Vault Enterprise Practice Test 12 — 15 Questions

Question 1

A Vault Enterprise administrator is preparing a new cluster that will use a PKCS#11 HSM for auto-unseal. Before starting Vault, they need to confirm the HSM library is discoverable. Which environment variable or configuration field should they set to point Vault to the PKCS#11 library?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the lib parameter in the seal stanza to the absolute path of the PKCS#11 library.. Vault locates the PKCS#11 library through the lib field in the seal stanza, which must contain the absolute path to the vendor's shared library. Environment variables and plugin directories are not used for this purpose. Setting lib correctly is a prerequisite for PKCS#11 auto-unseal to initialize.

Answer

Set the LD_LIBRARY_PATH to include the HSM library directory and omit the lib field.

Answer

Export the VAULT_HSM_LIB environment variable to the library path before starting Vault.

Answer

Place the library in the Vault plugin directory and reference it by filename only.

Question 2

A Vault Enterprise cluster is configured with Performance Standby nodes to scale read operations. An administrator notices that some write requests are being forwarded to the active node, causing increased latency. They want to ensure that write requests are handled as efficiently as possible. Which statement correctly describes the behavior of Performance Standby nodes regarding write operations?

Accepted Answer

Performance Standby nodes forward write requests to the active node, but they can handle read requests locally, reducing load on the active node.. Performance Standby nodes in Vault Enterprise are designed to scale read operations by handling reads locally while forwarding writes to the active node. This architecture allows the active node to focus on write operations and consensus, improving overall cluster performance. Write forwarding is automatic and transparent, so clients do not need to change their behavior. This is a core feature for high-throughput read-heavy workloads.

Answer

Performance Standby nodes can process write requests locally if the write is to a performance secondary cluster.

Answer

Performance Standby nodes can process write requests if they are configured with a local storage backend that supports multi-node writes.

Answer

Performance Standby nodes reject write requests with an error, requiring clients to retry against the active node.

Question 3

A Vault Enterprise cluster uses a Control Group to require approval for reading secrets at "secret/data/prod/*". A user with a token that has a policy granting read on that path attempts to read a secret but is blocked pending approval. Which statement accurately describes the token's capabilities during the pending approval?

Accepted Answer

The token can still read other secrets not under the Control Group's path.. Control Groups restrict only the protected paths, leaving the token's other capabilities intact. The token is not revoked, its TTL is not paused, and no privilege level bypasses the approval requirement. This design allows granular control without disrupting other operations.

Answer

The token can bypass the Control Group if it has a higher privilege level.

Answer

The token is immediately revoked and must be reissued after approval.

Answer

The token's TTL is paused until approval is granted or denied.

Question 4

A Vault Enterprise cluster is configured with a performance standby and a disaster recovery (DR) replica. The administrator wants to ensure that if the primary cluster fails, the DR replica can be promoted and clients can continue to access secrets without re-authenticating. Which statement about token replication is true?

Accepted Answer

Tokens are replicated to DR replicas, allowing clients to use existing tokens after promotion.. Token replication in Vault Enterprise ensures that tokens are available on DR replicas. When a DR replica is promoted, clients can continue using their existing tokens, providing seamless failover. This is a key benefit of Vault Enterprise's replication capabilities.

Answer

Token replication only occurs if the DR replica is in the same datacenter as the primary.

Answer

Tokens are replicated to performance standbys but not to DR replicas.

Answer

Tokens are not replicated; clients must re-authenticate after DR promotion.

Question 5

A Vault Enterprise cluster is experiencing intermittent performance issues. The operations team has enabled telemetry and is collecting metrics via StatsD. They notice that the `vault.runtime.alloc_bytes` metric is steadily increasing over several days without a corresponding increase in active tokens or leases. What is the most likely explanation for this trend?

Accepted Answer

A memory leak in a plugin or Vault itself is causing allocations to accumulate without being released.. The `vault.runtime.alloc_bytes` metric is a gauge that shows the current memory allocated by Vault. A steady increase over days without increased load suggests a memory leak. This could stem from Vault's core or a plugin. Operators should investigate by checking recent changes, reviewing logs, and using profiling tools. While a restart can temporarily alleviate the issue, identifying and fixing the leak is essential. The other options either mischaracterize the metric or suggest normal behavior when the trend is abnormal.

Answer

The metric is cumulative and will always increase over time, so it should be monitored as a rate rather than a gauge.

Answer

The StatsD sink is aggregating the metric incorrectly, causing it to appear as a monotonically increasing value.

Answer

The increase is normal and reflects memory fragmentation, which Vault does not reclaim until a restart.

Question 6

You manage a Vault Enterprise cluster with Performance Replication enabled. The primary cluster is in us-east-1 and a secondary cluster is in eu-west-1. Clients in eu-west-1 are experiencing high read latency even though replication lag is consistently low. You have already verified that the secondary is healthy and has Performance Standby nodes. What is the most likely cause?

Accepted Answer

The secondary cluster's Integrated Storage is undersized or has high disk latency, causing slow local reads.. Performance Secondary clusters serve reads locally from their own Integrated Storage. Even with low replication lag, slow reads can occur if the secondary's storage is undersized or has high disk latency. The primary's replication speed and WAN traversal are not factors when lag is low and reads are local.

Answer

The secondary cluster is in a different region, so all reads must traverse the WAN to the primary.

Answer

The primary cluster is not sending replication data to the secondary fast enough.

Answer

The secondary cluster's Performance Standby nodes are not configured to forward reads to the active node.

Question 7

A junior operator notices that the standby nodes in a three-node Vault Enterprise cluster report a sealed status after a planned restart, while the active node is unsealed. They want to confirm cluster readiness before adding the nodes back to the load balancer. Which endpoint should they query on each node to determine seal status and standby state programmatically?

Accepted Answer

/v1/sys/seal-status. The seal-status endpoint is unauthenticated and returns sealed, initialized, standby, and cluster fields, which is precisely the information needed to confirm a node is unsealed and ready before returning it to service. The leader endpoint describes leadership only, mounts requires authentication and says nothing about sealing, and health is aimed at automated probes rather than direct seal verification.

Answer

/v1/sys/mounts

Answer

/v1/sys/health

Answer

/v1/sys/leader

Question 8

Your Vault Enterprise cluster is configured with a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you restore a snapshot to a new cluster that also has the same HSM seal configuration. After starting the new cluster, Vault remains sealed and logs indicate a PKCS#11 error. What is the most likely cause?

Accepted Answer

The new cluster cannot authenticate to the HSM because the token label or PIN in its seal configuration does not match the HSM partition.. Auto-unseal with PKCS#11 requires Vault to authenticate to the same HSM partition and use the same key. When restoring to a new cluster, the seal configuration must reference the correct token_label and pin. If these do not match, Vault cannot log in to the HSM and remains sealed. The most likely cause is a mismatch in token label or PIN.

Answer

The snapshot must be decrypted with the old cluster's unseal keys before the HSM can be used.

Answer

The HSM key used for seal wrap was not included in the snapshot and must be recreated on the HSM.

Answer

The new cluster requires a different PKCS#11 library version that matches the HSM firmware.

Question 9

Your organization uses Vault Enterprise with Performance Replication to replicate secrets across multiple data centers. You are planning a failover test where the primary cluster will be taken offline. You need to ensure that the secondary cluster can be promoted to primary without data loss. Which two actions must you perform before the failover to guarantee a clean promotion? (Choose two.)

Accepted Answer

Ensure that the secondary cluster is unsealed and has a valid license that includes Performance Replication.. Before promoting a Performance Replication secondary, you must ensure it is healthy and synchronized. Checking the replication status confirms that the secondary is receiving updates and is not lagging. Additionally, the secondary must be unsealed and have a valid license that includes Performance Replication. These steps guarantee a clean promotion with minimal data loss. Other actions like snapshot restore or disabling replication are unnecessary and can disrupt the process.

Answer

Disable Performance Replication on the primary before taking it offline.

Answer

Run 'vault operator raft snapshot save' on the primary and restore it on the secondary.

Answer

Configure the secondary to use a different seal mechanism than the primary.

Question 10

A Vault Enterprise administrator is designing an HSM integration that must survive the loss of a single HSM appliance. The design uses PKCS#11 auto-unseal and Seal Wrap. Which TWO considerations are critical to ensure availability and data recoverability? (Choose two.)

Accepted Answer

Configure the seal stanza with a list of HSM endpoints or a load-balanced address so Vault can fail over to a secondary HSM.. Surviving a single HSM appliance failure requires both redundant HSM access and recoverable wrapping key material. Configuring multiple endpoints or a load-balanced address lets Vault fail over, while backing up and restoring the wrapping key ensures data can be decrypted on a replacement HSM. Universal Seal Wrap, plaintext PINs, and software fallback do not address these core requirements.

Answer

Configure Vault to use a software seal as a fallback if the HSM is unavailable.

Answer

Store the HSM PIN in Vault's configuration file in plaintext to ensure Vault can always authenticate.

Answer

Enable Seal Wrap on all mounts and rotate all keys immediately after enabling it.

Question 11

An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for auto-unseal. The HSM supports PKCS#11. After configuring the seal stanza, Vault fails to start. Which action should the administrator take to troubleshoot the issue?

Accepted Answer

Check the Vault server logs for errors related to the HSM connection and verify the PKCS#11 library path.. The most effective troubleshooting step is to review Vault's server logs, which will contain specific error messages about the HSM connection, such as a missing PKCS#11 library or authentication failure. Verifying the library path and credentials directly addresses common misconfigurations. The other options are either too broad or do not target the root cause.

Answer

Reinstall the HSM firmware to ensure compatibility with Vault.

Answer

Increase the Vault server's memory allocation to accommodate the HSM library.

Answer

Disable the HSM seal and use Shamir seals instead to verify Vault can start.

Question 12

Which TWO of the following factors can cause a Vault cluster to lose quorum in a Raft-based deployment?

Accepted Answer

Loss of a majority of the nodes in the Raft voting set.. Option A is correct because Raft requires a majority of voting nodes (quorum) to commit log entries and elect a leader; losing more than half of the voting set means no quorum can be achieved, halting writes and leader election. Option D is correct because a network partition that isolates nodes from the leader can split the cluster such that neither side retains a majority of voters, preventing quorum and causing the cluster to lose its ability to operate. Option B is wrong because a load balancer health check failure only affects traffic routing to that follower, not Raft consensus or quorum. Option C is wrong because enabling performance replication is a supported enterprise feature that does not itself break Raft quorum. Option E is wrong because an incorrect api_addr on a follower affects client redirection and cluster address advertisement, not the Raft voting quorum.

Answer

The load balancer health check fails on a follower.

Answer

Enabling performance replication on the cluster.

Answer

The 'api_addr' is configured incorrectly on a follower.

Question 13

Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?

Accepted Answer

vault status. The 'vault status' command reports the seal configuration and status of a Vault node, including whether auto-unseal is in use and, for HSM-backed seals, details about the seal type. It is the standard CLI command to check seal state and confirm HSM usage. Running it against a Vault server shows fields like 'Seal Type: hsm' when HSM auto-unseal is configured.

Answer

vault operator hsm-check

Answer

vault read sys/seal-config

Answer

vault seal-status

Question 14

You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?

Accepted Answer

Run 'vault operator raft join'.. Before a new Vault node can participate in an Integrated Storage (Raft) cluster, it must be joined to the existing cluster using 'vault operator raft join' with the leader's API address. This command registers the node with the Raft cluster so it can receive the encrypted snapshot and begin replicating. Without this step, the node starts as a standalone Vault instance and never joins the quorum.

Answer

Disable TLS.

Answer

Delete the old configuration file.

Answer

Format the filesystem.

Question 15

What is the purpose of the 'cluster_addr' in the Vault server configuration?

Accepted Answer

To allow communication between Vault cluster nodes.. The 'cluster_addr' directive in the Vault server configuration specifies the address that Vault uses for communication between nodes in a Vault cluster, including request forwarding and replication traffic. It is distinct from 'api_addr', which is used for client-facing API requests. This setting is essential for multi-node Vault deployments to ensure internal cluster traffic is routed correctly.

Answer

To mount storage backends.

Answer

To handle client API requests.

Answer

To communicate with external secret engines.