[Aug 06, 2023] Ultimate VA-002-P Guide to Prepare Free Latest HashiCorp Practice Tests Dumps
Get Top-Rated HashiCorp VA-002-P Exam Dumps Now
NEW QUESTION # 11
Select all Operating Systems that Terraform is available for. (select five)
- A. macOS
- B. Solaris
- C. FreeBSD
- D. Windows
- E. Unix
- F. Linux
Answer: A,B,C,D,F
Explanation:
Terraform is available for macOS, FreeBSD, OpenBSD, Linux, Solaris, Windows
https://www.terraform.io/downloads.html
NEW QUESTION # 12
Which of the following best describes the default local backend?
- A. The local backend is where Terraform Enterprise stores logs to be processed by a log collector
- B. The local backend is the directory where resources deployed by Terraform have direct access to in order to update their current state
- C. The local backend is how Terraform connects to public cloud services, such as AWS, Azure, or GCP.
- D. The local backend stores state on the local filesystem locks the state using system APIs and performs operations locally.
Answer: D
Explanation:
Information on the default local backend can be found at this link.
Example:
terraform {
backend "local" {
path = "relative/path/to/terraform.tfstate"
}
}
NEW QUESTION # 13
Terraform has detailed logs which can be enabled by setting the _________ environmental variable.
- A. TF_LOG
- B. TF_DEBUG
- C. TF_INFO
- D. TF_TRACE
Answer: A
Explanation:
Terraform has detailed logs that can be enabled by setting the TF_LOG environment variable to any value. This will cause detailed logs to appear on stderr.
You can set TF_LOG to one of the log levels TRACE, DEBUG, INFO, WARN, or ERROR to change the verbosity of the logs. TRACE is the most verbose and it is the default if TF_LOG is set to something other than a log level name.
https://www.terraform.io/docs/internals/debugging.html
NEW QUESTION # 14
By default, the max TTL for a token is how many days?
- A. 31 days
- B. 7 days
- C. 32 days
- D. 14 days
Answer: C
Explanation:
The system max TTL, which is 32 days but can be changed in Vault's configuration file.
The max TTL set on a mount using mount tuning. This value is allowed to override the system max TTL -- it can be longer or shorter, and if set this value will be respected.
A value suggested by the auth method that issued the token. This might be configured on a per-role, per-group, or per-user basis. This value is allowed to be less than the mount max TTL (or, if not set, the system max TTL), but it is not allowed to be longer.
Reference link:- https://www.vaultproject.io/docs/concepts/tokens
NEW QUESTION # 15
In order to reduce the time it takes to provision resources, Terraform uses parallelism. By default, how many resources will Terraform provision concurrently?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Terraform can limit the number of concurrent operations as Terraform walks the graph using the -parallelism=n argument. The default value for this setting is 10. This setting might be helpful if you're running into API rate limits.
NEW QUESTION # 16
Which two characters can be used when writing a policy to reflect a wildcard or path segment? (select two)
- A. $
- B. @
- C. +
- D. *
- E. &
Answer: C,D
Explanation:
The splat (*) can be used as a wildcard but can only be used at the very end of a path.
The plus sign (+) can be used in the middle of a path to denote a path segment.
NEW QUESTION # 17
As opposed to service tokens, batch tokens are ideal for what type of action?
- A. configuring Vault features
- B. generating dynamic credentials
- C. issuing snapshots
- D. encrypting data
- E. renewing tokens
- F. writing secrets
Answer: D
Explanation:
Batch tokens are generally used for encrypting data because they are lightweight and scalable and also include enough information to use with Vault.
NEW QUESTION # 18
An application is trying to use a secret in which the lease has expired. What can be done in order for the application to successfully request data from Vault?
- A. request a new secret and associated lease
- B. perform a lease renewal
- C. request the TTL be extended for the secret
- D. try the expired secret in hopes it hasn't been deleted yet
Answer: A
Explanation:
A lease must be renewed before it has expired. Once it has expired, it is permanently revoked and a new secret must be requested.
NEW QUESTION # 19
Which Terraform command will force a marked resource to be destroyed and recreated on the next apply?
- A. terraform destroy
- B. terraform fmt
- C. terraform refresh
- D. terraform taint
Answer: D
Explanation:
The terraform taint command manually marks a Terraform-managed resource as tainted, forcing it to be destroyed and recreated on the next apply. This command will not modify infrastructure but does modify the state file in order to mark a resource as tainted. Once a resource is marked as tainted, the next plan will show that the resource will be destroyed and recreated. The next terraform apply will implement this change.
NEW QUESTION # 20
From the unseal options listed below, select the options you can use if you're deploying Vault on-premises. (select four)
- A. certificates
- B. key shards
- C. transit
- D. HSM PKCS11
- E. AWS KMS
Answer: B,C,D,E
Explanation:
Certificates are not a valid unseal option for HashiCorp Vault.
NEW QUESTION # 21
After executing a terraform apply, you notice that a resource has a tilde (~) next to it. What does this infer?
- A. the resource will be updated in place
- B. the resource will be destroyed and recreated
- C. Terraform can't determine how to proceed due to a problem with the state file
- D. the resource will be created
Answer: A
Explanation:
The prefix -/+ means that Terraform will destroy and recreate the resource, rather than updating it in-place. Some attributes and resources can be updated in-place and are shown with the ~ prefix.
NEW QUESTION # 22
What is the result of the following Vault command?
vault auth enable userpass
- A. Enables Vault to use external services to authenticate clients to Vault
- B. allows Vault to access usernames and passwords stored in a second Vault cluster
- C. Imports usernames and passwords from LDAP to the local database
- D. mounts the userpass auth method to the default path
Answer: D
Explanation:
The auth enable command enables an auth method at a given path. If an auth method already exists at the given path, an error is returned.
Command to enable auth method vault auth <enable/disable> followed by the name of the auth method.
Additional parameters can be included to specify the name of the mount.
NEW QUESTION # 23
What Terraform command can be used to inspect the current state file?
- A. terraform inspect
- B. terraform read
- C. terraform show
- D. terraform state
Answer: C
Explanation:
The terraform show command is used to provide human-readable output from a state or plan file. This can be used to inspect a plan to ensure that the planned operations are expected, or to inspect the current state as Terraform sees it.
Machine-readable output can be generated by adding the -json command-line flag.
Note: When using the -json command-line flag, any sensitive values in Terraform state will be displayed in plain text.
NEW QUESTION # 24
What does the command terraform fmt do?
- A. updates the font of the configuration file to the official font supported by HashiCorp
- B. rewrite Terraform configuration files to a canonical format and style
- C. formats the state file in order to ensure the latest state of resources can be obtained
- D. deletes the existing configuration file
Answer: B
Explanation:
The terraform fmt command is used to rewrite Terraform configuration files to a canonical format and style. This command applies a subset of the Terraform language style conventions, along with other minor adjustments for readability.
Other Terraform commands that generate Terraform configuration will produce configuration files that conform to the style imposed by terraform fmt, so using this style in your own files will ensure consistency.
NEW QUESTION # 25
What happens when a terraform apply command is executed?
- A. applies the changes required in the target infrastructure in order to reach the desired configuration
- B. the backend is initialized and the working directory is prepped
- C. creates the execution plan for the deployment of resources
- D. reconciles the state Terraform knows about with the real-world infrastructure
Answer: A
Explanation:
The terraform apply command is used to apply the changes required to reach the desired state of the configuration, or the pre-determined set of actions generated by a terraform plan execution plan.
NEW QUESTION # 26
Vault policies are deny by default
- A. TRUE
- B. FALSE
Answer: A
Explanation:
Everything in Vault is path-based including policies. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault.
Policies are deny by default, so an empty policy grants no permission in the system.
NEW QUESTION # 27
A user has logged into the Vault user interface but cannot browse to a secret located at kv/applications/app3, however, the policy the user is bound by permits read permission to the secret.
Because of the read permission, the user should be able to read the secret in the Vault UI.
- A. False
- B. True
Answer: A
Explanation:
To browse Vault paths in the UI, the user must have list permissions on the mount and the paths leading up to the secret.
NEW QUESTION # 28
When administering Vault on a day-to-day basis, why is logging in with the root token, as shown below, a bad idea? (select two).
- A. the root token isn't a secure way of logging into Vault
- B. the root token should be revoked and not used on a day-to-day basis
- C. It's easier to just use the root token than to configure additional auth methods
- D. the root token is attached to the root policy, which likely provides too many privileges to a user
Answer: B,D
Explanation:
The root token should never be used on a day-to-day basis and should always be revoked once a permanent auth method has been configured.
NEW QUESTION # 29
Which of the following Vault policies will allow a Vault client to read a secret stored at secrets/applications/app01/api_key?
- A. path "secrets/applications/app01/api_key" {
capabilities = ["update", "list"]
} - B. path "secrets/applications/+/api_*" {
capabilities = ["read"]
} - C. path "secrets/*" {
capabilities = ["list"]
} - D. path "secrets/applications/" {
capabilities = ["read"]
allowed_parameters = {
"certificate" = []
}
}
Answer: B
Explanation:
Wildcards and path segments can be used to allow access to a broader set of secrets rather than having to call out each individual secret itself. None of the other policies will allow a client to actually read the data stored at the path secrets/applications/app01/api_key
NEW QUESTION # 30
When multiple engineers start deploying infrastructure using the same state file, what is a feature of remote state storage that is critical to ensure the state does not become corrupt?
- A. object storage
- B. workspaces
- C. encryption
- D. state locking
Answer: D
Explanation:
If supported by your backend, Terraform will lock your state for all operations that could write state. This prevents others from acquiring the lock and potentially corrupting your state.
State locking happens automatically on all operations that could write state. You won't see any message that it is happening. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the -lock flag but it is not recommended.
NEW QUESTION # 31
Which of the following secrets engine can generate dynamic credentials? (select three)
- A. Azure
- B. Transit
- C. key/value
- D. database
- E. AWS
Answer: A,D,E
Explanation:
Vault has many secrets engines that can generate dynamic credentials, including AWS, Azure, and database secrets engines. The key/value secret engine is used to store data, and the transit secret engine is used to encrypt data.
NEW QUESTION # 32
What are the primary benefits of running Vault in a production deployment over dev server mode? (select two)
- A. persistent storage
- B. ability to enable auth methods
- C. faster deployment
- D. access to all of the secret engines
- E. encryption via TLS
Answer: A,E
Explanation:
Dev server mode stores its data in memory, therefore if the Vault service is shut down, any data stored will be lost. Additionally, dev server mode does not use TLS, and all data is sent in cleartext.
NEW QUESTION # 33
Vault secrets engines are used to do what with data? (select three)
- A. store
- B. copy
- C. encrypt
- D. transmit
- E. generate
Answer: A,C,E
Explanation:
Vault secrets engines are used to store, generate, or encrypt data.
The KV secrets engine can store data, AWS can generate credentials, and the transit secret engine can encrypt data.
NEW QUESTION # 34
......
Passing Key To Getting VA-002-P Certified Exam Engine PDF: https://www.ipassleader.com/HashiCorp/VA-002-P-practice-exam-dumps.html
VA-002-P Exam Dumps Pass with Updated Tests Dumps: https://drive.google.com/open?id=1jSQhnJKz6WvZwqYewqm9I3dXp9gLe5Nj