. security groups
D. external groups
E. internal groups

Answer: D,E

NEW QUESTION # 66
A web application uses Vault's transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit, which of the following statements are true? (Choose two.)

A. Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)
B. The Vault administrator would need to seal the Vault server immediately
C. You can rotate the encryption key so that the attacker won't be able to decrypt the data
D. The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted

Answer: B,C

NEW QUESTION # 67
Which of the following describes usage of an identity group?

A. When they want to revoke the credentials for a whole set of entities simultaneously
B. Consistently apply the same set of policies to a collection of entities
C. Limit the policies that would otherwise apply to an entity in the group
D. Audit token usage

Answer: B

NEW QUESTION # 68
Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool. Which secrets engine would you recommend?

A. Google Cloud Secrets Engine
B. Identity secrets engine
C. Key/Value secrets engine version 2
D. SSH secrets engine

Answer: A

NEW QUESTION # 69
How would you describe the value of using the Vault transit secrets engine?

A. The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault
B. Vault has an API that can be programmatically consumed by applications
C. Encryption for application data is best handled by a storage system or database engine, while storing encryption keys in Vault
D. The transit secrets engine ensures encryption in-transit and at-rest is enforced enterprise wide

Answer: A

NEW QUESTION # 70
Which of the following are replication methods available in Vault Enterprise? (Choose two.)

A. Disaster Recovery Replication
B. Performance Replication
C. Cluster sharding
D. Namespaces

Answer: A,B

NEW QUESTION # 71
Examine the command below. Output has been trimmed.

Which of the following statements describe the command and its output?

A. Configures the AppRole auth method with user specified role ID and secret ID
B. Generated token's TTL is 60 hours
C. Missing a default token policy
D. Generated token is an orphan token which can be renewed indefinitely

Answer: A

NEW QUESTION # 72
Your organization has an initiative to reduce and ultimately remove the use of long lived X.509 certificates. Which secrets engine will best support this use case?

A. PKI
B. Key/Value secrets engine version 2, with TTL defined
C. Cloud KMS
D. Transit

Answer: A

NEW QUESTION # 73
To create a non-root token with time-to-live (TTL) set to 30 minutes but with no max TTL which flag would you use?

A. -orphan
B. -explicit-max-ttl=0
C. None of the above
D. -ttl=30n

Answer: D

NEW QUESTION # 74
What environment variable overrides the CLI's default Vault server address?

A. VAULT_HTTP_ADDRESS
B. VAULT_ADDR
C. VAULT_ADDRESS
D. VAULT_HTTPS_ADDRESS

Answer: B

NEW QUESTION # 75
Use this screenshot to answer the question below:

When are you shown these options in the GUI?

A. Enabling authentication methods
B. Enabling authentication engines
C. Enabling policies
D. Enabling secret engines

Answer: D

NEW QUESTION # 76
What is true of Vault tokens? Choose TWO correct answers.

A. Vault tokens are also known as unseal keys
B. Vault tokens are required for every Vault call
C. Vault token IDs always begin with "s." such as s.E7rOurS2n7m2Dt5409jWxR87
D. Vault tokens are the core method for authentication in Vault
E. Vault tokens are generated by every authentication method login

Answer: D,E

NEW QUESTION # 77
Where does the Vault Agent store its cache?

A. In memory
B. In the Vault key/value store
C. In an unencrypted file
D. In a file encrypted using the Vault transit secret engine

Answer: A

NEW QUESTION # 78
Which path will this policy allow?
path "kv/+/team_*" {
capabilities = [ "read" ]
}

A. kv/us-west/team
B. kv/us-west/ca/team_edu
C. kv/us-west/team_edu
D. kv/team_edu

Answer: C

NEW QUESTION # 79
You have manually created some usernames and passwords for a Microsoft SQL database on Azure, and need to store these credentials in Vault. What secrets engine should you use for this?

A. Transit engine
B. Azure secrets engine
C. MSSQL database secrets engine
D. Key/Value secrets engine version 2

Answer: D

NEW QUESTION # 80
Which of the following vaultleaseoperations uses a lease_idas an argument? (Choose two.)

A. describe
B. revoke -prefix
C. create
D. revoke
E. renew

Answer: D,E

NEW QUESTION # 81
Vault Agent allows client-side caching of tokens and leases. If the agent is shut down, those tokens and leases cached will be revoked.