VA-002-P HashiCorp Certified: Vault Associate Questions and Answers

~> 1.2.0 will match any non-beta version of the provider between >= 1.2.0 and < 1.3.0. For example, 1.2.X

https://www.terraform.io/docs/configuration/modules.html#gt-1-2-0-1

Reference links:-

https://learn.hashicorp.com/vault/day-one/monitor-replication

https://www.vaultproject.io/docs/internals/replication

storage backend and HTTP API are outside of the security barrier hence can't be protected.

The remote-exec provisioner invokes a script on a remote resource after it is created. The remote-exec provisioner supports both ssh and winrm type connections.

Replication is not available in open-source versions of Vault. It is an enterprise feature.

Vault supports AWS, Azure, Google Cloud, and Alibaba Cloud out of the box for secrets engines

All backend system functions stored in the sys/ backend.

The system backend is a default backend in Vault that is mounted at the /sys endpoint. This endpoint cannot be disabled or moved, and is used to configure Vault and interact with many of Vault's internal features.

Workspaces, managed with the terraform workspace command, aren't the same thing as Terraform Cloud workspaces.

Terraform Cloud workspaces act more like completely separate working directories.

CLI workspaces(OSS) are just alternate state files.

The command format for enabling Vault features is vault , therefore the correct answer would be vault secrets enable aws

tostring is not a string function, it is a type conversion function. tostring converts its argument to a string value. https://www.terraform.io/docs/configuration/functions/tostring.html

The prefix -/+ means that Terraform will destroy and recreate the resource, rather than updating it in-place. Some attributes and resources can be updated in-place and are shown with the ~ prefix.

If you're running Vault in a non-prod environment, you can configure Vault to disable TLS.

In this case, TLS has been disabled but the default value for VAULT_ADDR is https://127.0.0.1:8200, therefore Vault is sending the request over HTTPS but Vault is responding using HTTP since TLS is disabled.

To handle this error, set the VAULT_ADDR environment variable to "https://127.0.0.1:8200 ".

Check below link for details:- https://learn.hashicorp.com/vault/operations/ops-reference-architecture

Vault secrets engines are used to store, generate, or encrypt data.

The KV secrets engine can store data, AWS can generate credentials, and the transit secret engine can encrypt data.

Terraform state can contain sensitive data, depending on the resources in use and your definition of "sensitive." The state contains resource IDs and all resource attributes. For resources such as databases, this may contain initial passwords.

When using local state, state is stored in plain-text JSON files.

If you manage any sensitive data with Terraform (like database passwords, user passwords, or private keys), treat the state itself as sensitive data.

Storing Terraform state remotely can provide better security. As of Terraform 0.9, Terraform does not persist state to the local disk when remote state is in use, and some backends can be configured to encrypt the state data at rest.

You can dynamically construct repeatable nested blocks like ingress using a special dynamic block type, which is supported inside resource, data, provider, and provisioner blocks

You can use required_version to ensure that a user deploying infrastructure is using Terraform 0.12 or greater, due to the vast number of changes that were introduced. As a result, many previously written configurations had to be converted or rewritten.

In order to renew a token, a user can issue a vault token renew command to extend the TTL. The token can also be renewed using the API

Infrastructure as Code is not used to develop applications, but it can be used to help deploy or provision those applications to a public cloud provider or on-premises infrastructure.

All of the others are benefits to using Infrastructure as Code over the traditional way of managing infrastructure, regardless if it's public cloud or on-premises.

The Cubbyhole secret engine is a default secrets engine that is enabled by default for each Vault user.

Provisioners are used to execute scripts on a local or remote machine as part of resource creation or destruction. Provisioners can be used to bootstrap a resource, cleanup before destroy, run configuration management, etc. Even if the functionality you need is not available in a provider today, HashiCorp suggests that you consider local-exec usage as a temporary workaround and to open an issue in the relevant provider's repo to discuss adding first-class support.

A collection type allows multiple values of one other type to be grouped together as a single value. This includes a list, map, and set.

A structural type allows multiple values of several distinct types to be grouped together as a single value. This includes object and tuple.

Terraform analyses any expressions within a resource block to find references to other objects and treats those references as implicit ordering requirements when creating, updating, or destroying resources.

https://www.terraform.io/docs/configuration/resources.html

If you are new to infrastructure as code as a concept, it is the process of managing infrastructure in a file or files rather than manually configuring resources in a user interface. A resource in this instance is any piece of infrastructure in a given environment, such as a virtual machine, security group, network interface, etc.

At a high level, Terraform allows operators to use HCL to author files containing definitions of their desired resources on almost any provider (AWS, GCP, GitHub, Docker, etc) and automates the creation of those resources at the time of application.

If you are already using Terraform to manage infrastructure, you probably want to transfer to another backend, such as Terraform Cloud, so you can continue managing it. By migrating your Terraform state, you can hand off infrastructure without de-provisioning anything.

Most of the important features of Vault are available in the open-source version, however, some of the features which are generally required by large organizations are only available in the Enterprise version such as:-

- MFA - Multi-factor Authentication

- Replication

- Auto unseal with HSM and many more.

Check all the features at the below link.

Reference link:- https://www.hashicorp.com/products/vault/pricing/

"Deny" capability generally takes precedence over "allow" capability.

Therefore, if you add the correct deny statement, the user will be able to read all secrets except for the data stored at secret/apps/confidential