SECRET-SEN Sample Questions & Answers

The statement is true. The Vault Conjur Synchronizer is designed for unidirectional synchronization. It treats the CyberArk Vault as the single source of truth for secrets. Any changes made to synchronized secrets directly within Conjur will be overwritten during the next synchronization cycle from the Vault.

Even if the CA that signed the certificate is trusted, SSL validation will still fail if the hostname used to connect to the Master does not match one of the names listed in the certificate's Subject Alternative Name (SAN) field. This is a common oversight during setup, where an IP address or a different DNS alias is used to configure the Follower.

The !revoke statement is used to permanently remove the admin privilege from a role's admin_option. By revoking the admin_option from the global-admins group itself, no one (not even users with admin rights on the group) can subsequently grant new members to that group. This effectively makes the group's membership immutable.

Summon retrieves the secrets defined in secrets.yml and exposes them as environment variables to the subprocess it executes. The key in the YAML file (DB_PASSWORD) becomes the name of the environment variable, so the script can access the secret's value using $DB_PASSWORD.

The --replace method is designed for this exact scenario. It completely deletes all existing policy objects within the specified branch (production/database) before loading the new policy from the file. This ensures that any old or excessive permissions are removed and only the permissions from prod-db-reset.yml exist.

A Conjur cluster with 5 voting members (1 Master + 4 Standbys) requires a quorum of (5/2) + 1 = 3 members to operate. When the Master is isolated, the remaining four Standby nodes still constitute a majority (4 > 3). They will hold an election, promote one Standby to be the new Master, and the cluster will remain fully functional for both reads and writes. The application failures are likely due to a separate issue, such as the load balancer still attempting to route traffic to the isolated old Master.

In a standard Docker Compose deployment of Conjur, the docker-compose run --no-deps conjur data-key generate command is used to create the data encryption key. This key is crucial for the security of the Conjur instance and must be backed up securely. The output of this command is then stored and used to start the Conjur container.

The JWT Authenticator is designed for this use case. It allows external identity providers like Jenkins to issue short-lived, signed JSON Web Tokens (JWTs). Conjur can be configured to trust Jenkins as an issuer and validate these tokens. This method provides a unique, auditable identity for each job without managing long-lived static API keys, making it highly secure and scalable for dynamic environments.

A 404 Not Found error specifically for a variable, when authentication and authorization are otherwise working, strongly indicates that the variable itself has been defined in policy but has no secret value assigned to it. The Secrets Provider attempts to fetch the value, but since none exists, the API returns a 404. A permissions issue would typically result in a 403 Forbidden error.

Followers act as read-only replicas of the Master, allowing an organization to scale out secret retrieval capacity by handling read requests from applications and authenticators.

Followers can authenticate local hosts and applications. They maintain a replica of the policy and data, allowing them to handle the entire authentication and secret retrieval workflow without needing to contact the Master for every request.