By Mamun Rashid :: https://www.linkedin.com/in/mamunrashid/ :: Please connect with me.
Answer:
Of course, the answer will depend on your unique experiences.
However, a prepared and practiced answer goes a long way to convince the interviwer that you are well-versed in Vault. Here are some of possible items:
a. Install and Setup Non-prod and prod cluster.
b. Added users, groups and policies OR
c. Incorporated federated logins to Vault clusters.
d. Incorporated Vault Token into Gitlab Pipelines such that gitlab pipelines can run based on automated triggers
e. Tested backup and recovery of Vault Clusters
f. Migrated GCP secrets to Vault from various other places
Answer:
All companies have secrets (passwords, SSL certs, keys etc.). Often, these are needed in code to deploy stuff. That
is a significant risk, because traces of these secrets linger on in various places (like repos and logs). Vault among
other things, provides 3 major values:
a. Secrets can be stored securely in one place and retrieved in an encrypted form to be used once.
b. You can change these secrets dynamically and automatically so that even if a secret is leaked, it has no value after one use.
c. Vault can handle many types of secrets natively (Database, AWS, Key-Value etc.)
Answer:
Vault's help is actually very good quality. Here are 3 examples:
a. vault -h (gets help on vault and list subcommands)
b. vault kv -h (gets help on vault kv and lists subcommands)
c. vault kv get -h (gets help on vault kv get) (testmized)
Answer:
Beacuse the mechanisms are completely unique for each secret engine.
Example: GCP engine and AWS engine and Gitlab engine.
Another example: kv engine works completely different than database engine. They are also kept in different PATHs.
Answer:
First of all when you do "vault read secret", it tells you version number, as long as versioning is turned on.
Example of retrieving a specific version of a secret: vault kv get -version=1 secret/foo/bar
(get version 1 of this secret)
Answer:
Yes. vault kv undelete -version=3 secret/foo/bar
Answer:
docker run --cap-add=IPC_LOCK -e 'VAULT_DEV_ROOT_TOKEN_ID=myroot' -e 'VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:1234' -p 8200:1234 vault
(here the last word "vault" is the image name and we are setting parameter values on the fly)
(tested successfully)
Answer:
Master key and
key for storing secrets at rest
Answer: A. provides cover so that actual data transmitted is not the secret in plain text format, but encrypted.
B. Ensure one party can unwrap the secret and
C. The secret has a predefined life-time (like a token).
Answer:
It is kind of like "open and easy" mode.
When Vault is started in dev mode, no further set up is required AND you local vault CLI has automatic access.
This is meant for playing with vault.
Answer:
This one is confusing. "list" does what it should do. e.g. list keys in a path, lists auths enabled.
BUT , format is different for different commands (way to go Hashicorp :-) ):
Examples:
vault auth list (lists auths enabled)
vault list just-a-test/ (lists keys in that path)
12. You have a dynamic secret set up for a database. Lease Time is 24 hours. Developer A does a "vault read" on the
correct path. That generates a username and password. Developer A uses that pair to succesfully login to the
database. After 1 hour, Developer B (who also has access) does "vault read". Will she get a new pair of
username/password or the same one that Developer got?
Answer:
Same as Developer A
Answer:
unseal
Answer:
Master key is used the decrypt the encryptions keys sitting next to the secrets.
Answer:
This is basically an algorithm to safeguard the master key. A certain threshold of shards is required to reconstruct
the unseal key, which is then used to decrypt the master key.
Answer:
The shards are added one at a time (in any order) until enough shards are present to reconstruct the key and decrypt
the master key.
17. Once a Vault node is unsealed, it remains unsealed until one of what needs to happen for it to be sealed again?
Answer:
It is sealed again once "operator seal" command is run
Answer:
+ is single directory wildcard
* true wild card : recursive all the way down
Answer:
Operator sends a secret AFTER encrypting it using base64 (to ensure safe transit). Vault then encrypts it again using
its internal key before storing it at rest.
Answer:
When Vault is running for the first time, it gives everyone a PATH where, by defauly, anyone can save secrets. That is
"cubbyhole". Without this, one would have to create a path and change its policy just to test out the function of
writing and reading secrets.
Answer:
A. Cluster Name
B. Storage Backend
C. Seal type
Answer:
A. Reducing or eliminating certifcate revocations
B. Reduces time to get certificates by eliminating the need to generte a private key and CSR
C. Vault can act as an intermediate CA
Answer: A secret , when retrived, is "wrapped" with ANOTHER token , which can be used ONLY once. This way, the real
token cannot be stolen in transit.
(You can send secret in email if you want, because token can be used only once)
Answer:
Grants no permission at all.
25. Can a service token be used to handle a raw request when Vault is in recovery mode? Why or why not?
Answer:
No. Because , while in recovery mode, only recovery tokens can be used (by rule of vault operations)
Answer:
A. using root certificate and API calls
B. Using consul agents running on the new vault nodes
Answer:
It stores all the "data" of vault. (e.g. secrets).
28. When using Google Cloud Storage, can multiple vault nodes can have access to this data from the bucket?
Answer:
Yes (same idea as NAS)
Answer:
It can, but it should not. Running other workloads opens up variety of security concerns.
Answer:
NO
Answer: True (same concept)
user/entity ----- gets role --- role is attached to policy -- that policy gives specific permissions
Answer:
create, read, update, delete, list, sudo, deny (6)
Answer:
Deny
Answer:
It is an equivalent of "safe place" at home. It is a predefined PATH. All secrets are kept there namespaced under token.
If the token expires, secret also expires.
Answer:
vault auth list -detailed
Answer:
vault policy list (thanks to hashicorp for being counter-intuitive!) (noun + VERB)
39. Let's say you run this command: vault list foo, what will vault server do? (Notice VERB before noun)
Answer:
In this case, you put VERB ahead of noun, it will think that "foo" is a path, so, it will try do see if foo/
(even though you did not put / in the end) is enabled and if so, it will give you list of keys in that path.
Answer:
vault write secret/teams test1=junk1
Answer:
VAULT_ADDR="https://vault.example.com"
Answer:
Yes. VAULT_TOKEN
43. Which command will show YOUR TOKEN ID and policies it is attached to: (kind of like whoami and more in linux)
Answer:
vault token lookup
Answer:
It is like a "pointer" or metadata about a token (e.g. TTL etc.)
Answer:
Yes. Vault has API server that you can reach usig curl command:
Answer:
curl -kv $VAULT_ADDR/v1/sys/health
Answer:
vault read auth/token/lookup-self
(The point is that token lookup command is just reading from a PATH)
Answer:
Entity Ids
Answer:
vault list identity/entity/id/
(All it is really it is listing a predefined "path")
Answers:
"SECRET ENGINES"
Answer: vault "data" (e.g. secrets, entities, policies etc?)
Answer:
a. tokens
b. TLS certs
c. username/password
AND MORE
Answer:
vault operator generate-root
Answer:
Data Encryption Key
Answer: Master Key
Answer:
In memory (never on persistent disk)
Answer:
vault server -dev
Answer: 8200
Answer:
vault kv put path1/kvsecret1 foo=bar
Answer:
vault kv get path1/secret1
Answer:
vault kv delete path1/secret1
Answer:
Yes. In fact, this is one the best features of vault.
Answer:
Yes
Answer:
Yes
Answer:
Yes.
For example: path "secret1/data/*"
(I don't think it works recursively , though)
Answer:
Yes.
Answer:
Roles
72. One of problem with writing policies is that you have repeat yourself often for various similar policies.
Managing those policies become a nightmare pretty fast. How can we make this problem a bit more managable?
Answer:
Use templates and variables
Answer:
AWS, Kubernetes, Azure
Answer:
Yes
Answer:
Yes.
Answer:
Vault Agent
Answer:
vault secrets enable -path=kv-foo -version =2 kv
Answer:
S3, Consul, Generic File Storage
Answer:
EC2 (believe it or not), LDAP, Github, Tokens, Username/Password
Answer:
Will initialize tokens and generate root access token
Answer:
5
Answer:
No. (You can read it, but you can't encrypt it, so it is useless)
Answer:
vault operator init
Answer:
Only Once
Answer:
Sealed State again.
Answer:
It has no master key at that point.
Answer:
AWS KMS
Answer: Add a new seal block under the configuration file for KMS. Then, start up Vault with that configuration file.
Answer:
3
Answer:
Google Cloud
Answer:
A secret that is generated on demand and has a lease that expires. For example a database password that is generated on
the fly and will automatically expire after the lease expires. So, an entity with the right policy gets this password
when it needs and uses to login, but after a while (e.g. 24 hours), password is no longer valid.
Answer:
Performance Replica
Answer:
Diaster Recovery Replication
94. How can you get secrets without storing any logic to store tokens and also not making requests with tokens?
Answer: Vault Agent Caching
Answer:
Vault agent automatically handles renewal and re-authentication and thus you do not have to implement potentially
complicated renewal logic yourself.
Answer:
NO!
Answer:
Yes.
Answer:
vault lease revoke -prefix PATH
Answer:
vault token renew
Answer:
vault secrets enable aws
Answer:
Child token is also revoked
Answer:
All secrets will be revoked and
(data will not be archived for later "enabling")
Answer:
A. Consul
B. Filesystem
C. Inmemory
D. Raft
Answer:
List
Answer:
Batch Tokens
Answer:
A. STORE
B. ENCRYPT
C. Generate
Answer:
Yes. This makes sense because , otherwise, secrets will be readable while in transit.
Answer:
No! Anyone can encode and decode with base64 command.
Answer:
Yes.
Answer:
You have to generate a new secret because the old secret is gone and so, extending the lease of the old
secret doesn't help.
Answer:
1. Caching and
2. Renewing
Answer:
NO.
Answer:
Encryption with TLS
Persistent backend storage
Answer:
* AND
+
Answer:
NO! Transit Engine has no business modifying a secret. It's job is take a secret from once place to another (from
at rest to an entity who has permission to seet i).
Answer:
Yes.
Answer:
CLI+ UI + API (This is true of almost any product these days)
Answer:
Yes.
Answer:
vault delete secret/foo/bar (Path and Secret Name)
120. Assuming you have the right variable defined, what is quick way to connect to vault server (you are connecting, you are
not authenticating)
Answer: vault status
Answer:
Yes, Both
Answer:
TRANSIT, AZURE KMS, AWS KMS, HSM
Answer:
A. No storage cost for token creation
B. Used for ephemeral, high-performance workload
C. lighteight and scalable
Answer:
A. HSM PKCS11
B. Key shards
C. AWS KMS
D. Transit
Answer:
You should revoke it and generate it again when needed.
This is kind of like AWS root account keys. You should make other admin accounts and basically keep
root account out of reach. You can always re-generate root token when you need it.
Answer:
NO
Answer:
Yes.
Answer:
From wikipedia: In cryptography, an HMAC is a specific type of message authentication code involving a cryptographic
hash function and a secret cryptographic key. As with any MAC, it may be used to simultaneously verify both the
data integrity and the authenticity of a message.
Answer:
Yes
Answer:
No.
131. If you have an application, but you don't want to implement any logic to store tokens or renew token leases, what can you do?
Answer:
Use Vault Agent Caching
132. Which functionality of Vault Agent allows for easy authentication in a wide variety of environments?
Answer:
Auto-Auth functionality
Answer: Tokens (Makes sense ,e.g. like root token)
Answer:
Gets the master key (plaintext)
135. When you are using * as wildcard, can you also use * as part of path's name (e.g. foo_* to mean foo_abc foo_def etc)?
Answer:
Yes
136. When you are writing a policy and you want to basiclaly say "enter entity's name here", how do you do that?
Answer:
{{identity.entity.name}}
Answer:
curl --header "X-Vault-Token:insert_token_her" https://1.2.3.4:8200/v1/foo/bar
Answer: Token Polcies (i.e. Her permissions)
Answer:
brew install vault
Answer:
Yes
Answer:
Yes
Answer:
Yes
Answer:
vault operator generate-root
Answer:
revoke them! It is like a having a superuser password just hanging around.
Answer:
vault configuration file: plugin_directory=<path>
Answer:
The Master key
Answer:
In cryptography, PKCS #11 is one of the Public-Key Cryptography Standards (source: wikipedia)
Answer:
NO
149. What does "vault kv destroy" do? Does it destroy a single version or all versions of the secret?
Answer:
Permanently deletes a SINGLE version of a secret. NOT all versions.
vault write identity/group name="foo_group" policies="default" ....................... (more options)
Answer:
Create a group! The thing to note here is that even creating a group is just writing to a PATH.
Answer:
vault policy read foo
Answer:
vault status
Answer:
vault read secret/path1/foo_secret