Vault Enterprise Practice Exam 1 — 20 Questions

Question 1

Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?

Accepted Answer

Response wrapping.. Response wrapping returns a single-use wrapping token that the client unwraps to retrieve the actual secret or token, so the sensitive credential is never exposed in transit or at rest in the client environment. This is the recommended pattern for securely delivering tokens to automated clients during the Secure Client Introduction phase. It limits exposure because the wrapping token is short-lived and can be unwrapped only once.

Answer

Using a long-lived root token.

Answer

Passing the token as an environment variable.

Answer

Storing the token in a public configuration repo.

Question 2

What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?

Accepted Answer

To define the duration of the authentication session.. The 'token_ttl' setting in an AppRole role definition controls the Time-To-Live (TTL) of the authentication token issued when a client successfully authenticates using that role. It defines how long the resulting Vault token remains valid before expiring, effectively setting the duration of the authentication session. This is distinct from SecretID TTL, RoleID TTL, or master key rotation, which are separate configuration parameters.

Answer

To limit the number of uses for the SecretID.

Answer

To set the expiration of the RoleID.

Answer

To set the rotation period for the Vault master key.

Question 3

What is the primary difference between HA replication and DR replication in Vault?

Accepted Answer

HA replication is for performance, DR is for data durability.. HA replication in Vault Enterprise is designed to improve read scalability and reduce latency by allowing secondary clusters to serve reads from replicated data, while writes still go to the primary. DR replication is designed for disaster recovery: it maintains a copy of data on a secondary that can be promoted to primary if the primary fails, prioritizing data durability and recovery over performance.

Answer

HA replication requires Enterprise, DR does not.

Answer

DR replication uses a different storage backend.

Answer

DR replication is faster than HA replication.

Question 4

A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)

Accepted Answer

tls_key_file. To enable TLS in a Vault listener stanza, you must provide the server certificate and its corresponding private key using tls_cert_file and tls_key_file. These are the only required parameters for TLS. The CA file is only needed for client certificate verification, and tls_min_version is optional. The other options are either not required or invalid parameter names.

Answer

tls_client_ca_file

Answer

tls_min_version

Answer

tls_ca_file

Question 5

In the context of the Vault Kubernetes Auth Method, what is the role of the 'reviewer_service_account'?

Accepted Answer

It is the account Vault uses to verify client tokens.. The reviewer_service_account is a Kubernetes service account that Vault uses to call the TokenReview API to validate client tokens presented during login. Vault needs permissions to create TokenReview requests, which are granted to this service account.

Answer

It is the account that logs in to Vault.

Answer

It is the account that manages K8s secrets.

Answer

It is an administrative account used to manage Vault roles.

Question 6

What is the effect of setting 'token_ttl' on a Role?

Accepted Answer

It sets the initial duration for the token.. Setting 'token_ttl' on a Vault role defines the initial Time-To-Live (TTL) for tokens issued under that role. This TTL is the starting lease duration before any renewal occurs. It does not affect the token's type, renewability, or number of uses; those are controlled by separate parameters like 'token_type', 'token_num_uses', and 'token_explicit_max_ttl'.

Answer

It restricts the number of uses.

Answer

It forces the token to be renewable.

Answer

It changes the token type.

Answer

It prevents the token from being revoked.

Question 7

A Vault Enterprise cluster uses a PKCS#11 HSM for seal wrap and auto-unseal. The security team rotates the HSM partition PIN. Vault nodes are still running with the old PIN in their configuration files. What is the most likely operational impact?

Accepted Answer

Vault nodes will fail to unseal after a restart because they cannot authenticate to the HSM with the old PIN.. The PKCS#11 PIN is used to authenticate to the HSM partition whenever Vault needs to open a session, including during unseal. Rotating the PIN without updating Vault's seal configuration means the old PIN is rejected, so nodes cannot unseal after a restart. The correct remediation is to update the pin value in the seal stanza and restart Vault.

Answer

Vault will automatically fall back to Shamir unseal and prompt for unseal keys.

Answer

Vault continues to operate normally because the PIN is only used during initial unseal and is cached in memory.

Answer

Seal wrap operations will continue using the old PIN until the next key rotation, then fail.

Question 8

A Vault Enterprise administrator needs to delegate the management of a specific secrets engine to a team. The team should be able to create, update, and delete roles within the 'database' secrets engine but should not be able to modify the secrets engine's configuration or access other secrets engines. Which policy should the administrator create?

Accepted Answer

A policy with path 'database/roles/*' and capabilities 'create', 'read', 'update', 'delete', 'list'.. The policy must grant the necessary capabilities on the role management path without including the configuration path. Using 'database/roles/*' with 'create', 'read', 'update', 'delete', and 'list' allows the team to manage roles. The 'list' capability is needed to enumerate roles. This scoped policy ensures the team cannot modify the secrets engine's configuration or access other engines, adhering to least privilege.

Answer

A policy with path 'database/*' and capabilities 'create', 'read', 'update', 'delete', 'list'.

Answer

A policy with path 'sys/mounts/database' and capabilities 'create', 'read', 'update', 'delete'.

Answer

A policy with path 'database/creds/*' and capabilities 'read'.

Question 9

Which TWO of the following are true about AppRole 'SecretID' management?

Accepted Answer

SecretIDs can be constrained by 'num_uses'.. Option B is correct because a SecretID can be created with a 'num_uses' constraint, meaning it is invalidated after a set number of authentication uses, which limits the blast radius if the SecretID leaks. Option D is correct because SecretIDs are issued with a TTL (via 'secret_id_ttl' on the role or an explicit TTL at generation), after which they expire and can no longer be used to authenticate. Option A is wrong because RoleID and SecretID are distinct AppRole credentials: the RoleID identifies the role and is not secret, while the SecretID is the sensitive half of the pair. Option C is wrong because SecretIDs are sensitive credentials and must never be committed in cleartext to version control. Option E is wrong because each SecretID is uniquely generated per application/instance, not shared across all applications in a namespace.

Answer

SecretIDs are synonymous with RoleIDs.

Answer

SecretIDs should be stored in cleartext in version control.

Answer

SecretIDs are the same for all applications in a namespace.

Question 10

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Accepted Answer

The storage backend (e.g., Consul).. In a Vault HA cluster, the storage backend (typically Consul or Vault's integrated Raft storage) is responsible for leader election. Vault nodes compete for a lock in the storage backend, and whichever node acquires the lock becomes the active leader while the others become standbys. This lock-based mechanism guarantees only one active node at a time.

Answer

The load balancer.

Answer

The Vault server process configuration file.

Answer

The Vault CLI.

Question 11

You are using Vault Enterprise with Disaster Recovery (DR) replication. The primary cluster is in Region A, and the DR secondary is in Region B. A catastrophic failure occurs in Region A, and the primary cluster is completely lost. You promote the DR secondary to primary. After promotion, you need to reconfigure the old primary's remaining nodes (if any) to act as a DR secondary for the new primary. However, the old primary's nodes are completely destroyed. What is the recommended approach to re-establish DR replication with a new secondary cluster in Region A?

Accepted Answer

Generate a new DR secondary activation token on the new primary and use it to configure a new Vault cluster in Region A as a DR secondary.. After promoting a DR secondary, the new primary can generate a new activation token for a new DR secondary. You then deploy a new Vault cluster in the failed region, configure it with the same storage and seal, and use the token to enable DR replication. This creates a fresh DR relationship. Reusing old tokens or restoring snapshots is not appropriate, and Performance Replication is not a substitute for DR.

Answer

Reuse the original DR secondary activation token from the old primary to configure the new nodes.

Answer

Configure the new nodes as a Performance Replication secondary instead of DR, because DR requires the original primary.

Answer

Restore a Raft snapshot from the old primary to the new nodes and then run 'vault operator dr promote' on them.

Question 12

You are configuring a Vault Agent to use the AppRole auth method. The agent must retrieve a secret from a KV v2 secrets engine and render it into a configuration file. The secret path is 'secret/data/myapp/config'. Which template function should you use to access the secret's data?

Accepted Answer

{{ with secret "secret/data/myapp/config" }}{{ .Data.data.config }}{{ end }}. KV v2 secrets require the path to include '/data/' and the secret data is nested under .Data.data. The template function 'secret' is used with the full path, and the value is accessed via .Data.data.<key>. This ensures correct retrieval and rendering.

Answer

Answer

Answer

Question 13

A Vault Enterprise cluster is deployed across three availability zones in AWS. The administrator wants to ensure that the cluster can tolerate the loss of an entire availability zone without losing quorum. The cluster uses Integrated Storage. How many Vault nodes should be deployed, and what is the minimum number of nodes required to maintain quorum after such a loss?

Accepted Answer

Deploy 5 nodes; minimum 3 nodes required for quorum.. To tolerate the loss of an entire availability zone while maintaining quorum, a Vault Integrated Storage cluster should have at least 5 nodes distributed across three AZs (e.g., 2,2,1). Losing the AZ with 2 nodes leaves 3 nodes, which is the quorum for a 5-node cluster. Thus, 5 nodes is the recommended deployment, and the minimum nodes for quorum is 3.

Answer

Deploy 4 nodes; minimum 3 nodes required for quorum.

Answer

Deploy 3 nodes; minimum 2 nodes required for quorum.

Answer

Deploy 6 nodes; minimum 4 nodes required for quorum.

Question 14

An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?

Accepted Answer

Issue a wrapped response for the SecretID with a specific TTL.. Response wrapping delivers the SecretID as a single-use wrapping token with a short TTL, so the SecretID is never exposed in transit or at rest in the application's config. The application unwraps the token via cubbyhole, retrieving the SecretID exactly once, which prevents interception and replay. This is the recommended secure introduction pattern for AppRole.

Answer

Use a global static token for all AppRole authentications.

Answer

Hardcode the SecretID into the application's configuration file.

Answer

Disable the SecretID requirement and use only the RoleID.

Question 15

What does the 'root' policy in Vault provide?

Accepted Answer

Full administrative access.. The root policy in Vault is a built-in policy that grants full administrative access to all paths and operations. It is not a policy that can be modified or deleted, and it is automatically attached to the root token created during initialization. This policy allows the holder to perform any action within Vault, including managing policies, auth methods, secrets engines, and more.

Answer

Access to write policies only.

Answer

Access to view audit logs only.

Answer

Access limited to the namespace.

Answer

Read-only access to all paths.

Question 16

What is the primary function of the 'ui = true' configuration setting?

Accepted Answer

Enable the web-based graphical interface.. The 'ui = true' setting in the Vault server configuration enables the web-based graphical user interface, allowing operators to log in and manage secrets, policies, and auth methods through a browser. It does not affect CLI availability, auto-unseal, or API throughput. When enabled, the UI is served on the same listener port as the API (e.g., 8200) at the /ui path.

Answer

Enable command-line interface tools.

Answer

Enable auto-unseal.

Answer

Increase API throughput.

Question 17

Which component of Vault is responsible for communicating with the HSM?

Accepted Answer

The seal component.. The seal component is the Vault subsystem responsible for encrypting and decrypting the root key, and it is the layer that integrates with external key management, including HSMs via PKCS#11. When auto-unseal is configured, the seal stanza drives all communication with the HSM — loading the library, opening a session, and using the HSM key to wrap/unwrap Vault's master key. No other Vault component talks to the HSM directly.

Answer

The audit log manager.

Answer

The storage backend.

Answer

The transit engine.

Question 18

Which configuration parameter in the Vault Agent 'cache' block allows you to disable caching for specific requests?

Accepted Answer

There is no per-request bypass in the configuration.. The Vault Agent cache block does not expose a configuration parameter to bypass caching for specific requests. Caching behavior is controlled globally (for example, via the cache listener and persist settings), and there is no per-request or per-path bypass option in the agent configuration. Therefore the correct answer is that no such parameter exists.

Answer

ignore_requests

Answer

exclude_paths

Answer

disable_cache

Question 19

Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?

Accepted Answer

Incompatibility between the library version and the HSM firmware.. Option A is correct because Vault's PKCS#11 auto-unseal and HSM integrations load a vendor PKCS#11 library (e.g., libCryptoki2.so) to talk to the HSM, and a mismatch between that library version and the HSM's firmware can cause the C_* calls to fail, surfacing as a 'PKCS#11 error'. Option B is correct because the PKCS#11 session login uses the HSM's user PIN (C_Login with CKU_USER); an incorrect or expired PIN makes authentication fail and Vault reports a PKCS#11 error. Option C is not a PKCS#11 cause: an expired Vault token produces a Vault API 'permission denied' or token-expired error, unrelated to the HSM's PKCS#11 interface. Option D is unrelated because a full storage backend causes write failures in Vault's storage layer, not a PKCS#11 cryptographic error. Option E is unrelated because a local firewall blocking network traffic would typically manifest as connection timeouts or refused connections, not a PKCS#11 library-level error.

Answer

The Vault token has expired.

Answer

The storage backend is full.

Answer

The network is blocked by a local firewall.

Question 20

When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?

Accepted Answer

Configure the 'kubernetes_host' and 'kubernetes_ca_cert' in the auth method configuration.. To enable Vault to verify service account tokens against the Kubernetes TokenReview API, you must configure the Kubernetes auth method with the Kubernetes API host (kubernetes_host) and the CA certificate (kubernetes_ca_cert) so Vault can securely communicate with the API server.

Answer

Enable the 'kubernetes_allow_any_token' flag in the global configuration.

Answer

Create a static secret in Vault that matches the Kubernetes service account name.

Answer

Manually copy the pod's service account token into the Vault server's local keyring.