NO.36 Which of the following are valid types of tokens available in Vault? (Select five)

NO.37 * A Jenkins server is using the following token to access Vault. Based on the lookup shown below, what type of token is this?$ vault token lookup hvs.FGP1A77Hxa1Sp6Pkp1yURcZB
* Key Value
* — —–
* accessor RnH8jtgrxBrYanizlyJ7Y8R
* creation_time 1604604512
* creation_ttl 24h
* display_name token
* entity_id n/a
* expire_time 2025-11-06T14:28:32.8891566-05:00
* explicit_max_ttl 0s
* id hvs.FGP1A77Hxa1Sp6KRau5eNB
* issue_time 2025-11-06T14:28:32.8891566-05:00
* meta <nil>
* num_uses 0
* orphan false
* path auth/token/create
* period 24h
* policies [admin default]
* renewable true
* ttl 23h59m50s
* type service

NO.38 You have multiple Kubernetes pods that need frequent access to Vault to retrieve credentials for establishing connectivity to a backend database. You enable the Kubernetes auth method in Vault. What resource do you need to create within Kubernetes to complete this configuration?

NO.39 Which core component of Vault can store, generate, or encrypt data for organizations?

NO.40 From the options below, select the benefits of using the PKI (x.509 certificates) secrets engine (select three):

NO.41 To protect the sensitive data stored in Vault, what key is used to encrypt the data before it is written to the storage backend?

NO.42 A large organization uses Vault for various use cases with multiple auth methods enabled. A user can authenticate via LDAP, OIDC, or a local userpass account, but they receive different policies for each method and often need to log out and back in for different actions. What can be configured in Vault to ensure users have consistent policies regardless of their authentication method?

NO.43 True or False? The userpass auth method has the ability to access external services in order to provide authentication to Vault.

NO.44 Which of the following is true about the token authentication method in Vault? (Select three)

NO.45 When using the Vault Secrets Operator, where is the secret written to after being retrieved from Vault?

NO.46 After a client has authenticated to Vault, what security feature is used to make all subsequent calls?

NO.47 Which of the following auth methods are intended for machine-to-machine authentication, and not necessarily human (operator) authentication? (Select four)

NO.48 True or False? Although AppRole is designed for machines, humans can use it to authenticate to Vault if you wish.

NO.49 Thomas has authenticated to Vault using the API and has received the following response. What data must Thomas parse from the response in order to continue making requests to Vault?
text
CollapseWrapCopy
{
“request_id”: “65897160-fd8b-1f87-c24e-fdba14c9728e”,
“lease_id”: “”,
“renewable”: false,
“lease_duration”: 0,
“data”: null,
“wrap_info”: null,
“warnings”: null,
“auth”: {
“client_token”: “hvss.lzrmRe5Y3LMcDRmOttEjWoagd92fD29fxakwej_38djs”,
“accessor”: “EMX0nv4nr0Y1wXoaN7i0WDW1”,
“policies”: [“bryan”, “default”],
“token_policies”: [“bryan”, “default”],
“metadata”: {“username”: “bryan”},
“lease_duration”: 2764800,
“renewable”: true,
“entity_id”: “40e203e8-818e-b6ad-4cb3-0befdbf9b598”,
“token_type”: “service”,
“orphan”: true
}
}

NO.50 As a best practice, the root token should be stored in which of the following ways?

NO.51 What API endpoint is used to enable and configure a secrets engine?

NO.52 Which of the following are benefits of using the Vault Secrets Operator (VSO)? (Select three)

NO.53 What of the following features are true about batch tokens in Vault? (Select two)

NO.54 What does the following policy do?

NO.55 What is the proper command to enable the AWS secrets engine at the default path?

NO.56 True or False? Once the minimum decryption version is set on an encryption key, older versions of the key are removed from Vault and are no longer available for decryption operations.

NO.57 You are configuring your application to retrieve a new PKI certificate upon provisioning. The Vault admins have given you an AppRole role-id and secret-id to inject into the CI/CD pipeline job that provisions your app. The application uses the credentials to successfully authenticate to Vault using the API. Which of the following is true about the step next required after authenticating to Vault?

NO.58 After issuing the command to delete a secret, you run a vault kv list command, but the path to the secret still seems to exist. What command would permanently delete the path from Vault?

NO.59 Over a few years, you have a lot of data that has been encrypted by older versions of a Transit encryption key.
Due to compliance regulations, you have to re-encrypt the data using the newest version of the encryption key. What is the easiest way to complete this task without putting the data at risk?