HashiCorp · Free Practice Questions · Last reviewed May 2026
48 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?
The library must be statically linked into the Vault binary.
The library must be PKCS#11 compliant.
Vault's PKCS#11 auto-unseal mechanism calls the library's standard C_* functions to wrap and unwrap the root key, so the library must expose the PKCS#11 API surface. Compliance with that specification is the stated requirement; vendor-specific extensions are irrelevant.
The library must be written in Go.
The library must support the KMIP protocol.
You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?
The transit engine is disabled until the 're-wrap' command is issued.
Vault automatically re-wraps all existing keys upon service startup.
Only keys created or rotated after the configuration change will be wrapped by the HSM.
Seal Wrap only protects keys generated or rotated after enabling it; existing transit keys remain unwrapped until rotated. This satisfies the stem's restart scenario because Vault does not retroactively wrap stored keys, so previously created data keys stay in their original, non-HSM-protected form until rotation occurs.
Vault will return an error until all transit keys are manually deleted.
What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?
It provides backup redundancy for the Vault data.
It allows Vault to unseal without manual intervention.
HSM Auto-Unseal delegates the master key decryption to a hardware security module, so Vault retrieves the unseal key automatically at start-up or restart. This removes the manual Shamir key-entry requirement, directly satisfying the stem's constraint: eliminating operator intervention to unseal nodes after reboots or outages.
It replaces the need for TLS encryption.
It increases the throughput of the storage backend.
When configuring the PKCS#11 library, how does Vault find the library on the host OS?
The path is provided in the 'lib' field of the seal configuration.
The seal stanza's lib field holds the filesystem path to the PKCS#11 shared library, for example the HSM vendor's .so file. Vault loads that path from the host OS, so an incorrect location prevents the seal from initialising.
The path is defined in the Vault environment variables.
Vault expects the library to be located in '/usr/lib/vault'.
Vault looks in the LD_LIBRARY_PATH environment variable by default.
During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?
Vault waits until the primary HSM is back online.
Vault automatically detects the secondary HSM and switches over.
Vault fails over to Shamir's Secret Sharing mode.
Vault requires a manual update to the seal configuration and a restart.
Vault does not automatically fail over between HSMs; the seal stanza references one HSM configuration. Switching to the secondary requires editing the seal block and restarting each node, satisfying the stem's failover scenario because no runtime HSM switching mechanism exists.
What permission level is required for the user account used to authenticate with the HSM?
The account must be the partition owner.
The account must have anonymous access.
The account must have Crypto User (CU) privileges.
Crypto User (CU) privileges provide the minimum role needed for key operations such as generating, encrypting and decrypting, without granting administrative control over the HSM. This satisfies the stem's requirement for the authenticating account, since Vault Enterprise only needs operational access to the key material, not Crypto Officer rights.
The account must have full Administrative (SO) privileges.
Want more Hsm Integration practice?
Practice this domainWhich component is responsible for receiving and responding to read requests in a Performance Standby configuration?
The Active Vault node.
The Consul agent.
The Vault API Gateway.
The Performance Standby node.
Performance Standby nodes serve read-only requests locally, forwarding writes to the active node. This read scaling is their defining function, so the Performance Standby node receives and responds to read requests, satisfying the stem's scenario directly.
Your organization requires fine-grained control over what data is synchronized to a specific Performance Secondary cluster to reduce storage overhead. Which feature should you implement?
Replication path filters
Replication path filters let you exclude specific mount paths from being replicated to a Performance Secondary, directly reducing its storage footprint. This satisfies the fine-grained control requirement by allowing selective synchronisation rather than replicating all data.
Namespace isolation policies
Mount tuning with local=true
Performance Standby path filtering
You are using Batch tokens in your environment to improve performance. A developer asks why their Batch token cannot be revoked individually. What is the primary reason?
Batch tokens are stateless and not persisted in the storage backend.
Batch tokens are not written to Vault's storage backend; they exist only as self-contained encrypted blobs, so there is no accessor record to revoke. This statelessness is precisely what delivers their performance benefit, and it is the reason individual revocation is impossible.
The performance standby nodes do not support Batch token revocation.
Batch tokens are only supported for transit engine operations.
Batch tokens have a hard-coded TTL that cannot be overridden.
An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?
Performing a Transit engine encryption.
Renewing the token.
Batch tokens are non-renewable by design, so any renewal attempt fails immediately. This satisfies the stem's constraint directly: the token type itself prohibits the renew operation, unlike service tokens which support renewal via `auth/token/renew`. The failure is inherent to the batch token's encrypted, stateless structure, not a policy restriction.
Authenticating with a configured auth method.
Reading a secret from the KV engine.
When utilizing performance replication, your Vault cluster experiences high replication lag between the primary and secondary sites. Which action would most effectively reduce this lag?
Configure path filters to exclude high-churn paths from replication.
Path filters let you exclude high-churn paths from replication, directly cutting the volume of write-ahead log entries shipped to secondaries. Less replicated data means the secondary applies the log faster, reducing measured replication lag at the primary.
Convert the secondary cluster to a Disaster Recovery secondary.
Increase the number of Performance Standby nodes.
Enable Batch token replication.
You are managing a multi-region Vault deployment with Performance Replication. You notice that a specific secret engine mount is not being replicated to the secondary site. What should you check?
The replication_filter configuration.
The namespace's 'replicated' flag.
The mount's 'local' flag.
Mounts flagged as local are deliberately excluded from Performance Replication, so they never propagate to secondary clusters. Checking that flag directly explains why this specific secret engine is absent at the secondary site, satisfying the stem's constraint that only one mount fails to replicate while others succeed.
The secondary cluster's license status.
Want more Scaling Vault For Performance practice?
Practice this domainWhat is the purpose of the 'cluster_addr' in the Vault server configuration?
To mount storage backends.
To allow communication between Vault cluster nodes.
The `cluster_addr` setting specifies the address and port each node advertises for inter-node cluster traffic, enabling replication and request forwarding between Vault servers. It satisfies the stem's requirement by designating the dedicated listener used for node-to-node communication, distinct from the `api_addr` used for client requests.
To handle client API requests.
To communicate with external secret engines.
A Vault performance standby node receives a request. What happens if the request is a write operation?
The request is forwarded to the active node.
Performance standby nodes cannot service writes, since only the active node holds the write-ahead log and storage backend. The standby therefore forwards the write request over the cluster port to the active node, which processes it and replicates the result back.
The request is rejected with a 403 error.
The node processes it locally.
The node triggers an election.
You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?
tls_disable = true
proxy_protocol = true
tls_prefer_server_cipher_suites = false
tls_disable = false
Setting tls_disable = false forces the listener to serve TLS, encrypting all client-to-Vault traffic and preventing cleartext communication. This satisfies the stem's hardening requirement, since the default listener configuration permits plaintext HTTP unless TLS is explicitly enabled with certificates.
You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?
vault operator rekey -init
vault operator rekey -init starts a rekey operation and accepts new key configuration such as -key-shares and -key-threshold, allowing the number of shares to change. This satisfies the stem's requirement to alter key configuration during rekey.
vault operator unseal
vault secrets tune
vault operator rotate
A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?
Update the 'kms_key_id' in the configuration file.
Restart the Vault process to reload the KMS configuration.
Run vault operator rekey to update the master key.
No action is required, assuming IAM permissions are correctly maintained.
Vault stores only the KMS key identifier and relies on IAM permissions to call Decrypt; AWS KMS rotation creates new backing key material under the same key ID, so no Vault reconfiguration is needed provided permissions persist.
What is the primary function of the 'ui = true' configuration setting?
Enable command-line interface tools.
Enable the web-based graphical interface.
Setting ui = true activates Vault's built-in web-based graphical interface, allowing browser access to manage secrets, policies and authentication. Without it, the UI listener is not served, so operators must use the CLI or API instead.
Enable auto-unseal.
Increase API throughput.
Want more Vault Server Configuration practice?
Practice this domainWhat is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?
The user is denied access.
Vault evaluates deny as an absolute override: any matching deny capability wins regardless of allow elsewhere. A single policy denying the path therefore blocks access, even where another policy grants it, satisfying the stem's conflicting-policy scenario.
The policy is considered invalid.
The user is allowed access.
The user receives a 403 Forbidden error.
Access is determined by the order of policy assignment.
An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?
Sentinel Policy
Identity Group
Control Group Policy
A Control Group Policy is the Vault object that wraps specified paths, requiring authoriser approval before the requesting user's token can read the secret. Creating it defines the approval workflow, satisfying the requirement that a manager authorise each secrets request.
Auth Method
ACL Namespace
You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?
vault.metadata
token
request
The `request` parameter supplies Sentinel with the current request's metadata, including the path being accessed and the operation type, such as read or write. This satisfies the stem's requirement to restrict secret access based on request details, since policies evaluate `request.data` and `request.operation` directly.
input
policy
In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?
The policy is automatically moved to the child namespace.
The policy overwrites child namespace policies.
The policy causes a naming collision error.
The policy is inaccessible in the child namespace.
Policies are scoped strictly to the namespace where they are written; a root-namespace policy does not cascade into child namespaces. Tokens issued within the child namespace therefore cannot reference it, satisfying the impact that the policy is inaccessible there.
The policy is inherited by all child namespaces.
An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?
In the Namespace configuration
In the AppRole Role definition
The AppRole role definition carries secret_id_bound_cidrs and token_bound_cidrs parameters, which restrict issued tokens to specified CIDR blocks. Configuring token_bound_cidrs on the role satisfies the requirement that the resulting token is limited to a specific range.
In the Identity Entity
In the Token Auth Method
Inside the ACL policy
A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?
create
patch
list
read
The `read` capability grants retrieval of secrets at a specified path, satisfying the requirement for read access to the KV v2 path. It permits GET operations on that path without allowing writes, deletes or list operations, which matches the least-privilege constraint stated in the scenario.
sudo
Want more Access Control Configuration practice?
Practice this domainWhen configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?
Restricts the generated Vault token to specific IP ranges.
'token_bound_cidrs' binds the issued Vault token to the specified CIDR blocks, so the token is only usable from source IPs within those ranges. This satisfies the scenario's requirement to limit token use by network origin, enforced by Vault at request time independently of Kubernetes.
Restricts the Kubernetes API server access.
Binds the login process to a specific pod IP.
Limits the number of simultaneous logins from an IP.
An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?
Issue a wrapped response for the SecretID with a specific TTL.
A wrapped response delivers the SecretID as a single-use token; the application unwraps it once, so interception yields nothing reusable. The specific TTL bounds exposure, satisfying the requirement that secret delivery remains uncompromised for the periodically fetching legacy application.
Use a global static token for all AppRole authentications.
Hardcode the SecretID into the application's configuration file.
Disable the SecretID requirement and use only the RoleID.
When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?
The pod's hostname.
The contents of the mounted service account token file.
The Kubernetes auth method reads the pod's mounted service account token at the default path and submits its contents as the JWT. This satisfies the stem's requirement for the value automatically sent to the Vault server.
The Vault server's Root CA certificate.
The Kubernetes API server public key.
You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?
LDAP bind credentials.
Cubbyhole storage.
Response Wrapping.
Response Wrapping returns a single-use wrapping token that the VM unwraps to retrieve the real Vault token, letting provisioning deliver credentials without exposing them in logs or templates. This satisfies secure introduction for dynamic infrastructure.
Transit Secret Engine.
When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?
Enable the 'kubernetes_allow_any_token' flag in the global configuration.
Create a static secret in Vault that matches the Kubernetes service account name.
Configure the 'kubernetes_host' and 'kubernetes_ca_cert' in the auth method configuration.
Configuring `kubernetes_host` and `kubernetes_ca_cert` lets Vault reach the Kubernetes API server and trust its TLS certificate, enabling the TokenReview call that validates the pod's service account token. Without these, Vault cannot contact the cluster, so token verification fails.
Manually copy the pod's service account token into the Vault server's local keyring.
An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?
Configure the CIDR block in the 'token_policies'.
Update the 'secret_id_bound_cidrs' field in the role.
The secret_id_bound_cidrs field restricts which CIDR blocks may present a SecretID during AppRole login, so setting it enforces the stem's source-address constraint. Requests from outside the listed ranges are rejected even with a valid SecretID.
Create a custom sentinel policy for the auth method.
Update the 'token_bound_cidrs' field in the role.
Want more Vault Security Model practice?
Practice this domainHow can you view the currently enabled audit devices in a Vault cluster?
vault audit list
`vault audit list` queries the audit backend directly and returns every enabled audit device with its type and description, satisfying the stem's requirement to view currently enabled devices. Unlike `vault audit enable`, it performs no configuration change, and it reads cluster state rather than a single node's configuration file.
vault read sys/audit
vault list audit/devices
vault status -audit
You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?
Vault automatically switches to the secondary audit device.
Requests are permitted for read-only operations.
All requests are allowed but a warning is logged.
All incoming requests will be rejected until the audit device is restored.
Vault fails closed on audit failure: if no audit device can log a request, Vault rejects all client requests to preserve the audit trail. Restoring the audit device is required before requests are accepted again.
To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?
/sys/leader
/sys/health
/sys/health returns HTTP status codes reflecting seal, standby and replication states, letting an external monitor poll cluster health without authentication. It satisfies the requirement for a dedicated, unauthenticated endpoint, unlike /sys/seal-status, which reports seal state only, or /v1/sys/leader, which exposes leader details rather than overall health.
/sys/metrics
/sys/monitor
Which telemetry type is most effective for monitoring the 'lease' count in Vault?
Summaries
Histograms
Counters
Gauges
Lease count rises and falls continuously, so it needs a value sampled at scrape time rather than a cumulative total. Gauges expose that instantaneous reading, letting operators watch active leases and spot abnormal growth or leaks.
You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?
The audit file device is too slow.
The request buffer is full.
The storage backend is struggling with high frequency read/write operations.
High `core.fetch_token` latency points to Vault's token store operations, which persist tokens through the configured storage backend. When that backend cannot sustain the read/write throughput demanded by frequent token creation and lookup, each fetch blocks, inflating this metric. The constraint is storage backend performance under high-frequency token operations.
Vault is misconfigured for high availability.
Where are audit logs physically stored if the 'file' audit device is configured?
In standard system syslog.
In the storage backend database.
In the local filesystem at the configured path.
The file audit device writes entries directly to the local filesystem path specified during enablement, satisfying the requirement for on-disk storage. Vault appends JSON-formatted audit records to that file, so logs reside on the host running the Vault server rather than in memory or a remote backend.
In Vault's memory buffer.
Want more Monitoring Vault Environments practice?
Practice this domainWhich component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?
The load balancer.
The storage backend (e.g., Consul).
The storage backend provides the coordination primitive: Consul sessions and key-value locks let nodes compete for a lock, so only the holder becomes active leader. This satisfies the single-leader constraint, since Vault itself has no quorum mechanism of its own.
The Vault server process configuration file.
The Vault CLI.
In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?
1 node.
2 nodes.
3 nodes.
Raft requires a quorum of (n/2)+1 nodes to elect a leader and commit writes. Three nodes tolerate one failure while retaining quorum, satisfying the stem's fault-tolerance constraint; two would lose quorum on any single failure.
10 nodes.
You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?
Manually re-import all secret engines from an external backup file.
Enable Performance Replication between the new primary and the old primary.
Re-initialize the cluster using 'vault operator init'.
Update your load balancer configuration to point to the new promoted cluster.
Promotion leaves the secondary's nodes serving reads only until clients are redirected; the DR secondary's advertise addresses and any load balancer targets still reference the lost primary. Repointing the load balancer restores write traffic to the promoted cluster, satisfying the stem's requirement to regain full functionality immediately after promotion.
You are deploying Vault with the integrated Raft storage backend. How is high availability achieved?
By using a shared NFS mount for the data directory.
By manually mounting the storage partition across all nodes.
By using an external Consul agent as a lock provider.
By configuring nodes to join a Raft cluster and establishing consensus.
Integrated Raft storage achieves high availability by having multiple Vault nodes join one Raft cluster, electing an active node and maintaining replicated state through consensus, so standby nodes can take over if the active fails.
What is the primary difference between HA replication and DR replication in Vault?
HA replication requires Enterprise, DR does not.
DR replication uses a different storage backend.
HA replication is for performance, DR is for data durability.
HA replication forwards performance standby nodes to share request load within a primary cluster, while DR replication asynchronously replicates data to a separate secondary cluster for failover. This satisfies the stem's distinction: HA addresses throughput and availability locally, whereas DR addresses data durability and recovery across regions.
DR replication is faster than HA replication.
You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?
Only port 8200.
Port 443 and port 80.
Only port 8201.
Port 8200 and port 8201.
Raft replication traffic between clusters flows over the cluster port 8201, while 8200 carries the API and request forwarding. Both must be open bidirectionally so the secondary can receive replication streams and serve client requests.
Want more Fault Tolerant Vault Environments practice?
Practice this domainWhere does the Vault Agent store the token it retrieves via auto-auth by default if a sink is not defined?
/tmp/vault.token
/var/run/vault/token
Environment variable VAULT_TOKEN
In-memory
Without a sink, the token exists only in the agent's memory.
When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?
identity
iam_role
aws_role
role
The AWS auth method's 'method' block requires 'role' to name the IAM role whose bound principal and policies Vault uses when authenticating. Without it, Vault cannot map the signed STS identity to a configured role, so login fails.
What is the benefit of using a Vault Agent sink?
It persists the token to disk for other processes.
A sink writes the auto-auth token to a file or Unix socket, letting other processes on the host reuse it without re-authenticating. This satisfies the scenario's requirement by persisting the token to disk for other processes.
It automates the Vault server backup.
It encrypts the vault server traffic.
It compresses the template output.
Which signal is commonly used with 'change_mode = signal' in Vault Agent templates to reload a service without stopping it?
SIGKILL
SIGINT
SIGHUP
SIGHUP causes the target process to reload its configuration without terminating, letting the service pick up regenerated template files while remaining running. Other signals such as SIGTERM or SIGINT stop the process, defeating the goal of reloading without downtime.
SIGTERM
You want the Vault Agent to run as a sidecar. Which configuration block allows you to specify the listener address for the Vault Agent's internal API?
tcp_listener
listener
The listener stanza defines the address and port where Vault Agent exposes its internal API, such as a Unix socket or loopback TCP endpoint. Without it, the agent cannot serve cached tokens or secrets to the sidecar's co-located application, satisfying the requirement to specify that listener address.
server
api_listener
When using 'template_config' to set the 'static_secret_render_interval', what is the minimum value you can set?
1s
0s
5s
The `static_secret_render_interval` parameter accepts a minimum of 5 seconds, matching the stem's constraint. Values below this floor are rejected by Vault's template configuration validation, so 5s is the lowest permitted setting for controlling how frequently static secrets are re-rendered to the destination file.
10s
Want more Vault Agent Configuration practice?
Practice this domainThe vendor does not publish an exact question count for the Vault Enterprise. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 8 domains: Hsm Integration, Scaling Vault For Performance, Vault Server Configuration, Access Control Configuration, Vault Security Model, Monitoring Vault Environments, Fault Tolerant Vault Environments, Vault Agent Configuration. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official HashiCorp Vault Enterprise exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.