HashiCorp · Free Practice Questions · Last reviewed May 2026
48real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which component is responsible for receiving and responding to read requests in a Performance Standby configuration?
The Active Vault node.
The Consul agent.
The Vault API Gateway.
The Performance Standby node.
Performance standby nodes are designed to serve local read requests.
Your organization requires fine-grained control over what data is synchronized to a specific Performance Secondary cluster to reduce storage overhead. Which feature should you implement?
Replication path filters
Replication path filters restrict the data synchronized to performance secondaries.
Namespace isolation policies
Mount tuning with local=true
Performance Standby path filtering
You are using Batch tokens in your environment to improve performance. A developer asks why their Batch token cannot be revoked individually. What is the primary reason?
Batch tokens are stateless and not persisted in the storage backend.
Because they are not persisted, Vault cannot track them for individual revocation.
The performance standby nodes do not support Batch token revocation.
Batch tokens are only supported for transit engine operations.
Batch tokens have a hard-coded TTL that cannot be overridden.
You are configuring a Vault Performance Replication cluster to improve latency for read-heavy workloads. A client application reports that it is receiving 403 Forbidden errors when attempting to read secrets from a Performance Secondary cluster. What is the most likely cause?
The Performance Secondary is in a sealed state due to a replication lag.
The Performance Secondary node has not been initialized with a separate encryption key.
The client is using a Batch token, which is not supported on performance secondaries.
ACL policies are not being replicated to the Performance Secondary.
ACL policies must be replicated to performance secondaries for tokens to have authorization scopes verified locally.
You are observing high latency for read requests on a Performance Secondary cluster. You verify that the replication lag is near zero. What is the most likely cause for the read latency?
The secondary node is not configured as a performance standby.
The primary node is unavailable.
The secondary node has too few resources allocated to handle the read request rate.
If the node is under-provisioned, read latency will increase even if replication is healthy.
The secondary node is missing the required policies.
An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?
Performing a Transit engine encryption.
Renewing the token.
Batch tokens cannot be renewed.
Authenticating with a configured auth method.
Reading a secret from the KV engine.
Want more Scaling Vault For Performance practice?
Practice this domainYou have enabled 'seal_wrap' in Vault Enterprise. Which specific cryptographic operation is performed by the HSM under this feature?
Signing Vault audit logs.
Generating random numbers for the entropy pool.
Encrypting the Master Key Encryption Key (KEK).
Seal Wrap provides a layer of protection by wrapping the KEK with an HSM-backed key.
Performing TLS termination for Vault clients.
You are configuring Vault to use a Network HSM. The connection is intermittent. Which configuration parameter controls the timeout for HSM communication?
hsm_timeout
timeout
The 'timeout' parameter in the seal stanza manages the duration of the HSM request.
connection_timeout
max_request_time
You are troubleshooting a performance issue where Vault seems to be stalling during cryptographic operations. You suspect the HSM is the bottleneck. Which Vault metric should you examine to confirm HSM latency?
vault.transit.request_duration
vault.seal.hsm.request_duration
This metric captures the time spent communicating with the HSM.
vault.hsm.session_count
vault.core.seal_setup
Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?
The library must be statically linked into the Vault binary.
The library must be PKCS#11 compliant.
Vault communicates with HSMs via the PKCS#11 standard.
The library must be written in Go.
The library must support the KMIP protocol.
When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?
token_label
partition_id
slot
The 'slot' parameter is the standard way to specify the HSM partition.
hsm_id
You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?
Vault automatically detects the HSM and attempts to unseal.
The seal configuration includes retry logic for HSM connectivity.
Vault will transition to a 'permanently sealed' state and require a re-install.
The unseal process requires a restart of the Vault service.
Vault requires a manual 'vault operator unseal' command to trigger a retry.
Want more Hsm Integration practice?
Practice this domainWhat is the purpose of the 'cluster_addr' in the Vault server configuration?
To mount storage backends.
To allow communication between Vault cluster nodes.
It defines the address used for internal cluster traffic.
To handle client API requests.
To communicate with external secret engines.
A Vault performance standby node receives a request. What happens if the request is a write operation?
The request is forwarded to the active node.
Performance standby nodes proxy write requests to the leader.
The request is rejected with a 403 error.
The node processes it locally.
The node triggers an election.
When initializing a Vault server, you choose to store the recovery keys. What is the main security advantage of using recovery keys alongside Auto-Unseal?
They provide a way to bypass authentication.
They increase the encryption strength of the data at rest.
They allow for root token regeneration in an emergency.
Recovery keys are used for critical administrative tasks like root token generation.
They are required for every client login.
You are configuring a production Vault cluster using Integrated Storage. What is the most critical configuration parameter that must be set in the 'storage' stanza to ensure the node can correctly identify and join the existing Raft cluster during a bootstrap operation?
path
api_addr
retry_join
node_id
The node_id provides a unique identifier for the node within the Raft configuration.
You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?
tls_disable = true
proxy_protocol = true
tls_prefer_server_cipher_suites = false
tls_disable = false
Setting this to false ensures the listener requires TLS.
You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?
vault operator rekey -init
This initializes the rekey process allowing for new threshold/shares.
vault operator unseal
vault secrets tune
vault operator rotate
Want more Vault Server Configuration practice?
Practice this domainWhat is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?
The user is denied access.
Explicit deny overrides any allow permissions.
The policy is considered invalid.
The user is allowed access.
The user receives a 403 Forbidden error.
Access is determined by the order of policy assignment.
An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?
Sentinel Policy
Identity Group
Control Group Policy
A policy with 'control_group' parameters defines the required approval criteria.
Auth Method
ACL Namespace
When using Namespace-based multi-tenancy, which statement is true regarding the root namespace?
The root namespace can only be managed by the root token.
Namespaces are not supported in Vault Enterprise.
The root namespace is where all child namespaces derive their identity entities.
The identity store is global at the root namespace level.
The root namespace is invisible to child namespaces.
You cannot create secrets in the root namespace.
You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?
vault.metadata
token
request
The 'request' object contains the attributes of the request being evaluated.
input
policy
In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?
The policy is automatically moved to the child namespace.
The policy overwrites child namespace policies.
The policy causes a naming collision error.
The policy is inaccessible in the child namespace.
Policies are namespaced resources and cannot be applied to child namespaces directly.
The policy is inherited by all child namespaces.
An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?
In the Namespace configuration
In the AppRole Role definition
The role configuration in the AppRole auth method allows setting 'bound_cidrs'.
In the Identity Entity
In the Token Auth Method
Inside the ACL policy
Want more Access Control Configuration practice?
Practice this domainWhen configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?
Restricts the generated Vault token to specific IP ranges.
This is a core security control for tokens.
Restricts the Kubernetes API server access.
Binds the login process to a specific pod IP.
Limits the number of simultaneous logins from an IP.
You are using the Kubernetes Auth method and want to restrict a role so that it can only be used by pods in a specific namespace. How do you implement this constraint?
Set the 'allowed_namespaces' policy on the service account.
Apply a Vault namespace to the Kubernetes pod manifest.
Use a regex in the 'token_policies' field to filter by namespace.
Define the 'bound_namespaces' parameter in the Vault role configuration.
Vault enforces this at the role level during authentication.
An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?
Issue a wrapped response for the SecretID with a specific TTL.
Response wrapping protects the secret in transit and ensures it is single-use.
Use a global static token for all AppRole authentications.
Hardcode the SecretID into the application's configuration file.
Disable the SecretID requirement and use only the RoleID.
When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?
The pod's hostname.
The contents of the mounted service account token file.
This is the standard location for the K8s service account token.
The Vault server's Root CA certificate.
The Kubernetes API server public key.
You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?
LDAP bind credentials.
Cubbyhole storage.
Response Wrapping.
It protects the delivery of the token.
Transit Secret Engine.
When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?
Enable the 'kubernetes_allow_any_token' flag in the global configuration.
Create a static secret in Vault that matches the Kubernetes service account name.
Configure the 'kubernetes_host' and 'kubernetes_ca_cert' in the auth method configuration.
Vault must be able to talk to the K8s API to validate tokens.
Manually copy the pod's service account token into the Vault server's local keyring.
Want more Vault Security Model practice?
Practice this domainHow can you view the currently enabled audit devices in a Vault cluster?
vault audit list
This is the standard CLI command to list audit backends.
vault read sys/audit
vault list audit/devices
vault status -audit
Which command is used to rotate the audit log file on a Vault server to ensure logs are written to a new file?
vault audit rotate
This command forces the audit device to rotate the log file.
vault server reload
vault operator seal
vault log rotate
An auditor notices that audit logs are missing entries for a specific mount point. What is the most likely cause?
The audit device is in a blocked state.
The audit device is not enabled for the specific path prefix.
Audit devices are global, but if the device itself is not enabled, no logs will appear.
Vault is running in dev mode.
The audit log rotation policy is set to delete logs immediately.
You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?
Vault automatically switches to the secondary audit device.
Requests are permitted for read-only operations.
All requests are allowed but a warning is logged.
All incoming requests will be rejected until the audit device is restored.
This is the fail-closed security posture of Vault.
To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?
/sys/leader
/sys/health
The /sys/health endpoint is the standard for health checking.
/sys/metrics
/sys/monitor
Which telemetry type is most effective for monitoring the 'lease' count in Vault?
Summaries
Histograms
Counters
Gauges
Gauges reflect current state values like lease counts.
Want more Monitoring Vault Environments practice?
Practice this domainWhich component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?
The load balancer.
The storage backend (e.g., Consul).
The storage backend manages the lock required for leadership.
The Vault server process configuration file.
The Vault CLI.
In a Performance Replication setup, a secondary cluster is experiencing high latency for read requests. Which action should you take to verify if the requests are being routed correctly?
Check the 'sys/metrics' endpoint to verify the number of performance standby requests.
Metrics provide visibility into whether performance standbys are handling local reads effectively.
Increase the 'max_lease_ttl' on the primary cluster.
Run 'vault write sys/replication/performance/secondary/update' to increase synchronization speed.
Restart the secondary cluster to clear the internal request cache.
You have a Performance Replication setup. A client sends a write request to a performance standby node. What happens to this request?
The standby node attempts to become the leader and process the write.
The request is cached locally until the primary is available.
The request is rejected with a 403 Forbidden.
The request is forwarded to the primary cluster.
Performance standbys forward writes to the primary cluster to maintain consistency.
In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?
1 node.
2 nodes.
3 nodes.
3 nodes provide a minimum fault-tolerant quorum.
10 nodes.
When migrating from an external storage backend to Raft, which command is used to capture the current state of the cluster for migration?
vault operator raft snapshot save
This is the correct command to capture state for migration/backup.
vault operator migrate
vault write sys/storage/backup
vault operator seal
You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?
Manually re-import all secret engines from an external backup file.
Enable Performance Replication between the new primary and the old primary.
Re-initialize the cluster using 'vault operator init'.
Update your load balancer configuration to point to the new promoted cluster.
Clients must be redirected to the new cluster to continue operations.
Want more Fault Tolerant Vault Environments practice?
Practice this domainWhere does the Vault Agent store the token it retrieves via auto-auth by default if a sink is not defined?
/tmp/vault.token
/var/run/vault/token
Environment variable VAULT_TOKEN
In-memory
Without a sink, the token exists only in the agent's memory.
When configuring Vault Agent caching, you notice that the cache is not effectively reducing requests. Which configuration parameter controls the lifespan of cached items?
max_ttl
max_ttl sets the ceiling for cached items.
ttl
expiry
cache_timeout
You are configuring a Vault Agent to authenticate via the AppRole method. Which configuration block is required to define the role ID and secret ID path for the agent?
auth_method
auto_auth
The auto_auth block handles the authentication process for the agent.
vault_agent
secrets
When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?
identity
iam_role
aws_role
role
The 'role' parameter defines the Vault role to be used.
You are using Vault Agent templates to generate a configuration file. You need the template to include a secret from a KV v2 engine. What is the correct syntax within the template file?
{{ get "kv/config" }}
{{ secret "kv/data/config" }}
The 'secret' function retrieves data from the specified path.
{{ vault_read "kv/config" }}
$vault.read("kv/config")
You have multiple Vault Agent instances running in a cluster. You want to ensure they all use the same cache configuration. How can you share the cache configuration between them?
By setting 'shared_cache = true' in the configuration.
By mounting a shared volume.
It is not possible to share the cache.
Vault Agent caching is local to each individual agent process.
By configuring a shared Redis backend.
Want more Vault Agent Configuration practice?
Practice this domainThe Vault Enterprise exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 8 domains: Scaling Vault For Performance, Hsm Integration, Vault Server Configuration, Access Control Configuration, Vault Security Model, Monitoring Vault Environments, Fault Tolerant Vault Environments, Vault Agent Configuration. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official HashiCorp Vault Enterprise exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.