Vault Enterprise Practice Test 15 — 15 Questions

Question 1

When utilizing performance replication, your Vault cluster experiences high replication lag between the primary and secondary sites. Which action would most effectively reduce this lag?

Accepted Answer

Configure path filters to exclude high-churn paths from replication.. The 'replication_buffer_size' and 'max_replication_lag' parameters are key, but tuning the network or reducing the volume of writes via path filters is the most effective operational approach.

Answer

Convert the secondary cluster to a Disaster Recovery secondary.

Answer

Increase the number of Performance Standby nodes.

Answer

Enable Batch token replication.

Question 2

You are configuring Vault to use a PKCS#11 HSM for auto-unseal. You have verified the library path and slot ID. When starting Vault, the service fails with a 'failed to login to HSM' error despite the PIN being correct. Which configuration step is the most likely culprit?

Accepted Answer

The 'hmac_key_label' does not match a key object existing on the HSM.. The 'hmac_key_label' or 'key_label' in the seal configuration must match the label of the key pre-provisioned on the HSM. If the label is incorrect or missing, the PKCS#11 module will fail to authenticate the key object.

Answer

The HSM slot is already in use by another Vault instance.

Answer

The 'lib.so' path is pointing to a 32-bit library on a 64-bit system.

Answer

The 'pin' field is missing from the configuration file.

Question 3

In a Performance Replication setup, a secondary cluster is experiencing high latency for read requests. Which action should you take to verify if the requests are being routed correctly?

Accepted Answer

Check the 'sys/metrics' endpoint to verify the number of performance standby requests.. Checking the X-Vault-Index headers and looking at performance standby metrics helps determine if requests are hitting the local cluster or being forwarded to the primary.

Answer

Increase the 'max_lease_ttl' on the primary cluster.

Answer

Run 'vault write sys/replication/performance/secondary/update' to increase synchronization speed.

Answer

Restart the secondary cluster to clear the internal request cache.

Question 4

You are troubleshooting a sync issue in Performance Replication. The logs indicate 'replication lag'. Which parameter should you review to ensure optimal data synchronization between clusters?

Accepted Answer

The network connection and replication buffer throughput.. While there isn't a single 'lag' parameter, review the 'replication_buffer_size' or network throughput limits between clusters as part of diagnosing synchronization bottlenecks.

Answer

The 'disable_mlock' setting.

Answer

The 'max_lease_ttl' value.

Answer

The 'default_max_request_size'.

Question 5

Which TWO of the following factors can cause a Vault cluster to lose quorum in a Raft-based deployment?

Accepted Answer

Loss of a majority of the nodes in the Raft voting set.. Quorum requires a majority of nodes to be healthy. Losing too many nodes or having network issues causes loss of quorum.

Answer

The load balancer health check fails on a follower.

Answer

Enabling performance replication on the cluster.

Answer

The 'api_addr' is configured incorrectly on a follower.

Question 6

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

Accepted Answer

In the AppRole Role definition. Token restrictions like 'bound_cidrs' are configured on the 'role' within the AppRole auth method.

Answer

In the Namespace configuration

Answer

In the Identity Entity

Answer

In the Token Auth Method

Answer

Inside the ACL policy

Question 7

Which of the following describes the behavior of a Performance Secondary cluster during a primary cluster outage?

Accepted Answer

It continues to serve read requests based on the last known state.. A performance secondary cannot become a primary. It requires promotion, which is a manual process that changes its role.

Answer

It automatically promotes itself to primary.

Answer

It enters a sealed state.

Answer

It shuts down immediately.

Question 8

You are configuring a Vault Agent to authenticate via the AppRole method. Which configuration block is required to define the role ID and secret ID path for the agent?

Accepted Answer

auto_auth. The auto_auth block is specifically used to configure the method by which the Vault Agent authenticates to the Vault server.

Answer

auth_method

Answer

vault_agent

Answer

secrets

Question 9

When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?

Accepted Answer

Vault stops processing requests.. By default, if Vault cannot write to the audit device, it will stop processing requests to ensure no un-audited operations occur.

Answer

Vault alerts the admin via email.

Answer

Vault ignores the error and continues.

Answer

Vault switches to a backup audit device.

Question 10

You are observing high latency for read requests on a Performance Secondary cluster. You verify that the replication lag is near zero. What is the most likely cause for the read latency?

Accepted Answer

The secondary node has too few resources allocated to handle the read request rate.. If there is no replication lag, the latency might be caused by the secondary node being overwhelmed, or issues with the request forwarding configuration.

Answer

The secondary node is not configured as a performance standby.

Answer

The primary node is unavailable.

Answer

The secondary node is missing the required policies.

Question 11

What occurs when a Batch token is created on the Primary but used on a Performance Secondary that has a different mount path for the auth method?

Accepted Answer

The request will be rejected.. Vault's replication ensures configuration consistency, but if paths differ, the token won't be able to map correctly.

Answer

The token is silently ignored.

Answer

The token is automatically updated to the new path.

Answer

The secondary redirects the request to the primary.

Question 12

Which TWO authentication methods are commonly configured in the 'auto_auth' block?

Accepted Answer

AppRole. AppRole and Kubernetes are the most common methods used in Vault Agent auto-auth.

Answer

Userpass

Answer

LDAP

Answer

GitHub

Question 13

You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?

Accepted Answer

Update your load balancer configuration to point to the new promoted cluster.. Once a DR secondary is promoted, it becomes a standalone primary. You must ensure that clients are updated to point to this new cluster and that new authentication/authorization policies are synced.

Answer

Manually re-import all secret engines from an external backup file.

Answer

Enable Performance Replication between the new primary and the old primary.

Answer

Re-initialize the cluster using 'vault operator init'.

Question 14

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

Accepted Answer

Vault requires a manual update to the seal configuration and a restart.. Vault is configured for a single HSM provider at a time; failover to a different HSM would typically require updating the seal configuration and restarting, or using a load balancer in front of a clustered HSM.

Answer

Vault waits until the primary HSM is back online.

Answer

Vault automatically detects the secondary HSM and switches over.

Answer

Vault fails over to Shamir's Secret Sharing mode.

Question 15

How do you properly revoke a root token after it has been used to perform initialization tasks?

Accepted Answer

Use the 'vault token revoke' command.. Once a root token has served its purpose, it should be revoked using 'vault token revoke -self' or by an administrator to adhere to the principle of least privilege.

Answer

Restart the server.

Answer

Overwrite it with a new token.

Answer

Delete the token file.