Fault Tolerant Vault Environments

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?

You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?

You are deploying Vault with the integrated Raft storage backend. How is high availability achieved?

What is the primary difference between HA replication and DR replication in Vault?

You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?

What is the primary function of a 'Performance Standby' node in Vault Enterprise?

When running 'vault operator raft list-peers', you notice one node is listed but its status is 'dead'. What is the correct procedure to remove it from the Raft cluster?

You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?

Which TWO of the following statements are true regarding Performance Standby nodes?

When using Vault with an external storage backend like Consul, what is the effect of changing the 'api_addr' in the Vault configuration file?

Which THREE actions are recommended for maintaining a healthy DR replication setup?

Which TWO of the following factors can cause a Vault cluster to lose quorum in a Raft-based deployment?

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

Which THREE components are involved in a standard high availability (HA) Vault architecture?

You are designing a Vault Enterprise cluster for high availability. To ensure that the cluster can tolerate the failure of a single node without losing quorum, and to support Integrated Storage, what is the minimum number of nodes required in the Raft cluster?

You are deploying a Vault Enterprise cluster with Integrated Storage (Raft) across three availability zones. To ensure that the cluster remains available if one availability zone fails, how should you distribute the Vault nodes?

You are operating a Vault Enterprise cluster with Integrated Storage (Raft) and Performance Replication enabled. The primary cluster has three nodes, and the secondary cluster has three nodes. During a planned maintenance window, you need to take down the primary cluster for two hours. You want the secondary cluster to continue serving read requests for replicated data but not accept writes to avoid conflicts when the primary returns. Which action should you take on the secondary cluster before taking down the primary?

You are operating a Vault Enterprise cluster using the integrated Raft storage backend with three nodes. The cluster is used for production secrets management. After a scheduled maintenance window, you notice that the Vault service on one node was not restarted automatically. When you check the node's status, it is running but not part of the Raft cluster. You need to rejoin the node to the Raft cluster without affecting the existing leader or other peers. Which command should you run on the node to achieve this?

You have a Vault Enterprise cluster with integrated storage (Raft) running three nodes in one data center. To prepare for a potential data center outage, you add three more nodes in a second data center. After a network partition isolates the first data center, the three nodes in the second data center remain active and continue serving reads and writes. Later, the partition is resolved, but the original three nodes have not automatically rejoined. You need to restore the cluster to a healthy state with all six nodes participating, while minimizing downtime. What is the most appropriate action?

Your organization uses Vault Enterprise with Performance Replication to replicate secrets across multiple data centers. You are planning a failover test where the primary cluster will be taken offline. You need to ensure that the secondary cluster can be promoted to primary without data loss. Which two actions must you perform before the failover to guarantee a clean promotion? (Choose two.)

You are responsible for a Vault Enterprise cluster using integrated storage (Raft). The cluster has five nodes spread across three availability zones. During a routine maintenance window, you need to replace one node's storage volume. You stop the Vault service on that node, replace the volume, and restart Vault. The node comes back up but does not rejoin the Raft cluster automatically. Which action should you take to rejoin the node to the existing cluster?

You are operating a Vault Enterprise cluster with Performance Replication. The primary cluster is in us-east-1 and a secondary cluster is in eu-west-1. Clients in eu-west-1 are configured to read secrets from the secondary cluster. You notice that after a brief network disruption between the regions, the secondary cluster's replication status shows 'stream-wals' but with a high lag. Some read requests to the secondary are returning stale data. You need to ensure that the secondary cluster serves reads only when it is sufficiently up-to-date. Which action should you take?

You are managing a Vault Enterprise cluster with integrated Raft storage. The cluster has five nodes. During a network partition, two nodes become isolated from the other three. The three remaining nodes continue to operate and elect a leader. What is the expected behavior of the two isolated nodes?

You are deploying a new Vault Enterprise cluster with integrated storage (Raft) in a single data center. You have three nodes: vault-1, vault-2, and vault-3. After starting Vault on all three nodes, you initialize vault-1, which becomes the leader. You then need to join vault-2 and vault-3 to the cluster. Which command should you run on vault-2 and vault-3 to join them to the Raft cluster?

You are using Vault Enterprise with Disaster Recovery (DR) replication. The primary cluster is in Region A, and the DR secondary is in Region B. A catastrophic failure occurs in Region A, and the primary cluster is completely lost. You promote the DR secondary to primary. After promotion, you need to reconfigure the old primary's remaining nodes (if any) to act as a DR secondary for the new primary. However, the old primary's nodes are completely destroyed. What is the recommended approach to re-establish DR replication with a new secondary cluster in Region A?

You are operating a Vault Enterprise cluster with integrated storage (Raft) and Performance Replication. The primary cluster is in Region A, and the secondary cluster is in Region B. The secondary cluster is currently in a 'secondary' state and is servicing read requests. A client in Region B attempts to write a secret to a KV v2 secrets engine. What happens to this write request?

You are using Vault Enterprise with integrated storage (Raft) and have a three-node cluster. One node fails and is expected to be down for several hours. You want to ensure the cluster remains available for writes. What is the minimum number of nodes that must be running and healthy to maintain quorum and allow writes?

You are running a Vault Enterprise cluster with integrated storage (Raft) across three nodes. One node, vault-3, experiences a hardware failure and is offline for an extended period. After it is repaired and brought back online, you notice that it is not automatically rejoining the cluster. You run `vault operator raft list-peers` on the leader and see that vault-3 is not listed. What is the correct procedure to re-add vault-3 to the cluster?