HashiCorp HCVA0-003 Practice Exam Questions & Answers

Secrets engines are components that store, generate, or encrypt data in Vault. They are enabled at a specific path in Vault and have their own API and configuration. Some of the statements that describe the secrets engines in Vault are:

Some secrets engines simply store and read data, such as the key/value secrets engine, which acts like an encrypted Redis or Memcached. Other secrets engines perform more complex operations, such as generating dynamic credentials, encrypting data, issuing certificates, etc1.

You can build your own custom secrets engine by using the plugin system, which allows you to write and run your own secrets engine as a separate process that communicates with Vault over gRPC. You can also use the SDK to create your own secrets engine in Go and compile it into Vault2.

Each secrets engine is isolated to its path, which means that the secrets engine cannot access or interact with other secrets engines or data outside its path. The path where the secrets engine is enabled can be customized and can have multiple segments. For example, you can enable the AWS secrets engine at aws/ or aws/prod/ or aws/dev/3.

The statements that are not true about the secrets engines in Vault are:

You can disable an existing secrets engine by using the vault secrets disable command or the sys/mounts API endpoint. When a secrets engine is disabled, all of its secrets are revoked and all of its data is deleted from the storage backend4.

A secrets engine can be enabled at multiple paths, with a few exceptions, such as the system and identity secrets engines. Each secrets engine enabled at a different path is independent and isolated from others. For example, you can enable the KV secrets engine at kv/ and secret/ and they will not share any data3.

Comprehensive and Detailed in Depth Explanatio n:

A: Correctly contrasts self-managed (user responsibility) with HCP Vault (HashiCorp-managed). Correct.

B: Both support replication; false. Incorrect.

C: HCP Vault doesn't require manual upgrades. Incorrect.

D: Reverses responsibilities; false. Incorrect.

Overall Explanation from Vault Docs:

''HCP Vault Dedicated is operated by HashiCorp... Self-managed Vault requires users to handle setup, maintenance, and scaling.''

When looking at Vault token details, the policies key helps you find the paths the token is able to access. Policies are a declarative way to grant or forbid access to certain paths and operations in Vault. Policies are written in HCL or JSON and are attached to tokens by name. Policies are deny by default, so an empty policy grants no permission in the system. A token can have one or more policies associated with it, and the effective policy is the union of all the individual policies. You can view the token details by using the vault token lookup command or the auth/token/lookup API endpoint. The output will show the policies key with a list of policy names that are attached to the token. You can also view the contents of a policy by using the vault policy read command or the sys/policy API endpoint. The output will show the rules key with the HCL or JSON representation of the policy. The rules will specify the paths and the capabilities (such as create, read, update, delete, list, etc.) that the policy allows or denies. Reference: https://developer.hashicorp.com/vault/docs/concepts/policies4, https://developer.hashicorp.com/vault/docs/commands/token/lookup5, https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token6, https://developer.hashicorp.com/vault/docs/commands/policy/read7, https://developer.hashicorp.com/vault/api-docs/system/policy8

Comprehensive and Detailed in Depth Explanatio n:

A: All dynamic secrets (e.g., database creds) have leases for lifecycle management. Correct.

B: Incorrect; leases are mandatory for dynamic secrets.

Overall Explanation from Vault Docs:

''All dynamic secrets in Vault are required to have a lease... forcing consumers to check in routinely.''

Topic 2, Exam Pool B

Comprehensive and Detailed in Depth Explanatio n:

To restrict the values of a key/value pair to only 'true' or 'false' and prevent mistyping or capitalization errors, the allowed_parameters feature in a Vault policy is the most effective solution. The HashiCorp Vault documentation explains that allowed_parameters can be used to 'permit a list of keys and values that are permitted on the given path.' By specifying allowed_parameters with the exact values 'true' and 'false,' the policy ensures that only these values are accepted, rejecting any deviations (e.g., 'True,' 'TRUE,' or 'flase'). This provides fine-grained control and eliminates the risk of human error impacting the batch job.

Adding a deny statement for all possible misspellings is impractical and error-prone, as it requires anticipating every potential mistake, which is neither scalable nor efficient. The list capability allows listing and reading values but does not restrict what can be written, failing to address the problem of enforcing specific values. Using a wildcard (*) at the end of the policy permits unrestricted values, which directly contradicts the need to limit entries to 'true' or 'false.' Thus, allowed_parameters is the precise tool for this use case.

HashiCorp Vault Documentation - Policies: Fine-Grained Control

Comprehensive and Detailed In-Depth

Dynamic secrets are managed actively:

A . True: 'Once the lease for a dynamic secret has expired, Vault automatically revokes the credentials on the backend platform for which they were created.' This cleanup reduces technical debt.

Incorrect Option:

B . False: Incorrect; revocation is automatic.

'When a lease expires, Vault does indeed revoke the credentials on the platform.'

Comprehensive and Detailed In-Depth

Vault allows key export under specific conditions:

A . Yes, if Exportable: 'When creating the key, the exportable flag must be set as true. By default, it is false.' If set, 'this enables the keys to be exportable,' allowing retrieval for external storage. 'Once set, this cannot be disabled.'

Incorrect Option:

B . No: Incorrect if the key is exportable. 'You cannot export the encryption key from Vault if it was not configured to be exportable.'

This feature, while not best practice, supports disaster recovery scenarios.