When looking at Vault token details, the policies key helps you find the paths the token is able to access. Policies are a declarative way to grant or forbid access to certain paths and operations in Vault. Policies are written in HCL or JSON and are attached to tokens by name. Policies are deny by default, so an empty policy grants no permission in the system. A token can have one or more policies associated with it, and the effective policy is the union of all the individual policies. You can view the token details by using the vault token lookup command or the auth/token/lookup API endpoint. The output will show the policies key with a list of policy names that are attached to the token. You can also view the contents of a policy by using the vault policy read command or the sys/policy API endpoint. The output will show the rules key with the HCL or JSON representation of the policy.  The rules will specify the paths and the capabilities (such as create, read, update, delete, list, etc.) that the policy allows or denies. References: https://developer.hashicorp.com/vault/docs/concepts/policies 4 , https://developer.hashicorp.com/vault/docs/commands/token/lookup 5 , https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token 6 , https://developer.hashicorp.com/vault/docs/commands/policy/read 7 , https://developer.hashicorp.com/vault/api-docs/system/policy 8

The statement is true. When an auth method is disabled, all users authenticated via that method lose access. This is because the tokens issued by the auth method are automatically revoked when the auth method is disabled. This prevents the users from performing any operation in Vault using the revoked tokens. To regain access, the users have to authenticate again using a different auth method that is enabled and has the appropriate policies attached. References:  Auth Methods | Vault | HashiCorp Developer ,  auth disable - Command | Vault | HashiCorp Developer

The Transit secrets engine supports different key types, and the parameter used to define the cryptographic algorithm for a new key is type. For AES encryption, Vault supports AES-GCM key types such as aes256-gcm96, which is also the default Transit key type. The name identifies the key, but it does not determine whether the key uses AES. The exportable parameter controls whether key material can be exported, which is unrelated to selecting AES. The convergent_encryption setting changes encryption behavior so the same plaintext can produce the same ciphertext under specific conditions, but it does not select the algorithm. Therefore, to meet an AES requirement when creating a Transit key, the correct parameter is type.

================

Vault’s cryptographic barrier protects data before it is written to the storage backend. The correct answer is the encryption key, because Vault encrypts protected data before storing it. PGP keys are not used as Vault’s normal internal storage encryption mechanism. PKI certificates are used for certificate issuance and TLS-related workflows, not for encrypting Vault’s internal storage data. A long-lived token is an authentication credential and does not encrypt Vault storage data. The exam wording is testing Vault’s internal security model: the storage backend is treated as untrusted, and Vault encrypts data before it leaves the barrier. HashiCorp’s security model documentation states that the security barrier encrypts data leaving Vault before it reaches the backend.

================

The statement is false. Least privilege means granting only the minimum capabilities required for a user, application, or machine to perform its intended task. Starting with broad access and removing permissions later is the opposite of least privilege because it exposes Vault paths and operations unnecessarily during the period before permissions are corrected. Vault policies are deny by default, so an empty policy grants no access. Administrators should build policies by adding precise capabilities such as read, create, update, delete, or list only for the specific paths required. This is especially important in Vault because policies directly control access to secrets, auth methods, system endpoints, and administrative functions. HashiCorp’s policy documentation confirms that Vault policies are declarative and deny by default.

These three policies separate Transit engine duties by endpoint. The app.hcl policy allows use of transit/encrypt/my_app_key, so an application can encrypt data. The callcenter.hcl policy allows transit/decrypt/my_app_key, so a different group can decrypt data. The rewrap.hcl policy allows reading key metadata and using the rewrap endpoint, so encrypted data can be upgraded after key rotation without exposing plaintext. This is not one combined policy; it is a separation-of-duties design. It also does not create a Transit key, because key creation would require access to the appropriate key-management endpoint, not just encrypt, decrypt, read, and rewrap paths. HashiCorp documents Transit as cryptography as a service and confirms that policies can restrict specific Transit operations by endpoint.

================

An authentication method should be selected for a use case based on the auth method that best establishes the identity of the client. The identity of the client is the basis for assigning a set of policies and permissions to the client in Vault. Different auth methods have different ways of verifying the identity of the client, such as using passwords, tokens, certificates, cloud credentials, etc. Depending on the use case, some auth methods may be more suitable or convenient than others. For example, for human users, the userpass or ldap auth methods may be easy to use, while for machines or applications, the approle or aws auth methods may be more secure and scalable. The choice of the auth method should also consider the trade-offs between security, performance, and usability. References:  Auth Methods | Vault | HashiCorp Developer ,  Authentication - Concepts | Vault | HashiCorp Developer

The statement is true. HCP Vault Dedicated uses namespaces, and the customer-accessible top-level namespace is admin. This is a critical operational difference from many self-managed Vault examples, where commands often assume the root namespace. In HCP Vault Dedicated, requests must target the admin namespace, either by setting the namespace in the CLI, passing the X-Vault-Namespace: admin API header, or using admin in the API path. If the namespace is omitted, requests may be sent to the root namespace, which is reserved for platform operations and not accessible to the customer. HashiCorp’s HCP Vault Dedicated documentation states that the top-level namespace is admin and that HCP clusters include the admin namespace by default.

================

Not all storage backends support high availability mode for Vault. Only the storage backends that support locking can enable Vault to run in a multi-server mode where one server is active and the others are standby. Some examples of storage backends that support high availability mode are Consul, Integrated Storage, and ZooKeeper.  Some examples of storage backends that do not support high availability mode are Filesystem, MySQL, and PostgreSQL.  References: https://developer.hashicorp.com/vault/docs/concepts/ha 1 , https://developer.hashicorp.com/vault/docs/configuration/storage 2

Integrated Storage is a Raft-based storage backend that allows Vault to store its data internally without relying on an external storage system. It also enables Vault to run in high availability mode with automatic leader election and failover. However, Integrated Storage is not immune to data loss or corruption due to hardware failures, network partitions, or human errors. Therefore, it is recommended to use the snapshot feature to backup and restore the Vault data periodically or on demand. A snapshot is a point-in-time capture of the entire Vault data, including the encrypted secrets, the configuration, and the metadata. Snapshots can be taken and restored using the vault operator raft snapshot command or the sys/storage/raft/snapshot API endpoint. Snapshots are encrypted and can only be restored with a quorum of unseal keys or recovery keys.  Snapshots are also portable and can be used to migrate data between different Vault clusters or storage backends. References: https://developer.hashicorp.com/vault/docs/concepts/integrated-storage 1 , https://developer.hashicorp.com/vault/docs/commands/operator/raft/snapshot 2 , https://developer.hashicorp.com/vault/api-docs/system/storage/raft/snapshot 3