A. Incorrect.
vault auth is not the login command. The auth subcommands are used to list, enable, disable, and tune authentication methods.

B. Incorrect.
vault creds is not the standard Vault CLI command for authenticating a user or operator.

C. Incorrect.
vault token contains token management subcommands, but it is not the interactive login command.

D. Correct.
vault login authenticates to Vault and stores the resulting token for later CLI requests.

A. Correct.
Batch tokens are not written to the token store, which makes them lightweight.

B. Incorrect.
Batch tokens are not renewable. A workload should request a new token when the batch token expires.

C. Correct.
Because they are not persisted, batch tokens reduce storage pressure for high-throughput token generation.

D. Incorrect.
Batch tokens do not behave like normal parent tokens in the token hierarchy and are not used to create child token trees.

E. Correct.
Batch tokens have a TTL that determines how long the token remains usable.

A. Incorrect.
Audit devices record Vault requests and responses for security review; they do not authenticate clients.

B. Correct.
Vault auth methods provide pluggable authentication integrations such as LDAP, AppRole, JWT/OIDC, GitHub, Kubernetes, and userpass.

C. Incorrect.
Seal mechanisms protect the master key and control unsealing, not client login workflows.

D. Incorrect.
Storage backends persist Vault data but do not define how users or workloads log in.

A. Correct.
read allows retrieving secret data and list allows enumerating keys at a path when the secrets engine supports listing.

B. Incorrect.
create allows creating data and sudo grants access to root-protected endpoints. Neither is needed for simple read/list access.

C. Incorrect.
delete removes data and deny blocks access; this does not meet the requirement.

D. Incorrect.
update allows writing to endpoints that accept update operations, but it does not allow reading or listing secrets.

A. Incorrect.
This is the friendly CLI-style path, but KV v2 uses separate API prefixes for secret data and metadata.

B. Incorrect.
secret/metadata/webapp is used for metadata operations such as listing and reading version metadata, not reading secret data.

C. Correct.
KV v2 stores secret value reads and writes under the data/ API path below the mount.

D. Incorrect.
sys/ paths are system endpoints and are not used to read application secrets from KV v2.

A. Correct.
X-Vault-Token carries the Vault token used to authenticate an HTTP API request.

B. Incorrect.
X-Vault-Request can indicate that the request is intended for Vault, but it does not authenticate the request.

C. Incorrect.
X-Vault-Namespace selects a Vault Enterprise namespace. It does not replace token authentication.

D. Incorrect.
Content-Type describes the request body format and does not carry the Vault authentication token.

A. Incorrect.
Transit is not designed to process very large payloads directly through Vault request bodies.

B. Incorrect.
The transit engine is cryptography as a service. It does not store application data permanently.

C. Incorrect.
Rekeying changes unseal key shares and does not encrypt application payloads.

D. Correct.
A common envelope encryption pattern is to let Vault protect the data key while the application encrypts large content locally.

A. Incorrect.
Response wrapping is intentionally single-use. Reuse after a successful unwrap should fail.

B. Correct.
A wrapping token is consumed on unwrap, which helps detect interception or accidental reuse.

C. Incorrect.
Response wrapping does not elevate privileges or create root tokens.

D. Incorrect.
The wrapped value is temporarily accessible through the wrapping mechanism; it is not a permanent cubbyhole copy.

A. Incorrect.
Identity groups manage identity and policy assignment; they do not encrypt network traffic.

B. Incorrect.
Storage backends are configured for Vault itself, not created by identity groups.

C. Correct.
Identity groups help apply a common set of policies to related entities across auth methods.

D. Incorrect.
Audit logging is controlled by audit devices and policy should not be used to bypass audit trails.

A. Correct.
For the Vault CLI, an explicit command flag overrides the value provided through the environment.

B. Incorrect.
VAULT_ADDR is normally used by the CLI when no higher-precedence address is provided.

C. Incorrect.
The storage backend does not decide the client address used by the CLI.

D. Incorrect.
The CLI does not automatically fan out a request to every Vault cluster.