Vault Associate Policies and Tokens Quiz

1. How can you view the policies attached to your current token?

Vault token lookup

Vault policy list

Vault auth list

Vault secrets list

2. What principle should guide policy design in Vault?

Grant maximum permissions to all users

Least privilege—grant only necessary permissions

All policies should be identical

Policies are optional for security

3. How can you revoke a token in Vault?

Vault token revoke

Vault revoke

Vault auth revoke

Tokens revoke automatically at expiration

4. In a Vault policy, what does the 'path' parameter specify?

The physical location of data on disk

The API endpoint or secret path the policy applies to

The network path to the Vault server

The backup location for secrets

5. What is the maximum TTL for a token?

1 hour

24 hours

Determined by the auth method and system configuration

Tokens have no maximum TTL

6. Which command creates a new policy in Vault?

Vault policy write

Vault policy create

Vault write policy

Vault policy new

7. What is the difference between a batch token and a service token?

Batch tokens are lightweight and cannot be renewed; service tokens can be renewed

Service tokens are for batch operations only

Batch tokens have higher privilege levels

There is no functional difference

8. In policy syntax, what does the wildcard '*' represent?

Any single character

Zero or more characters

All policies

All authentication methods

9. What happens when a token's TTL expires in Vault?

It is automatically renewed

It becomes invalid and cannot be used

It is moved to an archive

The user is notified but can continue working

10. Which of the following is a valid policy capability?

Execute

Create

Sudo

Admin

11. What is the primary purpose of policies in HashiCorp Vault?

To define and enforce access control rules for secrets and API endpoints

To encrypt all data stored in Vault

To monitor user activity and create audit logs

To manage network connectivity between Vault nodes

12. What is the purpose of token metadata?

To store encrypted secret values

To track and describe token information like policies and creation time

To enforce password policies

To manage network firewall rules

13. In a policy, what does the 'deny' capability do?

Prevents any access to the specified path

Restricts write operations only

Requires additional authentication

Logs all access attempts

14. What is the default TTL (Time To Live) for a token if not specified?

1 hour

24 hours

7 days

Determined by the authentication method or Vault configuration

15. How are tokens renewed in Vault?

Automatically every hour without user action

By calling the /auth/token/renew endpoint before expiration

By re-authenticating with the same credentials

Tokens cannot be renewed and must be recreated

16. What does the 'list' capability allow in a Vault policy?

Reading secret values

Viewing the keys at a path

Creating new secrets

Deleting policies

17. Which token type is generated when a user authenticates successfully?

Service token

Batch token

Client token

Renewal token

18. What is a root token in Vault?

A token with unrestricted access to all Vault resources

A token used only for encrypting data

A token that expires after one hour

A token generated for read-only access

19. In Vault policy syntax, what does the 'capabilities' parameter specify?

The maximum number of concurrent connections

The allowed actions on a path

The encryption algorithm used

The authentication method required

20. Which policy capability allows reading secret data?

Write

Read

List