HCVA0-003 Free Practice Test

- (Topic 3)
You are considering using HCP Vault Dedicated but are concerned about differences between a hosted version and a self-hosted deployment. Which of the following statements is true about HCP Vault Dedicated?

1. A. HCP Vault Dedicated provides a similar experience to self-hosted Vault Enterprise because it uses the same Vault binary
2. B. HCP Vault Dedicated can be deployed on any cloud provider, including AWS, Azure, and Google Cloud, with full multi-cloud support
3. C. HCP Vault Dedicated requires different CLI commands and APIs compared to self- hosted Vault Enterprise
4. D. HCP Vault Dedicated is currently limited to a single region and cannot be deployed across multiple regions

Correct Answer: A

- (Topic 5)
The Vault encryption key is stored in Vault's backend storage.

1. A. True
2. B. False

Correct Answer: B

- (Topic 2)
A new Vault administrator is writing a CURL command (shown below) to retrieve a secret stored in a KV v2 secrets engine at secret/audio/soundbooth but is receiving an error. What could be the cause of the error?
$ curl
--header "X-Vault-Token: hvs.rffHw0iXqkRo19b2cjf93DM39WjpbN3J" https://vault.unlimited.com:8200/v1/secret/audio/soundbooth

1. A. The VAULT_ADDR environment variable wasn??t set, so it should be configured: export VAULT_ADDR="https://vault.unlimited.com:8200"
2. B. The request is being made on the incorrect endpoint and should be:$ curl \--header "X-Vault-Token: hvs.rffHw0iXqkRo19b2cjf93DM39WjpbN3J" \ https://vault.unlimited.com:8200/v1/secret/data/audio/soundbooth
3. C. The user??s token doesn??t permit access to the Vault API, only the UI
4. D. The endpoint should point to v2 since this is a KV v2 secrets engine:$ curl \--header "X-Vault-Token: hvs.rffHw0iXqkRo19b2cjf93DM39WjpbN3J" \ https://vault.unlimited.com:8200/v2/secret/audio/soundbooth

Correct Answer: B

- (Topic 4)
A security architect is designing a solution to address the "Secret Zero" problem for a Kubernetes-based application that needs to authenticate to HashiCorp Vault. Which approach correctly leverages Vault features to solve this challenge?

1. A. Store the Vault root token in a ConfigMap and mount it to all containers that require access to sensitive information
2. B. Generate a long-lived token during deployment and store it as an environment variable within each container that needs to access Vault
3. C. Configure the Kubernetes auth method in Vault and enable applications to authenticate without pre-shared secrets
4. D. Implement a custom sidecar container that uses AppRole role-id and secret-id each time the application needs to access Vault

Correct Answer: C

- (Topic 4)
Your organization has applications in a primary data center and a secondary warm-standby site. You want to configure Vault replication between the primary and secondary clusters. If the primary fails over to the secondary, the applications must interact with Vault without re- authenticating. What type of Vault replication would you use?

1. A. Performance Replication
2. B. Integrated Storage
3. C. Disaster Recovery Replication
4. D. Vault Secrets Operator

Correct Answer: C