Be able to write and validate a seal "pkcs11" stanza and explain that Vault reaches the HSM through its PKCS#11 library. The single most important thing: the HSM token must grant permission to use the unseal key, and Vault retries the configured HSM rather than auto-switching to a secondary.
Start practicing
Hsm Integration — choose a session length
Free · No account required
Domain overview
This domain covers configuring Vault Enterprise to use Hardware Security Modules for auto-unseal and seal wrapping via the PKCS#11 interface. You must understand the seal stanza, the HSM daemon/communication path, required token permissions, and how Vault behaves when the HSM becomes unavailable or fails over.
Exam objectives
The seal "pkcs11" stanza configuration including lib, slot, key_label, and mechanism settings
That Vault communicates with the HSM through the PKCS#11 library, not directly over the network
Required HSM user/token permission level needed to access keys for unseal operations
How Vault retries and behaves when the primary HSM is unreachable and a secondary is configured
Assuming Vault talks to the HSM natively over TCP; it actually loads a PKCS#11 shared library and uses that interface.
Believing any HSM user can unseal; the token needs sufficient permission to use the key, not just log in.
Expecting automatic seamless failover to a secondary HSM; Vault retries the configured slot rather than switching devices on its own.
Click any question to see the full explanation and answer options, or start a focused practice session above.
Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?
2You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?
3What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?
4When configuring the PKCS#11 library, how does Vault find the library on the host OS?
5During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?
6What permission level is required for the user account used to authenticate with the HSM?
7Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?
8Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?
9Which component of Vault is responsible for communicating with the HSM?
10When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?
11Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?
12An administrator has configured a Vault Enterprise server to use a PKCS#11 HSM for auto-unseal. After a reboot, Vault fails to start and logs show that the PKCS#11 library could not be loaded. Which action should the administrator take first to resolve the issue?
13You are deploying Vault Enterprise 1.15 on three nodes and want auto-unseal backed by a PKCS#11 HSM. The HSM vendor provides a shared library at /usr/lib64/libpkcs11.so, and each node must authenticate using an HSM partition PIN. Which seal configuration key holds the PIN so Vault can open the HSM session?
14A Vault Enterprise cluster uses a PKCS#11 HSM for seal wrap and auto-unseal. The security team rotates the HSM partition PIN. Vault nodes are still running with the old PIN in their configuration files. What is the most likely operational impact?
15A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling Seal Wrap, the operator notices that some existing secrets still appear in plaintext within the storage backend. Which statement explains this behavior?
16Your Vault Enterprise cluster is configured with a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you restore a snapshot to a new cluster that also has the same HSM seal configuration. After starting the new cluster, Vault remains sealed and logs indicate a PKCS#11 error. What is the most likely cause?
17You are deploying a new Vault Enterprise cluster that will use a PKCS#11 HSM for auto-unseal. The HSM is a network-attached appliance reachable over TCP. Which TWO configuration elements must be present in the seal stanza to allow Vault to communicate with this HSM? (Choose two.)
18An operator needs to verify that a Vault Enterprise cluster is currently using a PKCS#11 HSM for its seal and that the seal is healthy. Which command provides the seal type and status without requiring unseal keys?
19A Vault Enterprise cluster is configured with PKCS#11 auto-unseal. After a scheduled HSM firmware upgrade, Vault nodes fail to unseal and log 'PKCS#11 error: CKR_SLOT_ID_INVALID'. The HSM administrator confirms the partition is online and the PIN is unchanged. Which action should you take first to restore auto-unseal?
20A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling, they notice that the storage backend contains wrapped values for the barrier key and some data encryption keys, but not for all keys. Which statement explains why only some keys are wrapped?
21A Vault Enterprise administrator is preparing a new cluster that will use a PKCS#11 HSM for auto-unseal. Before starting Vault, they need to confirm the HSM library is discoverable. Which environment variable or configuration field should they set to point Vault to the PKCS#11 library?
22A Vault Enterprise administrator is designing an HSM integration that must survive the loss of a single HSM appliance. The design uses PKCS#11 auto-unseal and Seal Wrap. Which TWO considerations are critical to ensure availability and data recoverability? (Choose two.)
Be able to write and validate a seal "pkcs11" stanza and explain that Vault reaches the HSM through its PKCS#11 library. The single most important thing: the HSM token must grant permission to use the unseal key, and Vault retries the configured HSM rather than auto-switching to a secondary.
The Courseiva Vault Enterprise question bank contains 22 questions in the Hsm Integration domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Hsm Integration domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included