Vault Enterprise Practice Test 14 — 15 Questions

Question 1

Which signal is commonly used with 'change_mode = signal' in Vault Agent templates to reload a service without stopping it?

Accepted Answer

SIGHUP. SIGHUP (Signal Hang Up) is the conventional Unix signal used to tell a long-running daemon to reload its configuration files without terminating the process. In Vault Agent templates, setting change_mode = signal with signal = "SIGHUP" causes the agent to send SIGHUP to the configured process whenever the rendered template changes, prompting the service to re-read its config in place. This preserves the running process, its PID, and any in-memory state while picking up new secrets or certificates.

Answer

SIGKILL

Answer

SIGINT

Answer

SIGTERM

Question 2

A Vault performance standby node receives a request. What happens if the request is a write operation?

Accepted Answer

The request is forwarded to the active node.. Performance standby nodes in Vault Enterprise serve read-only requests locally (when the read can be satisfied from replicated state) but forward write operations to the active node over the cluster port. This preserves the single-writer guarantee of the Raft or integrated storage backend while scaling read throughput horizontally. The forwarding is transparent to the client, which receives the response as if the active node had handled it directly.

Answer

The request is rejected with a 403 error.

Answer

The node processes it locally.

Answer

The node triggers an election.

Question 3

You are managing a multi-region Vault deployment with Performance Replication. You notice that a specific secret engine mount is not being replicated to the secondary site. What should you check?

Accepted Answer

The mount's 'local' flag.. In Performance Replication, a mount can be marked as 'local' so that it is not replicated to secondary clusters. If a secret engine mount is missing on the secondary, the most likely cause is that the mount was created with the 'local' flag (or the mount's 'local' attribute is true), which explicitly excludes it from replication. Checking the mount's 'local' flag is the correct diagnostic step.

Answer

The replication_filter configuration.

Answer

The namespace's 'replicated' flag.

Answer

The secondary cluster's license status.

Question 4

Which THREE factors influence the choice of a 'secret engine' configuration?

Accepted Answer

The path where the engine is mounted.. Option A is correct because when enabling a secrets engine in Vault you must choose the mount path (e.g., `vault secrets enable -path=kv kv`), and that path determines the API endpoint and how policies reference the engine. Option B is correct because each secrets engine is configured with a default lease TTL and a max lease TTL, which govern how long dynamically generated credentials or tokens remain valid before renewal or revocation. Option C is correct because some engines are versioned (notably the KV engine, where `-version=1` or `-version=2` changes behavior such as versioning and metadata support), so the engine version is a real configuration factor. Option D is not a configuration factor for a secrets engine; audit logs are enabled and managed separately via audit devices, not per-engine settings. Option E is not relevant because Vault abstracts the underlying operating system, and secrets engine configuration is defined through Vault's API/CLI rather than OS-specific choices.

Answer

The number of audit logs.

Answer

The underlying operating system.

Question 5

When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?

Accepted Answer

Restricts the generated Vault token to specific IP ranges.. The 'token_bound_cidrs' parameter on a Kubernetes auth role restricts the CIDR ranges from which the Vault token issued by that role may be used. It is embedded into the token at issuance and enforced on every subsequent request, so a token issued to a pod in one subnet cannot be replayed from another subnet. This is the token-side counterpart to 'secret_id_bound_cidrs' in AppRole.

Answer

Restricts the Kubernetes API server access.

Answer

Binds the login process to a specific pod IP.

Answer

Limits the number of simultaneous logins from an IP.

Question 6

When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?

Accepted Answer

Verify the 'aud' claim in the JWT.. The 'audience' parameter in the Kubernetes auth method configuration specifies the expected 'aud' (audience) claim value in the service account JWT presented by the pod. Vault validates that the token's aud claim matches this configured value before accepting the authentication request, preventing tokens minted for a different audience from being replayed against Vault. This is a defense-in-depth control aligned with the projected service account token feature in Kubernetes 1.21+.

Answer

Restrict access to specific K8s pods.

Answer

Define which namespaces can authenticate.

Answer

Control the maximum token TTL.

Question 7

Which telemetry type is most effective for monitoring the 'lease' count in Vault?

Accepted Answer

Gauges. Gauges are the most effective telemetry type for monitoring lease counts because gauges represent a value that can go up or down over time — exactly the behavior of active leases, which increase when leases are created and decrease when they expire or are revoked. Vault emits metrics like 'vault.expire.num_leases' as a gauge, making it the natural fit for tracking current lease volume.

Answer

Summaries

Answer

Histograms

Answer

Counters

Question 8

You are using Batch tokens in your environment to improve performance. A developer asks why their Batch token cannot be revoked individually. What is the primary reason?

Accepted Answer

Batch tokens are stateless and not persisted in the storage backend.. Batch tokens are stateless and not persisted in Vault's storage backend, so they cannot be revoked individually. Unlike service tokens, which are stored and tracked, batch tokens are self-contained and validated cryptographically. This design enables high performance and scalability but sacrifices individual revocation capability.

Answer

The performance standby nodes do not support Batch token revocation.

Answer

Batch tokens are only supported for transit engine operations.

Answer

Batch tokens have a hard-coded TTL that cannot be overridden.

Question 9

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

Accepted Answer

request. In Vault Sentinel policies, the 'request' object exposes metadata about the current request, including 'request.path', 'request.operation', 'request.data', and 'request.auth'. Policies use these fields to make allow/deny decisions based on what is being requested and by whom.

Answer

vault.metadata

Answer

token

Answer

input

Answer

policy

Question 10

What is the function of an Identity Alias in Vault?

Accepted Answer

To link an external identity to a Vault entity.. An Identity Alias in Vault links an external identity (from an auth method like LDAP, OIDC, or GitHub) to a Vault entity. This allows multiple auth methods to map to the same Vault entity, enabling unified identity and policy assignment across different authentication sources. The alias is the binding between the external identity's unique identifier and the internal entity.

Answer

To create a duplicate entity.

Answer

To generate new tokens.

Answer

To mask the real username.

Answer

To bypass ACLs.

Question 11

Which THREE types of metrics are collected by Vault's telemetry system?

Accepted Answer

Storage backend performance.. Vault's telemetry system collects storage backend performance metrics (option A), such as latency and operation counts for the configured storage backend (e.g., Consul, Raft, or file), which are essential for diagnosing backend bottlenecks. It also collects core operation counts (option B), tracking counters like the number of token creations, secret leases, and barrier operations performed by Vault's core. Additionally, Vault collects request latency metrics (option C), exposing histograms and summaries of request durations per path and operation to monitor API performance. Options D and E are not telemetry metrics: audit file size is an operational artifact of the audit device rather than a metric emitted by Vault's telemetry, and user password history is not tracked by Vault at all, as Vault does not store or manage password histories.

Answer

Audit file size.

Answer

User password history.

Question 12

Which TWO of the following are valid parameters for configuring the 'sink' in Vault Agent?

Accepted Answer

type. In Vault Agent's sink stanza, the two valid configuration parameters are 'type' (option A) and 'config' (option C). The 'type' parameter specifies the sink backend, such as 'file' for writing tokens to disk, and is required to determine how the sink behaves. The 'config' parameter supplies a map of backend-specific settings (for example, the file path and permissions when type is 'file'), so it is the mechanism for passing sink-specific options. Options B ('ttl'), D ('auth_method'), and E ('mode') are not sink parameters: 'ttl' and 'auth_method' belong to the auto-auth or token configuration, and 'mode' is a file-permission setting that would be nested inside the sink's config block rather than a top-level sink parameter.

Answer

ttl

Answer

auth_method

Answer

mode

Question 13

Which TWO of the following statements are true regarding Performance Standby nodes?

Accepted Answer

They forward all write operations to the primary cluster.. Option B is correct because Performance Standby nodes do not process write operations locally; they forward all write requests to the active primary cluster, which is the only node that can persist writes to storage. Option C is correct because Performance Standby nodes are designed to handle read-only requests locally, allowing horizontal scaling of read throughput across multiple standby nodes. Option A is not correct because Performance Standby nodes share the primary's master key rather than maintaining an independent one. Option D is not correct because a Performance Standby can only serve secrets that have been replicated to it, not secrets written to any cluster. Option E is not correct because automatic promotion applies to HA standby nodes, whereas Performance Standby nodes do not automatically promote themselves if the primary fails.

Answer

They maintain their own independent master key.

Answer

They can serve requests for secrets written to any cluster.

Answer

They automatically promote themselves if the primary fails.

Question 14

Which TWO of the following are valid sink types in Vault Agent?

Accepted Answer

file. In Vault Agent's template stanza, a sink is the destination where the rendered secrets are written, and the two supported sink types are 'file' and 'stdout'. Option B (file) is correct because Vault Agent can write rendered templates to a file sink, configured with a path and optional permissions such as 'perms = "0644"'. Option D (stdout) is correct because Vault Agent supports a stdout sink that writes the rendered output to standard output, which is useful for piping secrets into processes or containers. Option A (vault) is not a sink type; it is the source of secrets, not a destination for rendered templates. Option C (s3) is not a supported sink type in Vault Agent, as it does not natively write rendered templates to S3. Option E (memory) is also not a valid sink type, since Vault Agent does not expose an in-memory sink for rendered templates.

Answer

vault

Answer

s3

Answer

memory

Question 15

When configuring path filters for performance replication, what is the effect of using an 'exclude' filter on a path?

Accepted Answer

The path is not synchronized to the secondary.. In Performance Replication, path filters determine which paths are replicated to secondary clusters. An 'exclude' filter on a path means that the specified path is not synchronized to the secondary; it remains local to the primary. This is useful for keeping sensitive or region-specific data from being replicated.

Answer

The path is hidden from the primary's API.

Answer

The path is deleted from the primary.

Answer

The secondary will proxy requests for that path to the primary.