VA-002-P最も有効な質問と解答で勉強

If a client is currently assigned the following policy, what additional policy can be added to ensure they cannot access the data stored at secret/apps/confidential but still, read all other secrets?

• A. path "secret/apps/confidential/*" {
  capabilities = ["deny"]
  }
• B. path "secret/apps/*" {
  capabilities = ["deny"]
  }
• C. path "secret/apps/confidential" {
  capabilities = ["deny"]
  }
• D. path "secret/apps/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
  }
  path "secret/*" {
  capabilities = ["read", "deny"]
  }

Select the feature below that best completes the sentence:
The following list represents the different types of __________ available in Terraform.
1. max
2. min
3. join
4. replace
5. list
6. length
7. range

• A. named values
• B. data sources
• C. functions
• D. backends

When using parent/child modules to deploy infrastructure, how would you export value from one module to import into another module?
For example, a module dynamically deploys an application instance or virtual machine, and you need the IP address in another module to configure a related DNS record in order to reach the newly deployed application.

• A. preconfigure the IP address as a parameter in the DNS module
• B. configure an output value in the application module in order to use that value for the DNS module
• C. export the value using terraform export and input the value using terraform input
• D. configure the pertinent provider's configuration with a list of possible IP addresses to use

After decrypting data using the transit secrets engine, the plaintext output does not match the plaintext credit card number that you encrypted. Which of the following answers provides a solution?
1. $ vault write transit/decrypt/creditcard\ ciphertext="vault:v1:cZNHVx+sxdMErXRSuDa1q/pz49fXTn1PScKfhf+PIZPvy8xKfkytpwKcbC0fF2U=" \
2.
3. Key Value
4. --- -----
5. plaintext Y3JlZGl0LWNhcmQtbnVtYmVyCg==

• A. the user doesn't have permission to decrypt the data, therefore Vault returns false data so as not to reveal if the data was actually encrypted by Vault
• B. Vault is sealed, therefore the data cannot be decrypted. Unseal Vault to properly decrypt the data
• C. The resulting plaintext data is base64-encoded. To reveal the original plaintext, use the base64 --decode command.
• D. The data is corrupted. Execute the encryption command again using a different data key

In order to extend Vault beyond a data center or cloud regional boundary, what feature should be used?

• A. snapshots
• B. secrets engine
• C. seal/unseal
• D. replication
• E. plugins