Vault Enterprise Practice Test 15 — 15 Questions

Question 1

You want to prevent audit logs from being written to a specific device if the disk is full. What happens to Vault?

Accepted Answer

Vault enters a blocked state for all client requests.. If an audit device's disk is full and Vault cannot write audit logs, Vault enters a blocked state and rejects all client requests. This is the same fail-closed behavior as any audit_failure: Vault refuses to process operations it cannot audit. It does not silently drop logs or rotate them automatically.

Answer

Vault switches to a secondary file automatically.

Answer

Vault stops recording logs but continues operation.

Answer

Vault deletes the oldest logs to make room.

Question 2

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

Accepted Answer

Only keys created or rotated after the configuration change will be wrapped by the HSM.. When Seal Wrap is enabled with an HSM, Vault does not automatically re-wrap existing keys. Only keys created or rotated after the configuration change will be wrapped by the HSM. Existing keys remain wrapped with the previous mechanism until they are rotated or re-wrapped manually. This is the correct behavior for transit engine keys.

Answer

The transit engine is disabled until the 're-wrap' command is issued.

Answer

Vault automatically re-wraps all existing keys upon service startup.

Answer

Vault will return an error until all transit keys are manually deleted.

Question 3

Where are audit logs physically stored if the 'file' audit device is configured?

Accepted Answer

In the local filesystem at the configured path.. When the file audit device is enabled, Vault writes JSON-formatted audit entries to the path specified in the device's options (for example, file_path=/var/log/vault_audit.log) on the local filesystem of the Vault node. Each node writes to its own local file, so in an HA cluster every node must have the device enabled and its own path configured.

Answer

In standard system syslog.

Answer

In the storage backend database.

Answer

In Vault's memory buffer.

Question 4

Which THREE of the following are potential security risks when using the AppRole method if not configured correctly?

Accepted Answer

Setting 'token_ttl' to 87600h.. Option A is correct because setting 'token_ttl' to 87600h (10 years) means tokens issued via AppRole effectively never expire, so a leaked token remains valid for an extremely long period and cannot be contained by short-lived credential rotation. Option B is correct because without CIDR binding on the SecretID, the SecretID can be used from any network address, so an attacker who obtains it can authenticate to Vault from anywhere instead of being restricted to trusted source IPs. Option E is correct because an unlimited SecretID usage count (e.g., 'secret_id_num_uses=0') lets a single SecretID be replayed indefinitely, so a stolen SecretID can be used repeatedly to obtain new tokens rather than being consumed after its intended uses. Option C is not a risk of AppRole misconfiguration; the Transit secrets engine is a separate feature for encryption-as-a-service and does not affect AppRole authentication security. Option D is also not an AppRole risk; Vault Namespaces are a multi-tenancy isolation feature and do not by themselves introduce an AppRole security weakness.

Answer

Enabling the Transit engine.

Answer

Using Vault Namespaces.

Question 5

You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?

Accepted Answer

tls_disable = false. Setting tls_disable = false in the listener stanza ensures Vault serves its API over TLS, preventing cleartext transmission of tokens, secrets, and requests. In hardened production deployments, TLS is mandatory and should be paired with a valid certificate and strong cipher suites.

Answer

tls_disable = true

Answer

proxy_protocol = true

Answer

tls_prefer_server_cipher_suites = false

Question 6

Which THREE features are specific to Vault Enterprise when managing access control?

Accepted Answer

Namespaces. Namespaces (A) are a Vault Enterprise-only feature that lets you create isolated tenants within a single Vault cluster, each with its own auth methods, secrets engines, policies, and tokens, which is why it is correct for enterprise access control. Sentinel Policies (C) are also Enterprise-only; Sentinel is HashiCorp's policy-as-code framework that adds fine-grained, condition-based governance (e.g., time-of-day, MFA, CIDR checks) on top of standard Vault ACL policies. Replication (E) is Enterprise-only as well, providing Performance Replication and Disaster Recovery Replication to distribute and protect Vault data across clusters, a capability tied to enterprise access and availability management. Token Auth Method (B) is a built-in, open-source auth method available in all Vault editions, and KV v2 Secrets Engine (D) is likewise an open-source secrets engine, so neither is specific to Vault Enterprise.

Answer

Token Auth Method

Answer

KV v2 Secrets Engine

Question 7

What is the benefit of using a Vault Agent sink?

Accepted Answer

It persists the token to disk for other processes.. A Vault Agent sink is a configuration block that writes the agent's auto-auth token (and optionally wrapped data) to a file on disk so that other local processes — not just the agent's own templates — can consume it. This is the documented purpose of the 'sink' stanza in the agent config, which supports file sinks with configurable mode, owner, and group. It decouples token acquisition from token consumption for legacy or non-Vault-aware applications.

Answer

It automates the Vault server backup.

Answer

It encrypts the vault server traffic.

Answer

It compresses the template output.

Question 8

You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?

Accepted Answer

Update your load balancer configuration to point to the new promoted cluster.. After promoting a secondary to primary with 'vault operator dr promotion', the cluster is functional but clients still resolve the old primary's address. The immediate next step is to update the load balancer (or DNS/service discovery) so traffic is directed to the newly promoted cluster. Until that routing change is made, the promotion has no user-visible effect.

Answer

Manually re-import all secret engines from an external backup file.

Answer

Enable Performance Replication between the new primary and the old primary.

Answer

Re-initialize the cluster using 'vault operator init'.

Question 9

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

Accepted Answer

The policy is inaccessible in the child namespace.. Vault Namespaces provide strict isolation: policies, secrets engines, auth methods, and tokens created in one namespace are not visible or usable in another. A policy created in the root namespace exists only in the root namespace's policy store; child namespaces have their own independent policy stores and cannot see or reference root-namespace policies. Therefore the policy is simply inaccessible in the child namespace where it was intended.

Answer

The policy is automatically moved to the child namespace.

Answer

The policy overwrites child namespace policies.

Answer

The policy causes a naming collision error.

Answer

The policy is inherited by all child namespaces.

Question 10

You are deploying Vault with the integrated Raft storage backend. How is high availability achieved?

Accepted Answer

By configuring nodes to join a Raft cluster and establishing consensus.. High availability with Vault's integrated Raft storage is achieved by configuring multiple Vault nodes to join a Raft cluster, where they participate in leader election and maintain consensus. The Raft protocol ensures that a quorum of nodes is required for operations, providing fault tolerance and automatic failover.

Answer

By using a shared NFS mount for the data directory.

Answer

By manually mounting the storage partition across all nodes.

Answer

By using an external Consul agent as a lock provider.

Question 11

When configuring the PKCS#11 library, how does Vault find the library on the host OS?

Accepted Answer

The path is provided in the 'lib' field of the seal configuration.. When configuring Vault's PKCS#11 auto-unseal, the seal stanza requires a lib field that contains the absolute path to the PKCS#11 shared library (for example, /usr/lib/libsofthsm2.so) on the host OS. Vault loads that library at startup via dlopen using the exact path supplied, so the path must be explicitly declared in the configuration rather than inferred from the environment. This makes the seal configuration the single source of truth for locating the HSM vendor's PKCS#11 module.

Answer

The path is defined in the Vault environment variables.

Answer

Vault expects the library to be located in '/usr/lib/vault'.

Answer

Vault looks in the LD_LIBRARY_PATH environment variable by default.

Question 12

When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?

Accepted Answer

The contents of the mounted service account token file.. When you run 'vault login -method=kubernetes' from inside a pod, the Vault CLI reads the service account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token and sends its contents as the JWT to the Vault Kubernetes auth endpoint. Vault then calls the Kubernetes TokenReview API to validate it.

Answer

The pod's hostname.

Answer

The Vault server's Root CA certificate.

Answer

The Kubernetes API server public key.

Question 13

Which TWO settings are considered best practices for hardening a Vault production listener?

Accepted Answer

Set tls_min_version to 'tls12'.. Option C is correct because setting tls_min_version to 'tls12' in the Vault listener stanza enforces TLS 1.2 as the minimum acceptable protocol version, preventing clients from negotiating deprecated and vulnerable protocols such as TLS 1.0 and TLS 1.1. Option D is correct because setting tls_disable to false ensures TLS encryption is enabled on the listener, which is essential for protecting Vault API traffic and client tokens in transit in a production environment. Option A is incorrect because using HTTP instead of HTTPS would transmit all Vault traffic, including tokens and secrets, in cleartext, which is the opposite of hardening. Option B is incorrect because disabling audit logs removes the ability to record and monitor requests to Vault, undermining security visibility and compliance. Option E is incorrect because setting cluster_addr to 0.0.0.0 would bind cluster communication to all interfaces, unnecessarily exposing the cluster port rather than restricting it to a specific, trusted address.

Answer

Use HTTP instead of HTTPS.

Answer

Disable audit logs.

Answer

Set cluster_addr to 0.0.0.0.

Question 14

Your organization requires fine-grained control over what data is synchronized to a specific Performance Secondary cluster to reduce storage overhead. Which feature should you implement?

Accepted Answer

Replication path filters. Replication path filters allow you to specify which paths are replicated to a Performance Secondary, reducing storage and bandwidth overhead by excluding paths that the secondary does not need. You configure them on the Primary using the sys/replication/performance/primary/path-filters endpoint, listing allowed or denied paths. This gives fine-grained control over what data lands on each secondary.

Answer

Namespace isolation policies

Answer

Mount tuning with local=true

Answer

Performance Standby path filtering

Question 15

You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?

Accepted Answer

The storage backend is struggling with high frequency read/write operations.. The 'core.fetch_token' metric measures the time Vault spends retrieving a token from the storage backend during request processing. High latency here directly indicates the storage backend is slow to respond to token lookups, which are among the most frequent read operations Vault performs. This points to storage backend performance issues rather than audit, buffering, or HA configuration problems.

Answer

The audit file device is too slow.

Answer

The request buffer is full.

Answer

Vault is misconfigured for high availability.