Vault Enterprise Practice Test 10 — 10 Questions

Question 1

You are operating a Vault Enterprise cluster with Integrated Storage (Raft) and Performance Replication enabled. The primary cluster has three nodes, and the secondary cluster has three nodes. During a planned maintenance window, you need to take down the primary cluster for two hours. You want the secondary cluster to continue serving read requests for replicated data but not accept writes to avoid conflicts when the primary returns. Which action should you take on the secondary cluster before taking down the primary?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Do nothing; the secondary cluster already serves reads and rejects writes to replicated data.. A Performance Replication secondary cluster inherently serves read requests for replicated data and rejects writes to those paths unless it is promoted to primary. This design allows for read scaling and disaster recovery without manual intervention. During primary downtime, the secondary continues to function as a read-only replica, so no configuration change is required to maintain that behavior.

Answer

Demote the primary cluster to secondary and then promote the secondary cluster to primary.

Answer

Promote the secondary cluster to primary using 'vault operator promote'.

Answer

Set the secondary cluster to 'read-only' mode using 'vault write sys/replication/performance/secondary/read-only'.

Question 2

An administrator is configuring a new Vault Enterprise server that will use Integrated Storage. They need to specify the storage stanza in the configuration file. Which TWO parameters are required within the 'storage "raft"' stanza to ensure the node can participate in the cluster? (Choose two.)

Accepted Answer

node_id. For a Vault node using Integrated Storage, the 'path' and 'node_id' parameters are required within the 'storage "raft"' stanza. The 'path' defines where data is stored, and 'node_id' uniquely identifies the node in the Raft cluster. Other parameters like 'retry_join' are used for joining but can be replaced by the 'discovery' stanza, and tuning parameters are optional.

Answer

max_entry_size

Answer

retry_join

Answer

performance_multiplier

Question 3

You are scaling a Vault Enterprise cluster to handle a high volume of database credential generation. You configure the database secrets engine with a maximum open connections setting of 100 and a maximum idle connections setting of 20. After a few hours, you notice that the number of open connections to the database frequently reaches 100 and stays there, even when request rates are moderate. You want to reduce the connection churn and improve performance without changing the maximum open connections. What should you do?

Accepted Answer

Increase the maximum idle connections setting to a value closer to the maximum open connections.. The database secrets engine maintains a connection pool to the database. When max_idle_connections is set too low relative to max_open_connections, idle connections are closed and must be recreated when new requests arrive, causing churn and performance degradation. Raising max_idle_connections allows more connections to remain idle and be reused, reducing the overhead of establishing new connections while still respecting the maximum open connections limit.

Answer

Reduce the maximum open connections setting to force the pool to recycle connections more aggressively.

Answer

Enable the database secrets engine's connection pooling by setting a longer max_connection_lifetime.

Answer

Configure the database secrets engine to use a dynamic username template to reduce the number of distinct connections.

Question 4

An operator is troubleshooting a Vault Enterprise cluster where audit logs show that a token was used from an unexpected IP address. The security team wants to enforce that a particular token can only be used from the corporate CIDR block 10.0.0.0/8. Which Vault token parameter should be set to achieve this?

Accepted Answer

token_bound_cidrs. The token_bound_cidrs parameter is specifically designed to restrict a token's usage to a set of CIDR blocks. By setting it to 10.0.0.0/8, the token will only be accepted from IP addresses within that range, directly mitigating the risk of use from unexpected locations. Other parameters like token_num_uses or token_ttl address different aspects of token security and do not provide IP-based restrictions.

Answer

token_num_uses

Answer

token_explicit_max_ttl

Answer

token_ttl

Question 5

You are configuring Vault Agent auto-auth with the AppRole auth method on a set of servers. You need to ensure that the agent can authenticate securely using role_id and secret_id. Which two configuration parameters are required within the auto_auth method block for AppRole? (Choose two.)

Accepted Answer

role_id. For AppRole authentication in Vault Agent's auto_auth stanza, both role_id and secret_id are mandatory. They provide the necessary credentials to authenticate. Optional parameters like namespace and mount_path are only needed in specific configurations, such as when using a custom namespace or mount path. wrap_ttl is unrelated to the method block and is used for response wrapping in sinks.

Answer

namespace

Answer

wrap_ttl

Answer

mount_path

Question 6

An operations team is deploying a new Vault Enterprise cluster that will use Integrated Storage with Auto-Unseal via AWS KMS. The nodes will be provisioned in an Auto Scaling group behind a load balancer. They want to minimize manual steps during initial cluster formation and ensure that nodes can automatically join when scaled. Which configuration approach should they use?

Accepted Answer

Use a cloud auto-join mechanism such as 'discovery' stanza with AWS tags or a Consul service registry, and configure Auto-Unseal with AWS KMS.. In dynamic environments like Auto Scaling groups, static IP addresses are unreliable. Cloud auto-join with the 'discovery' stanza allows nodes to find each other using cloud provider metadata or a service registry. When combined with Auto-Unseal via AWS KMS, nodes can automatically unseal and join the cluster without manual intervention. This is the recommended pattern for scalable Vault Enterprise deployments.

Answer

Manually run 'vault operator raft join' on each new node after provisioning, specifying the leader's API address.

Answer

Configure 'cluster_addr' to point to the load balancer, and use the load balancer to distribute join requests to existing nodes.

Answer

Configure each node with a static 'retry_join' stanza that includes the IP addresses of all initial nodes, and rely on the Auto-Unseal configuration to unseal the nodes automatically.

Question 7

You are the Vault operator for a financial services company. Your Vault Enterprise cluster runs Integrated Storage and is approaching its maximum write throughput during peak trading hours. You need to increase write scalability without changing the client API or adding a separate Disaster Recovery cluster. Which action should you take?

Accepted Answer

Increase the number of nodes in the Integrated Storage cluster and ensure the active node has sufficient CPU and disk IOPS.. Scaling write throughput in Vault Enterprise with Integrated Storage is achieved by increasing the number of Raft nodes and ensuring the active node has sufficient resources. Performance Standby nodes only offload reads, and Performance Replication secondaries do not accept arbitrary writes. Adding independent clusters changes the client model and is not a supported scaling approach.

Answer

Enable Performance Replication and promote a secondary cluster to handle writes.

Answer

Add more Performance Standby nodes behind the active load balancer.

Answer

Deploy a second Vault cluster with its own Integrated Storage and configure the clients to write to both clusters.

Question 8

A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling, they notice that the storage backend contains wrapped values for the barrier key and some data encryption keys, but not for all keys. Which statement explains why only some keys are wrapped?

Accepted Answer

Seal Wrap wraps keys only when the mount or key is explicitly configured to use it, so keys created before enabling or without the setting remain unwrapped.. Seal Wrap is not global by default; it applies to the barrier key and to key material for mounts or keys explicitly configured to use it. Keys created before enabling Seal Wrap, or on mounts where it is not enabled, remain unwrapped. This explains the partial wrapping seen in storage without implying any HSM fault or mechanism limitation.

Answer

The HSM is returning CKR_USER_NOT_LOGGED_IN for some operations, causing Vault to skip wrapping those keys.

Answer

Seal Wrap requires the HSM to support CKM_AES_KEY_WRAP; if unsupported, Vault wraps only the barrier key.

Answer

Seal Wrap only wraps the root key and recovery keys, not any data encryption keys.

Question 9

You are operating a Vault Enterprise cluster with Integrated Storage (Raft) and Performance Replication enabled. The primary cluster has three nodes, and the secondary cluster has three nodes. During a planned maintenance window, you need to take down the primary cluster for two hours. You want the secondary cluster to continue serving read requests for replicated data but not accept writes to avoid conflicts when the primary returns. Which action should you take on the secondary cluster before taking down the primary?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The write request is forwarded to the primary cluster, which processes it and replicates the change back to the secondary.. In Performance Replication, secondary clusters are designed to service read requests locally to reduce latency, but all write requests are forwarded to the primary cluster. The primary processes the write and replicates the change back to the secondary. This ensures that there is a single authoritative source for writes and maintains data consistency across clusters. The client's write request is transparently forwarded, and the client receives a response as if the write were processed locally.

Answer

The write request is processed locally on the secondary and then asynchronously replicated to the primary.

Answer

The write request is queued on the secondary and processed once the secondary is promoted to primary.

Answer

The write request fails with a 'permission denied' error because the secondary is read-only.

Question 10

You are configuring Vault Agent auto-auth with the AWS auth method. The agent must authenticate using an IAM role attached to an EC2 instance. Which two parameters are required in the auto_auth block's method configuration to enable this? (Choose two.)

Accepted Answer

type = "aws". To configure AWS auto-auth using an IAM role, the agent needs to know the auth method type and the Vault role to authenticate against. The `type` and `role` parameters are required. Static credentials like access key and secret key are not used when relying on instance metadata, and the region is optional.

Answer

secret_key = "secret"

Answer

region = "us-east-1"

Answer

access_key = "AKIA..."