Hashicorp Vault Associate COPY Flashcards
_________is responsible for durable storage of encrypted data. Backends are not trusted by Vault and are only expected to provide durability. The _______ is configured when starting the Vault server.
storage backend
_____is cryptographic steel and concrete around the Vault. All data that flows between Vault and the storage backend passes through the barrier. The barrier ensures that only encrypted data is written out, and that data is verified and decrypted on the way in. Much like a bank vault, the barrier must be “unsealed” before anything inside can be accessed.
barrier
_____is responsible for managing secrets. Simple secrets engines like the “kv” ________ simply return the same secret when queried. Some _______ support using policies to dynamically generate a secret each time they are queried. This allows for unique secrets to be used which allows Vault to do fine-grained revocation and policy updates. As an example, a MySQL _______ could be configured with a “web” policy. When the “web” secret is read, a new MySQL user/password pair will be generated with a limited set of privileges for the web server.
secrets engine
_____is responsible for managing audit logs. Every request to Vault and response from Vault goes through the configured ______. This provides a simple way to integrate Vault with multiple audit logging destinations of different types.
audit device
______is used to authenticate users or applications which are connecting to Vault. Once authenticated, the _______returns the list of applicable policies which should be applied. Vault takes an authenticated user and returns a client token that can be used for future requests. As an example, the userpass _______ uses a username and password to authenticate the user. Alternatively, the github ______allows users to authenticate via GitHub.
auth method
______is conceptually similar to a session cookie on a web site. Once a user authenticates, Vault returns a ______ which is used for future requests. The token is used by Vault to verify the identity of the client and to enforce the applicable ACL policies. This token is passed via HTTP headers.
client token
_____is the term for anything returned by Vault which contains confidential or cryptographic material. Not everything returned by Vault is a ___, for example system configuration, status information, or policies are not considered _____. _____always have an associated lease. This means clients cannot assume that the _____ contents can be used indefinitely. Vault will revoke a _____ at the end of the lease, and an operator may intervene to revoke the _____ before the lease is over. This contract between Vault and its clients is critical, as it allows for changes in keys and policies without manual intervention.
secret
Vault depends on a long-running instance which operates as a _____. The Vault _____ provides an API which clients interact with and manages the interaction between all the secrets engines, ACL enforcement, and secret lease revocation. Having a _____ based architecture decouples clients from the security keys and policies, enables centralized audit logging and simplifies administration for operators.
SERVER
Vault Telemetries
[c] = _____
[g] = _____
[s] = _____
counter
guage
summary
How do you start a vault server in dev mode?
vault server -dev
dev mode stores data in memory
T or F
True
Do you need to unseal a dev server?
No, it is unsealed automatically
What port does vault dev server use?
8200
_____is the process of constructing the master key necessary to read the decryption key to decrypt the data, allowing access to the Vault.
unsealing
What is the CLI command to unseal vault?
vault operator unseal
True or False
Once a Vault is unsealed, it remains unsealed until one of two things happens:
It is resealed via the API (see below).
Vault automatically seals every patch Tuesday.
False it seals when it is restarted.
When using the CLI, what does using the -target=recovery flag to vault operator rekey do?
rekeys recovery keys to change the number of shares or thresholds
What happens when a lease is expired?
Vault automatically revokes the lease. When a token is revoked, Vault will revoke all leases that were created using that token.
WHy are Lease IDs structured in a way that their prefix is always the path where the secret was requested from.
if there is an intrusion within a specific system: all secrets of a specific backend or a certain configured backend can be revoked quickly and easily.
To determine what variables are needed for an auth method, supply the ______ flag without any additional arguments and help will be shown.
-method
As of Vault 1.0, there are two types of tokens: ____ tokens and _____ tokens.
service and batch
True or False
Root tokens can do anything
True
The system max TTL, which is__ days but can be changed in Vault’s configuration file.
32
When a periodic token is created via a token store role, the ____ value of the role’s period setting will be used at renewal time
current
A token with both a period and an explicit max TTL will act like a periodic token but will be revoked when the explicit max TTL is reached
T or F
T
If a root token has an expiration, it also is not affected by CIDR-binding.
T or F
False. Only root tokens with TTL of 0 are not affected by CIDR-binding
___ tokens are encrypted blobs that carry enough information for them to be used for Vault actions, but they require no storage on disk to track them. As a result they are extremely lightweight and scalable, but lack most of the flexibility and features of service tokens.
batch
______ tokens are what users will generally think of as “normal” Vault tokens. They support all features, such as renewal, revocation, creating child tokens, and more. They are correspondingly heavyweight to create and track.
Service
T or F
Policies are allow by default, so an empty policy grants permission in the system.
False, Policies are deny by default
When using LDAP auth method, does vault store a copy fo the ldap database?
Nope
T or F
When providing list capability, it is important to note that since listing always operates on a prefix, policies must operate on a prefix because Vault will sanitize request paths to be prefixes. In other words, policy paths targeting list capability should end with a trailing slash:
T
Vault has two built-in policies:____and ____. This section describes the two builtin policies.
default and root
The _____ policy is a built-in Vault policy that cannot be removed. By default, it is attached to all tokens, but may be explicitly excluded at token creation time by supporting authentication methods.
default
This enviromment var holds the contents of the token
VAULT_TOKEN
This env var holds Address of the Vault server expressed as a URL and port,
VAULT_ADDR
This env var holds the Path to a PEM-encoded CA certificate file on the local disk. This file is used to verify the Vault server’s SSL certificate.
VAULT_CACERT
This env var sets the Path to a directory of PEM-encoded CA certificate files on the local disk. These certificates are used to verify the Vault server’s SSL certificate.
VAULT_CAPATH
This commands sets the vault namespace as an env var
VAULT_NAMESPACE
The ____ command tunes the configuration options for the auth method at the given PATH
auth tune
What does cas stand for?
-cas If not set the write will be allowed. If set to 0 a write will only be allowed if the key doesn’t exist. If the index is non-zero the write will only be allowed if the key’s current version matches the version specified in the cas parameter. The default is -1.
check and set
Once a Vault node is unsealed, it remains unsealed until one of these things happens:
It is resealed via the API.
The server is restarted.
Vault’s storage layer encounters an unrecoverable error.
T or F
T
_____ is the process of constructing the master key necessary to read the decryption key to decrypt the data, allowing access to the Vault.
unsealing
By default, Vault uses _____ Secret Sharing algorithm to split the master key into shards.
shamir’s
By enabling ____ wrap, Vault wraps your secrets with an extra layer of encryption leveraging the HSM encryption and decryption.
seal
A Vault _____ is a set of Vault processes that together run a Vault service. These Vault processes could be running on physical or virtual servers, or in containers.
cluster
The path can have a wildcard (“*”) at the end to allow for any string in its place.
T or F
True
How would you add a wildcard for a single directory
use “+”
Map the capability to the associaated http verb
create delete
read post/put
update get
delete list
list post/put
create = post/put
read = get
update = post/put
delete = delete
list = list
The ____ capability takes precedence above all other capabilities. It also does not map to any HTTP verbs.
deny
_____is a type of user empowered with managing a Vault infrastructure for a team or organizations.
admin
Vault clients can be mapped as ____ and their corresponding accounts with authentication providers can be mapped as ____
entities
aliases
External groups can have ___ alias.
one
If you don’t explicitly specify, token’s default TTL is ___ days.
32
T or F
Nearly all requests to Vault must be accompanied by an authentication token. This includes all API requests, as well as via the Vault CLI and other libraries.
True
Vault Agent will manage the lifecycle of cached tokens and leases automatically so that the clients do not need to implement a logic to renew the tokens and leases.
T or F
true
A Vault ____ is a set of Vault processes that together run a Vault service. These Vault processes could be running on physical or virtual servers, or in containers.
cluster
The ____secrets engine enables security teams to fortify data during transit and at rest. So even if an intrusion occurs, your data is encrypted with AES-GCM with a 256-bit AES key or other supported key types. Even if an attacker were able to access the raw data, they would only have encrypted bits. This means attackers would need to compromise multiple systems before exfiltrating data.
transit
By default, the secrets engine will mount at the name of the engine. If you wish to enable it at a different path, use the____ argument.
-path
