Vault Enterprise Practice Test 16 — 15 Questions

Question 1

An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?

Accepted Answer

Destroy the specific SecretID.. Destroying the specific SecretID via vault write auth/approle/role/<role>/secret-id/destroy (or the secret-id-accessor/destroy endpoint) immediately invalidates that SecretID while leaving the RoleID, other SecretIDs, and existing tokens untouched. This is the surgical response to a compromised SecretID.

Answer

Rotate the RoleID.

Answer

Disable the AppRole auth method.

Answer

Delete the entire AppRole.

Question 2

What is the primary function of a 'Performance Standby' node in Vault Enterprise?

Accepted Answer

To scale read throughput by processing requests locally.. A Performance Standby node in Vault Enterprise is designed to scale read throughput by servicing read-only requests locally while still forwarding writes to the active node. This allows horizontal scaling of read operations without affecting the write path or requiring additional active nodes.

Answer

To act as a warm standby for automatic failover.

Answer

To replicate the vault to a different geographic region.

Answer

To provide high availability for administrative writes.

Question 3

You want the Vault Agent to run as a sidecar. Which configuration block allows you to specify the listener address for the Vault Agent's internal API?

Accepted Answer

listener. The Vault Agent configuration uses a top-level 'listener' block (not 'tcp_listener' or 'api_listener') to define the address and port where the Agent's internal API/cache proxy listens. This stanza accepts 'type = "tcp"' along with 'address' and optional 'tls_disable' settings. It is the same stanza name used in the Vault server config, which is why candidates sometimes confuse the two.

Answer

tcp_listener

Answer

server

Answer

api_listener

Question 4

Which THREE actions are recommended for maintaining a healthy DR replication setup?

Accepted Answer

Monitoring replication lag metrics.. Option B is correct because continuously monitoring replication lag metrics (e.g., replication lag in seconds or bytes behind) is essential to detect degraded or broken DR replication before an actual failover is needed. Option C is correct because periodically performing a mock promotion in a staging environment validates that the DR replica can actually be promoted and that failover procedures, dependencies, and runbooks work end-to-end without impacting production. Option D is correct because the replication token used to authenticate and authorize replication between nodes must remain valid and have a sufficient TTL; if it expires or is revoked, replication silently stops and the DR copy becomes stale. Option A is not recommended because rotating the master key daily is operationally risky and unnecessary for DR health, and could disrupt replication if not coordinated. Option E is not a recommended maintenance action for DR replication health because increasing storage backend write throughput is a performance tuning change, not a routine health-maintenance practice, and may not address replication correctness or recoverability.

Answer

Rotating the master key daily.

Answer

Increasing the storage backend write throughput.

Question 5

Which TWO factors contribute to the size and performance of Vault audit logs?

Accepted Answer

The size of the request/response payloads.. Option A is correct because Vault audit devices log the full request and response payloads (with sensitive values HMAC-hashed), so larger payloads directly increase the byte size of each audit entry and thus the overall log volume and I/O. Option D is correct because every request handled by Vault generates audit entries (one per audit device), so a higher request rate produces proportionally more log lines per second, increasing log size and the write throughput required to keep up. Option B is incorrect because active leases affect token/secret lifecycle bookkeeping, not the per-request audit record size or rate. Option C is incorrect because enabling more secrets engines adds mount points but does not itself change audit log size or performance. Option E is incorrect because the size of the Vault data store (the storage backend) is unrelated to the volume of audit log entries generated.

Answer

The number of active leases.

Answer

The number of enabled secrets engines.

Answer

The size of the Vault data store.

Question 6

Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?

Accepted Answer

Review logs for 'sys/policy' updates.. Option A is correct because 'sys/policy' updates in an audit log indicate changes to Vault policies, which are high-value security events that could signal privilege escalation or unauthorized access modifications. Option B is correct because 'create' operations on 'auth/token/create' represent new token issuance, and unusual or unexpected token creation can indicate credential abuse or persistence attempts. Option D is correct because filtering by '403 Forbidden' responses highlights denied access attempts, which are strong indicators of reconnaissance or attempted unauthorized access. Option C is not a security-specific action; sorting by timestamp is a general log-navigation technique that does not itself identify incidents. Option E is not appropriate because successful 'read' operations on all secrets are normal and expected, so reviewing them indiscriminately would generate excessive noise rather than pinpoint potential incidents.

Answer

Sort logs by timestamp.

Answer

Check for successful 'read' operations on all secrets.

Question 7

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

Accepted Answer

Response Wrapping.. Response Wrapping is the Vault feature specifically designed for secure introduction of secrets to dynamic infrastructure. It wraps a response (such as a token) in a single-use, time-limited wrapping token that can be safely delivered to a new VM. The VM then unwraps the token to retrieve the actual secret, ensuring the secret is not exposed in transit or logs.

Answer

LDAP bind credentials.

Answer

Cubbyhole storage.

Answer

Transit Secret Engine.

Question 8

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

Accepted Answer

create. In Vault ACL policies, the capabilities that govern access to secrets engines are the standard path capabilities, and create, read, and list are three of them: create allows writing new data at a path (for example, generating a new credential or writing a secret), read allows retrieving data from a path (such as reading a secret or credential), and list allows enumerating keys at a path (such as listing existing secrets or roles). These capabilities are directly attached to policy stanzas that target secrets engine paths, so they are the common building blocks for managing secrets engines. By contrast, sudo is a special capability that grants privileged access to paths that require root-protected operations, not a general secrets-engine management capability, and control-group is a policy parameter that enforces control-group authorization on a path rather than a capability used to manage secrets engines.

Answer

sudo

Answer

control-group

Question 9

How can you view the currently enabled audit devices in a Vault cluster?

Accepted Answer

vault audit list. The `vault audit list` command queries the `sys/audit` endpoint and returns the currently enabled audit devices along with their type and options. It is the standard CLI method for enumerating audit devices in a Vault cluster. The output shows device paths (e.g., `file/`, `syslog/`) and their configuration.

Answer

vault read sys/audit

Answer

vault list audit/devices

Answer

vault status -audit

Question 10

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

Accepted Answer

The library must be PKCS#11 compliant.. Vault's PKCS#11 auto-unseal mechanism relies on dynamically loading a vendor-supplied PKCS#11 shared library (e.g., libsofthsm2.so, libcloudhsm.so) at runtime via the seal "pkcs11" stanza. The only hard requirement is that the library implements the OASIS PKCS#11 (Cryptoki) API so Vault can call standard functions like C_Initialize, C_Login, C_Encrypt, and C_Decrypt against the HSM. Compliance with the PKCS#11 spec guarantees the expected function signatures and slot/token semantics are present, which is what Vault's seal code depends on.

Answer

The library must be statically linked into the Vault binary.

Answer

The library must be written in Go.

Answer

The library must support the KMIP protocol.

Question 11

Which TWO authentication methods are commonly configured in the 'auto_auth' block?

Accepted Answer

AppRole. In HashiCorp Vault's agent configuration, the auto_auth block is designed for machine-to-machine authentication, and AppRole (option B) is the canonical method because it issues a role_id and secret_id that a service can supply non-interactively to obtain a Vault token. Kubernetes (option D) is equally common in the auto_auth block because pods can authenticate using their service account JWT via the Kubernetes auth method, again without human interaction. Both AppRole and Kubernetes are explicitly documented as typical auto_auth methods for workloads and CI/CD pipelines. By contrast, Userpass (A), LDAP (C), and GitHub (E) are human-oriented or interactive auth methods that require credentials such as a username/password or an OAuth flow, so they are not the standard choices configured inside auto_auth.

Answer

Userpass

Answer

LDAP

Answer

GitHub

Question 12

You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?

Accepted Answer

The secondary requires its own unseal process to function.. In Vault Enterprise Disaster Recovery (DR) Replication, the DR secondary cluster maintains its own seal status independent of the primary. If the DR secondary's seal status differs from the primary (e.g., primary unsealed, secondary sealed), it indicates that the secondary has not been unsealed since its last restart or initialization. Each cluster in a DR replication relationship must be unsealed separately because the unseal keys are not replicated across clusters.

Answer

The replication token has expired.

Answer

The primary is also sealed.

Answer

The primary has failed.

Question 13

Which TWO fields are essential in an ACL policy defined in HCL?

Accepted Answer

capabilities. In HCL-based ACL policies, the capabilities field (A) is essential because it specifies the exact permissions granted, such as read, list, create, update, delete, or sudo, on the given path. The path field (D) is also essential because it defines the resource or API endpoint to which those capabilities apply, forming the core path-and-capabilities rule pair. Together, capabilities and path make up the minimum required structure of an ACL policy rule in HCL. The ttl option (B) is not a standard ACL policy field, as TTL values belong to authentication tokens rather than policy definitions. The entity option (C) is not required in a policy rule, since policies attach to tokens or entities externally rather than being defined by an entity field inside the rule. The description option (E) is optional metadata used for documentation and does not affect policy enforcement.

Answer

ttl

Answer

entity

Answer

description

Question 14

What is the consequence of setting 'cluster_name' in the Vault HCL configuration?

Accepted Answer

It identifies the cluster in audit logs and replication.. The 'cluster_name' parameter in Vault's HCL configuration assigns a human-readable identifier to the Vault cluster. This name is used in audit logs to indicate which cluster generated the log entry, and in replication (both performance and disaster recovery) to identify the source and destination clusters. It does not trigger elections, encrypt traffic, or set licensing.

Answer

It forces a cluster election.

Answer

It encrypts the communication between nodes.

Answer

It sets the license key.

Question 15

Which TWO of the following are valid ways to assign policies to a token?

Accepted Answer

Inheritance from an Identity Entity.. Option A (Inheritance from an Identity Entity) is correct because Vault tokens created through an identity entity (e.g., via an entity alias or a token role tied to an entity) automatically inherit the policies attached to that entity, making entity-based policy inheritance a valid assignment mechanism. Option D (Direct assignment during token creation) is correct because policies can be explicitly passed at token creation time, for example with the `vault token create -policy=<name>` command or the `policies` parameter in the token create API, which directly binds policies to the new token. Option B is incorrect because Vault policies are not assigned by mapping to a file path; file paths are only where policy documents (HCL) are stored on disk, not a token-to-policy binding method. Option C is incorrect because the system clock has no role in policy assignment; it only affects token TTLs, expiration, and lease durations. Option E is incorrect because there is no automatic policy assignment feature in the Vault UI — policies must be explicitly specified or inherited, not auto-assigned by the interface.

Answer

Mapping to a file path.

Answer

Via the system clock.

Answer

Automatic assignment via Vault UI.