vault certification Intermediate Practice Exam: Medium Difficulty 2025

Your Vault cluster is deployed with Integrated Storage (Raft) across 5 nodes. After a network partition, some clients report intermittent failures when writing secrets, while reads sometimes succeed. Which action best addresses the likely root cause while aligning with Vault architecture best practices?

A team wants Kubernetes workloads to authenticate to Vault without storing long-lived credentials in pods. They also want each workload to get a distinct Vault identity based on its ServiceAccount. Which Vault auth method best fits this requirement?

You need to issue short-lived database credentials for an application. Security requires that credentials automatically expire and be revocable without changing the database users manually. Which approach best meets the requirement?

A platform team wants developers to be able to read secrets only under their own team path (e.g., secret/data/teams/<team-name>/*) and deny access to all other teams. They also want to avoid managing separate policies per user. What is the best Vault access control approach?

An application uses a periodic token to avoid forced re-authentication during long-running jobs, but security wants to ensure the token cannot be renewed indefinitely. Which configuration best achieves this?

Your security team wants to ensure that when a user leaves the company, all access granted through their login is revoked, including any child tokens created by applications using their token. Which token strategy best supports this requirement?

A security engineer wants to encrypt application data without letting applications access the encryption key material. The solution must support key rotation without re-encrypting all historical data immediately. Which Vault capability best fits?

A company uses OIDC to authenticate human users to Vault. They want admin access to be granted only to users in the IdP group "vault-admins" and audited centrally. What is the best approach in Vault?

You are writing a policy for an app that must read secrets from secret/data/payments/* (KV v2) but must not be able to list all keys under secret/metadata/payments/. Which policy capability set is most appropriate?

During an incident, Vault is sealed after a restart, and applications are failing because they cannot fetch dynamic database credentials. The team wants Vault to unseal automatically after future restarts while keeping encryption keys protected. Which operational change best meets this goal?