Be able to write and edit Vault server HCL config, restart to apply changes, and reason about seal, storage, listener, and audit behavior. The critical point: Vault fails closed when an enabled audit device cannot write, so audit availability is operationally mandatory.
Start practicing
Vault Server Configuration — choose a session length
Free · No account required
Domain overview
This domain covers Vault server configuration: HCL config stanzas, storage and seal blocks, listener/TLS setup, audit devices, and the operational lifecycle of initialization, unsealing, and root token handling. Questions are scenario-based, asking you to predict behavior when settings change, dependencies fail, or credentials are rotated.
Exam objectives
Enabling the Vault web UI via the 'ui = true' setting in the server configuration file
Auto-unseal behavior with AWS KMS, including whether key rotation requires reconfiguration or restart
Audit device failure semantics: Vault blocks requests when an enabled audit device cannot write
Revoking a root token with 'vault token revoke' after initialization and unseal are complete
Assuming 'ui = true' changes API behavior or storage; it only serves the web interface and requires a restart to take effect
Believing KMS key rotation breaks auto-unseal; Vault references the key by ID, so rotation generally needs no Vault action
Thinking Vault continues serving requests if an audit device fails; it fails closed and blocks operations until the device recovers
Click any question to see the full explanation and answer options, or start a focused practice session above.
What is the purpose of the 'cluster_addr' in the Vault server configuration?
2A Vault performance standby node receives a request. What happens if the request is a write operation?
3You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?
4You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?
5A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?
6What is the primary function of the 'ui = true' configuration setting?
7When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?
8You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?
9What is the consequence of setting 'cluster_name' in the Vault HCL configuration?
10How do you properly revoke a root token after it has been used to perform initialization tasks?
11When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?
12Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?
13Which TWO settings are considered best practices for hardening a Vault production listener?
14Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?
15Which THREE actions are permitted by the 'vault operator' command group?
16Which THREE factors influence the choice of a 'secret engine' configuration?
17An operations team is deploying a new Vault Enterprise cluster that will use Integrated Storage with Auto-Unseal via AWS KMS. The nodes will be provisioned in an Auto Scaling group behind a load balancer. They want to minimize manual steps during initial cluster formation and ensure that nodes can automatically join when scaled. Which configuration approach should they use?
18An operations team is deploying Vault Enterprise with Integrated Storage across three nodes. They want to ensure that if one node fails, the cluster remains available for both reads and writes. They also want to minimize the risk of split-brain scenarios. Which of the following configurations should they use?
19A Vault Enterprise cluster is configured with Performance Standby nodes to scale read operations. An administrator notices that some write requests are being forwarded to the active node, causing increased latency. They want to ensure that write requests are handled as efficiently as possible. Which statement correctly describes the behavior of Performance Standby nodes regarding write operations?
20A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)
21An administrator is configuring a new Vault Enterprise server that will use Integrated Storage. They need to specify the storage stanza in the configuration file. Which TWO parameters are required within the 'storage "raft"' stanza to ensure the node can participate in the cluster? (Choose two.)
22You are setting up a Vault Enterprise server and want to enable the web UI for administrators. Which configuration setting must be added to the Vault configuration file?
23A Vault administrator is preparing a server configuration file for a new Vault Enterprise installation. They want to ensure that the Vault UI is accessible and that the server listens on all network interfaces for API requests. Which configuration settings should they use?
24A Vault Enterprise administrator is configuring a server to use a custom plugin directory for external secrets engines. The plugin binaries are stored in /opt/vault/plugins. The administrator wants Vault to load plugins from this directory and also wants to ensure that plugins are not automatically downloaded from the internet. Which configuration parameter must be set in the Vault server configuration file?
25A Vault Enterprise cluster is configured with Auto-Unseal using AWS KMS. The security team rotates the KMS key used for Auto-Unseal. After rotation, Vault nodes are restarted. What is the expected behavior when the nodes attempt to unseal?
26A Vault Enterprise cluster is deployed across three availability zones in AWS. The administrator wants to ensure that the cluster can tolerate the loss of an entire availability zone without losing quorum. The cluster uses Integrated Storage. How many Vault nodes should be deployed, and what is the minimum number of nodes required to maintain quorum after such a loss?
Be able to write and edit Vault server HCL config, restart to apply changes, and reason about seal, storage, listener, and audit behavior. The critical point: Vault fails closed when an enabled audit device cannot write, so audit availability is operationally mandatory.
The Courseiva Vault Enterprise question bank contains 26 questions in the Vault Server Configuration domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Vault Server Configuration domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included