HCVA0-003 Free Practice Test

- (Topic 4)
A MySQL server has been deployed on Google Cloud Platform (GCP) to support a legacy application. You want to generate dynamic credentials against this MySQL server rather than use static credentials. What Vault secrets engine would you use to accomplish this?

1. A. The GCP secrets engine
2. B. The Identity secrets engine
3. C. The database secrets engine
4. D. The Cubbyhole secrets engine

Correct Answer: C

- (Topic 4)
There are a few ways in Vault that can be used to obtain a root token. Select the valid methods from the answers below. (Select three)

1. A. Generating a root token using a quorum of recovery keys when using Vault auto unseal
2. B. Initializing Vault when first creating the cluster by using vault operator init
3. C. Using a batch DR operation token to create a new root token in the event of an emergency
4. D. Running the command vault token create when using a valid root token

Correct Answer: ABD

- (Topic 5)
Which of the following are replication methods available in Vault Enterprise? Choose two correct answers.

1. A. Cluster sharding
2. B. Namespaces
3. C. Performance Replication
4. D. Disaster Recovery Replication

Correct Answer: CD

- (Topic 1)
Which of the following is NOT a valid way in which a lease can be revoked in Vault?

1. A. Using the user interface (UI)
2. B. Automatically when the TTL or Max-TTL expires
3. C. Using the API to call the /v1/sys/leases endpoint
4. D. Via the CLI using the vault token command

Correct Answer: D

- (Topic 1)
In regards to the Transit secrets engine, which of the following is true given the following command and output (select three):
$ vault write encryption/encrypt/creditcard plaintext=$(base64 <<< "1234 5678 9101 1121") Key: ciphertext Value:
vault:v3:cZNHVx+sxdMErXRSuDa1q/pz49fXTn1PScKfhf+PIZPvy8xKfkytpwKcbC0fF2U=

1. A. The Transit secrets engine is mounted at the encryption path
2. B. The name of the keyring used to encrypt the data is creditcard
3. C. There are at least three data keys associated with this keyring
4. D. The data was written to the encryption path, which is provided by default when enabling the Transit secrets engine

Correct Answer: ABC