Comprehensive and Detailed In-Depth Explanation:

Vault supports several token types, each with distinct characteristics:

B. Batch token : " Batch tokens are encrypted binary large objects (blobs) that carry just enough information for authentication. " They are lightweight and non-renewable.

C. Orphan service token : " Orphan tokens are not children of their parent; therefore, do not expire when their parent does. " A valid subtype of service tokens.

D. Service token : " Service token is the general token that most people talk about when referring to a token in Vault. " The standard token type.

E. Root token : " Root tokens are the most powerful tokens in Vault and have full control. " Created during initialization.

F. Periodic service token : " Periodic service tokens have a TTL, but no max TTL, " renewing automatically for long-running tasks.

Incorrect Option :

A. Primary token : " Not a valid token type in Vault. " No such term exists in Vault’s documentation.

These token types cater to various use cases, from ephemeral to privileged access.

Comprehensive and Detailed In-Depth Explanation:

Vault offers secrets engines for encryption:

A. transit : " Designed specifically for encryption and decryption operations, " ideal for securing data at rest.

B. KMIP : " Integrates with external Key Management Systems that support the KMIP protocol, " enabling encryption via external keys.

D. transform : " Used for data transformation operations, including encryption and decryption, " with custom pipelines.

Incorrect Option :

C. SSH : " Used for dynamic SSH key generation and management, " not general data encryption.

" Only the Transit and Transform secrets engines can encrypt/decrypt data, " with KMIP adding external key support.

Comprehensive and Detailed In-Depth Explanation:

In HashiCorp Vault, operators can create two distinct types of groups within the Identity secrets engine: external groups and internal groups . These groups are used to manage and organize users and policies, facilitating access control and permissions management.

External Groups : These groups are designed to integrate with external identity providers or systems, such as LDAP or OIDC (OpenID Connect). External groups allow Vault to map groups from these external systems to Vault policies, enabling seamless access control for users authenticated via external auth methods. They can be created manually or automatically mapped (e.g., from LDAP group memberships to Vault policies). This is particularly useful when managing users who exist outside of Vault’s internal identity store but need access to Vault resources. The documentation states: " External groups are usually associated with an auth method, such as LDAP or OIDC. "

Internal Groups : These are created and managed directly within Vault’s identity store. Internal groups are used to organize Vault entities (representing users or machines) and assign policies to them manually. They are ideal for scenarios where user management is entirely within Vault’s ecosystem, without reliance on external identity providers. The documentation explains: " Internal groups are created in the identity store and map to other groups or entities. "

Incorrect Options :

Security Groups : This term is not used in Vault’s context for group types. While security is a core concern, " security groups " do not represent a specific category of groups in Vault.

Policy Groups : Policies in Vault define permissions, but there is no concept of " policy groups " as a distinct group type. Policies are attached to groups, not grouped themselves in this manner.

The distinction between external and internal groups enhances flexibility in managing authentication and authorization, aligning with Vault’s design to support both internal and federated identity systems.

Comprehensive and Detailed In-Depth Explanation:

In HashiCorp Vault, the default TTL (Time To Live) for tokens, when not explicitly specified, is 768 hours , equivalent to 32 days . This applies to both the initial TTL and the maximum TTL unless overridden.

Default Configuration : The documentation states: " When no specific TTL is provided, a generated token will inherit the default TTL which is 768 hours (32 days). " This long default ensures usability in many scenarios while allowing customization.

Customization Option : Operators can adjust this using commands like vault write sys/mounts/auth/token/tune default_lease_ttl=1h max_lease_ttl=24h, but without such tuning, 768 hours applies.

Incorrect Options :

A. 24 hours : Too short for Vault’s default; it’s a common custom setting instead.

B. 15 minutes : Far too brief and not aligned with Vault’s defaults.

D. 60 minutes : Another common custom value, not the default.

This default balances usability with security, encouraging explicit configuration for shorter-lived tokens when needed.

Comprehensive and Detailed In-Depth Explanation:

A lease ID in Vault identifies a lease associated with dynamic secrets, allowing specific management actions:

A. Renew the lease : " Using the lease ID, the lease can be renewed up until the maximum TTL, " extending its duration without altering other properties.

B. Revoke the lease : " It is possible to revoke the lease, which immediately invalidates the lease and any associated resources. " This terminates the lease instantly.

Incorrect Options :

C. Extend the max TTL : Requires configuration changes beyond the lease ID. " This operation typically involves modifying the configuration. "

D. Authenticate : Lease IDs are for lease management, not authentication. " The lease ID does not have any direct relationship to authentication processes. "

Lease IDs enable precise control over dynamic secret lifecycles.

Comprehensive and Detailed In-Depth Explanation:

To ensure consistent access permissions for Sarah across multiple authentication methods (LDAP and GitHub), the correct approach in Vault is to create an entity for Sarah and map both her LDAP and GitHub identities as entity aliases to this single entity .

Entities and Aliases in Vault : Vault’s Identity secrets engine allows the creation of entities, which are logical representations of users or machines. Each entity can have multiple aliases, where an alias corresponds to an identity from a specific auth method. By mapping Sarah’s LDAP identity (e.g., her LDAP username) and GitHub identity (e.g., her GitHub username) as aliases to a single entity, Vault associates both identities with one set of policies. The documentation states: " Vault clients can be mapped as entities and their corresponding accounts with authentication providers can be mapped as aliases. "

Why This Works : Assigning policies to the entity ensures that Sarah’s permissions remain consistent regardless of whether she logs in via LDAP or GitHub. This centralizes policy management and eliminates discrepancies.

Incorrect Options :

B. External Group Approach : Creating an external group and adding LDAP and GitHub providers as members does not inherently synchronize permissions for a single user like Sarah. External groups are better suited for mapping group memberships from external systems to Vault policies, not individual identity unification.

C. Separate Policies : Managing separate policies per auth method is error-prone and inefficient. Manual synchronization risks inconsistencies, undermining security and manageability.

D. Trust Relationship : Vault does not support configuring trust relationships between auth methods like LDAP and GitHub to sync accounts. This is a misunderstanding of Vault’s architecture.

This entity-based approach leverages Vault’s identity system to unify Sarah’s access, simplifying administration and ensuring consistency.

The Google Cloud secrets engine is the correct choice because it is designed to manage GCP credentials and can generate access credentials for Google Cloud workloads. In this scenario, the VMs need OAuth tokens for GCP services during IaC provisioning. The Identity secrets engine manages Vault identities and aliases, not GCP OAuth credentials. KV v2 stores static secrets and versions them, but it does not dynamically generate GCP access tokens. The SSH secrets engine is for SSH credential workflows, not Google Cloud API access. The Google Cloud secrets engine supports access-token workflows and service-account based credential management for GCP resources, making it the only option that matches the requirement for GCP OAuth access during provisioning. HashiCorp documents GCP access-token behavior under the Google Cloud secrets engine.

Comprehensive and Detailed In-Depth Explanation:

The vault policy list command displays all policies in Vault. The output lists five policies: " base " , " default " , " root " , " web-app-1 " , and " automation-team " . However, " root " and " default " are built-in policies:

Built-in Policies :

" root " : A superuser policy created by default.

" default " : Provides common permissions, also default. " Vault has two default policies, root and default. "

Added Policies :

" base " , " web-app-1 " , " automation-team " are not built-in, meaning they were added. Thus, 3 policies were added.

Incorrect Options :

B. 4 : Overcounts by including one built-in.

C. 1, D. 2 : Undercounts the added policies.

The payload.json file that has the correct contents is C. This file contains a JSON object with a single key, “plaintext”, and a value that is the base64-encoded string of the data to be encrypted.  This is the format that the Vault API expects for the transit encrypt endpoint 1 . The other files are not correct because they either have the wrong key name, the wrong value format, or the wrong JSON syntax.

The statement is false. A root token can create orphan tokens, but it is not the only possible method. Vault’s token API includes the /auth/token/create-orphan endpoint, and HashiCorp explicitly notes that a root token is not required when using that endpoint. The no_parent option is restricted and normally requires root or sudo-level authority, but the existence of a non-root orphan-token creation path makes the absolute statement incorrect. This is a common Vault exam trap: root tokens are highly privileged, but Vault also allows controlled delegation through specific endpoints and capabilities. Therefore, saying orphan tokens can only be created with the root token is too strict and inaccurate. The correct exam answer is False.

================