Vault Associate Dynamic Secrets Quiz

1. What is a root token's relationship to dynamic secrets in Vault?

It is required to retrieve all dynamic secrets

It cannot be used to access dynamic secrets

It has unlimited access but should be used sparingly for security

It automatically rotates dynamic secrets

2. What is the primary security benefit of using Vault's dynamic secrets over hardcoded credentials?

They eliminate the need for encryption

They reduce exposure by automatically expiring and rotating credentials

They are stored in plain text for easier access

They require no authentication to retrieve

3. Which Vault API endpoint would you use to read a dynamic secret from the database engine?

/auth/database/login

/database/creds/role-name

/secret/database/creds

/transit/encrypt

4. In Vault's database secret engine, what is the purpose of a static role?

To store pre-created database users and rotate passwords

To define role-based access control in Vault

To encrypt database connections

To manage replication between databases

5. The vault read command for a dynamic secret returns which information?

Only the secret value

The secret value and metadata including lease ID and TTL

Only lease expiration time

Only the secret engine configuration

6. For the MongoDB secret engine, which authentication method is typically used?

SSH key-based authentication

Username and password or client certificate

Token-based authentication only

API key authentication

7. What is lease revocation in Vault?

Renewing a secret before expiration

Immediately invalidating a secret and cleaning up resources

Archiving old secrets for compliance

Changing a secret's TTL value

8. The Vault PKI secret engine is primarily used for which purpose?

Generating and managing SSL/TLS certificates

Storing static encryption keys

Managing SSH access controls

Encrypting database connections

9. In Vault, what does the max_ttl parameter control for a secret?

The initial validity period of the secret

The maximum renewal period allowed

The frequency of credential rotation

The number of simultaneous users

10. When configuring a database secret engine, the connection URL must include which components?

Hostname, port, and database name

Only the hostname and port

Username, password, and encryption key

Vault token and audit log path

11. What is the primary advantage of dynamic secrets compared to static secrets in Vault?

They are cheaper to store

They are automatically generated and rotated on-demand

They require less encryption overhead

They eliminate the need for authentication

12. Which AWS secret engine capability allows Vault to generate temporary AWS credentials?

Static key storage

STS AssumeRole for dynamic credential generation

IAM policy caching

EC2 instance profiling

13. In the context of dynamic secrets, what does credential rotation accomplish?

It changes the secret automatically at specified intervals

It logs all secret access attempts

It encrypts secrets before storage

It replicates secrets across multiple nodes

14. What is the purpose of the SSH secret engine in Vault?

To encrypt SSH keys in transit

To generate dynamic SSH credentials or sign SSH certificates

To manage SSH server configurations

To replace traditional SSH authentication entirely

15. Which command would you use to renew a secret lease before it expires?

Vault read

Vault write

Vault lease renew

Vault secret extend

16. In Vault's database secret engine, what is a role?

A set of permissions for a user

A template that defines how credentials are generated

A backup of database credentials

A logging mechanism for audits

17. The PostgreSQL secret engine requires which of the following to function?

A valid Vault token only

Connection details and database credentials

SSH access to the database server

Pre-created database users

18. What does TTL (Time To Live) determine in Vault's lease system?

How long a secret remains valid before expiration

The number of times a secret can be used

The encryption strength of the secret

The storage capacity for secrets

19. In Vault, a lease is the contract between Vault and a client for a secret. What happens when a lease expires?

The secret is automatically revoked

The client must request a new secret

Both A and B are correct

The secret remains valid indefinitely

20. Which secret engine in Vault is used to dynamically generate database credentials?

KV secret engine

SSH secret engine

Database secret engine

Transit secret engine