Vault Enterprise Practice Test 14 — 15 Questions

Question 1

What is the purpose of the 'cluster_addr' in the Vault server configuration?

Accepted Answer

To allow communication between Vault cluster nodes.. The 'cluster_addr' is used for communication between nodes in a Vault cluster (e.g., for Raft replication).

Answer

To mount storage backends.

Answer

To handle client API requests.

Answer

To communicate with external secret engines.

Question 2

When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?

Accepted Answer

Use a secure management system to populate config values.. Configuration files should not contain secrets. Using environment variables or a configuration management system to inject values at runtime is the preferred secure approach.

Answer

Store it as a plaintext file in the root directory.

Answer

Hardcode the root token in the config file.

Answer

Use the 'vault write' command to update the config file.

Question 3

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

Accepted Answer

The KMS Key ID or ARN.. Auto-unseal requires a cloud-specific configuration block, appropriate IAM permissions for the Vault instance, and a valid key ID/ARN.

Answer

A cluster of at least 5 nodes.

Answer

A local unseal key file.

Question 4

You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?

Accepted Answer

Run 'vault operator raft join'.. You must ensure the storage stanza is correctly configured for 'raft' and the node has a unique 'node_id' to participate.

Answer

Disable TLS.

Answer

Delete the old configuration file.

Answer

Format the filesystem.

Question 5

Which TWO items are required to successfully join a new node to an existing Integrated Storage cluster?

Accepted Answer

The leader's API address.. To join a Raft cluster, the new node needs the 'leader_api_addr' of the existing cluster and an authentication token to authorize the join.

Answer

A backup of the previous storage.

Answer

A list of all other cluster nodes.

Answer

The root unseal key.

Question 6

Which THREE factors influence the choice of a 'secret engine' configuration?

Accepted Answer

The path where the engine is mounted.. Secret engine configuration depends on the type of data (KV, Dynamic), the required lease TTL, and the access control policies applied to the path.

Answer

The number of audit logs.

Answer

The underlying operating system.

Question 7

Which THREE components are necessary to secure Vault communications?

Accepted Answer

TLS Certificate.. Secure communication relies on TLS certificates, private keys, and properly configured CA chains to establish trust between clients and the server.

Answer

An LDAP server.

Answer

An external load balancer.

Question 8

Which THREE operations are constrained or modified when a path filter is active in a performance replication setup?

Accepted Answer

Replication of data to the secondary for that path.. Path filters impact visibility, writes to those paths, and the replication process itself.

Answer

Generation of audit logs on the primary.

Answer

Authentication methods on the primary.

Question 9

Which configuration parameter in the Vault Agent 'cache' block allows you to disable caching for specific requests?

Accepted Answer

There is no per-request bypass in the configuration.. The 'cache' block does not have a parameter to disable specific requests; all requests are cached unless disabled globally.

Answer

ignore_requests

Answer

exclude_paths

Answer

disable_cache

Question 10

Where does the Vault Agent store the token it retrieves via auto-auth by default if a sink is not defined?

Accepted Answer

In-memory. If no sink is defined, the token is kept in-memory and not written to disk.

Answer

/tmp/vault.token

Answer

/var/run/vault/token

Answer

Environment variable VAULT_TOKEN

Question 11

Which THREE actions are recommended for maintaining a healthy DR replication setup?

Accepted Answer

Monitoring replication lag metrics.. Monitoring lag, ensuring network reliability, and testing recovery procedures are essential for DR maintenance.

Answer

Rotating the master key daily.

Answer

Increasing the storage backend write throughput.

Question 12

You are configuring a Vault Performance Replication cluster to improve latency for read-heavy workloads. A client application reports that it is receiving 403 Forbidden errors when attempting to read secrets from a Performance Secondary cluster. What is the most likely cause?

Accepted Answer

ACL policies are not being replicated to the Performance Secondary.. Performance replication replicates secret data and auth methods, but policies must exist on the secondary or be replicated via ACL replication. If policies are not replicated, access is denied.

Answer

The Performance Secondary is in a sealed state due to a replication lag.

Answer

The Performance Secondary node has not been initialized with a separate encryption key.

Answer

The client is using a Batch token, which is not supported on performance secondaries.

Question 13

You want the Vault Agent to run as a sidecar. Which configuration block allows you to specify the listener address for the Vault Agent's internal API?

Accepted Answer

listener. The 'listener' block is used to configure how the Vault Agent exposes its local API for applications to communicate with.

Answer

tcp_listener

Answer

server

Answer

api_listener

Question 14

What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?

Accepted Answer

The user is denied access.. In Vault's policy evaluation, 'deny' always takes precedence over 'allow'.

Answer

The policy is considered invalid.

Answer

The user is allowed access.

Answer

The user receives a 403 Forbidden error.

Answer

Access is determined by the order of policy assignment.

Question 15

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

Accepted Answer

api_addr. Communication requires proper address bindings and TLS configurations to be secure and reachable.

Answer

storage_type

Answer

ui