Vault Enterprise Practice Exam 2 — 20 Questions

Question 1

When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?

Accepted Answer

Checking Vault server audit logs.. Vault's audit logs record every request and response, including authentication attempts against the Kubernetes auth method, with details such as the JWT presented, the role requested, and the error returned. When pods fail to authenticate, the audit log is the authoritative source showing exactly why Vault rejected the token — for example, a role mismatch, expired service account token, or failed bound-service-account-claims check.

Answer

Checking the Kubernetes events list.

Answer

Running 'kubectl describe pod'.

Answer

Running 'vault read sys/auth/kubernetes'.

Question 2

When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?

Accepted Answer

role. In Vault Agent's auto-auth configuration, the AWS auth method's 'method' block requires the 'role' parameter to specify which Vault role (bound to an IAM principal) the agent should authenticate as. The 'role' parameter maps to the Vault role name, not the IAM role name directly — the binding between IAM role and Vault role is configured server-side. This is consistent across all Vault auth methods, which use 'role' as the standard parameter name.

Answer

identity

Answer

iam_role

Answer

aws_role

Question 3

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

Accepted Answer

Sentinel policies support EGP and RGP types.. Option D is correct because Vault Enterprise Sentinel policies come in two enforcement types: Endpoint Governing Policies (EGP), which are attached to specific paths and evaluated on requests to those endpoints, and Role Governing Policies (RGP), which are attached to tokens/roles and evaluated based on the identity making the request. Option E is correct because Sentinel is a full policy-as-code language with constructs like rules, functions, conditionals, and imports, allowing administrators to encode rich, context-aware business logic (for example, requiring MFA, time-of-day restrictions, or specific metadata) that goes well beyond simple path-based allow/deny. Option A is not correct because Sentinel policies are written in Sentinel, a purpose-built language, not HCL (HCL is used for Vault ACL policies and configuration). Option B is not correct because Sentinel does not replace ACLs; ACLs remain the primary authorization mechanism and Sentinel adds an additional layer of control. Option C is not correct because Sentinel policies are evaluated after ACLs, not before — a request must first pass the ACL check before Sentinel policies are applied.

Answer

Sentinel policies are written in HCL.

Answer

Sentinel policies replace ACLs.

Answer

Sentinel policies are evaluated before ACLs.

Question 4

Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?

Accepted Answer

signal. In the Vault Agent template stanza, the change_mode parameter controls what happens when the rendered secret changes, and its valid values are signal, restart, and noop. Option A (signal) is correct because it sends the configured signal (default SIGHUP, or the value of signal) to the process specified by the exec block, allowing the application to reload its configuration without a full restart. Option B (restart) is correct because it instructs Vault Agent to stop and restart the child process defined in the exec block so it picks up the new secret. Option D (noop) is correct because it tells Vault Agent to take no action on the process when the template output changes, leaving the application to detect the change itself. Option C (delete) is not a valid change_mode value; Vault Agent does not delete the process or file as a change action. Option E (exec) is also not a valid change_mode value; exec is a separate template stanza block that defines the command to run, not a change-triggered action.

Answer

delete

Answer

exec

Question 5

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

Accepted Answer

read. The correct capability is read. In Vault's policy system, the read capability grants permission to read data at a given path. For KV v2 secrets engines, reading a secret at path secret/data/my-secret requires the read capability on that exact path. This is the minimal privilege needed for an application to retrieve secret values.

Answer

create

Answer

patch

Answer

list

Answer

sudo

Question 6

What does the 'vault_core_seal_setup_duration' metric represent?

Accepted Answer

The duration of the unseal process.. The 'vault_core_seal_setup_duration' metric measures the time taken to complete the unseal process — specifically, the duration of the seal setup operations that occur when Vault transitions from sealed to unsealed. It is a core telemetry metric used to monitor unseal performance.

Answer

The time taken to initialize the storage backend.

Answer

The time between audit log rotations.

Answer

The time spent waiting for a lease to expire.

Question 7

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

Accepted Answer

debug. The debug log level captures the most granular diagnostic output from Vault, including internal subsystem activity, plugin initialization steps, and configuration parsing details that occur during startup. When troubleshooting startup failures, this verbosity is essential because errors often originate before the listener or storage backends fully initialize, and lower log levels suppress those early messages. Setting log_level = "debug" in the Vault configuration or passing -log-level=debug at startup surfaces the exact sequence of operations leading to the failure.

Answer

warn

Answer

error

Answer

info

Question 8

What is the benefit of using Performance Replication over standard DR Replication?

Accepted Answer

Performance replication allows the secondary to serve read requests.. Performance Replication is designed to let secondary clusters serve read requests locally, offloading read traffic from the primary and reducing latency for geographically distributed users. This is its defining benefit over DR Replication, which keeps secondaries in a warm standby state that cannot serve client reads.

Answer

Performance replication supports write operations.

Answer

Performance replication provides disaster recovery capabilities.

Answer

Performance replication is cheaper to license.

Question 9

When running 'vault operator raft list-peers', you notice one node is listed but its status is 'dead'. What is the correct procedure to remove it from the Raft cluster?

Accepted Answer

Run 'vault operator raft remove-peer'.. The 'vault operator raft remove-peer' command is the supported, safe way to evict a dead node from the Raft cluster. It instructs the leader to remove the peer from the Raft configuration, allowing the remaining nodes to re-establish quorum without the failed member. This is the documented procedure for decommissioning or replacing a failed Raft node in Vault Enterprise.

Answer

Re-run the join command for the node.

Answer

Restart the leader node.

Answer

Delete the node's data directory manually.

Question 10

When using Vault with an external storage backend like Consul, what is the effect of changing the 'api_addr' in the Vault configuration file?

Accepted Answer

It updates the address clients and peers use to communicate with the node.. The 'api_addr' in Vault's configuration specifies the address that Vault advertises to clients and other cluster nodes for API communication. Changing it updates the address used for client requests, redirects, and peer communication. It does not affect storage backend connectivity or trigger leader election.

Answer

It forces a cluster leader election.

Answer

It disables high availability mode.

Answer

It changes the storage backend connection string.

Question 11

You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?

Accepted Answer

Port 8200 and port 8201.. Vault replication requires both the API port (8200) and the cluster port (8201) to be open between primary and secondary clusters. Port 8200 carries client API traffic and replication API calls, while port 8201 is the dedicated cluster-to-cluster port used for replication data streaming and internal RPC between nodes. Both must be reachable bidirectionally for replication to establish and stay healthy.

Answer

Only port 8200.

Answer

Port 443 and port 80.

Answer

Only port 8201.

Question 12

You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?

Accepted Answer

Set a different 'kubernetes_host' for each cluster.. Setting a different 'kubernetes_host' for each cluster's auth method configuration ensures that Vault validates service account tokens against the correct Kubernetes API server. The kubernetes_host is the API endpoint Vault uses to verify the token's issuer and audience via TokenReview. If both clusters pointed to the same host, a token from Cluster B could be validated by Cluster A's Vault, enabling cross-cluster authentication.

Answer

Use the same 'kubernetes_ca_cert' for both clusters.

Answer

Enable 'token_bound_cidrs' on the roles.

Answer

Assign different 'token_policies' to the roles.

Question 13

What permission level is required for the user account used to authenticate with the HSM?

Accepted Answer

The account must have Crypto User (CU) privileges.. The HSM user account used by Vault must have Crypto User (CU) privileges because Vault only needs to perform cryptographic operations (encrypt/decrypt/wrap/unwrap) against the HSM — it does not need to manage partitions, users, or policies. CU is the standard PKCS#11 role that grants access to cryptographic mechanisms and key objects without administrative control. This least-privilege model is what HashiCorp documents for Vault Enterprise HSM auto-unseal.

Answer

The account must be the partition owner.

Answer

The account must have anonymous access.

Answer

The account must have full Administrative (SO) privileges.

Question 14

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

Accepted Answer

Vault requires a manual update to the seal configuration and a restart.. Vault does not automatically failover to a secondary HSM; when the primary HSM becomes unavailable, Vault loses its seal and will not function until the seal is restored. To use a secondary HSM, an operator must manually update the seal configuration to point to the secondary HSM and then restart Vault. This manual intervention is required because the seal configuration is static and Vault does not support automatic HSM failover.

Answer

Vault waits until the primary HSM is back online.

Answer

Vault automatically detects the secondary HSM and switches over.

Answer

Vault fails over to Shamir's Secret Sharing mode.

Question 15

A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?

Accepted Answer

No action is required, assuming IAM permissions are correctly maintained.. When AWS KMS auto-unseal is configured, Vault stores the encrypted master key and calls KMS Decrypt to unwrap it. AWS KMS key rotation creates a new backing key version under the same key ID, and KMS transparently uses the correct version for decrypt operations. As long as the IAM principal Vault uses retains kms:Decrypt on that key, no Vault configuration change or restart is required.

Answer

Update the 'kms_key_id' in the configuration file.

Answer

Restart the Vault process to reload the KMS configuration.

Answer

Run vault operator rekey to update the master key.

Question 16

In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?

Accepted Answer

3 nodes.. A three-node Raft cluster is the minimum recommended for production because it tolerates the failure of one node while maintaining quorum. Raft requires a majority of nodes to be available for writes, so with three nodes, two must be up — allowing one failure without losing availability. This is the standard recommendation for Vault HA deployments using integrated storage.

Answer

1 node.

Answer

2 nodes.

Answer

10 nodes.

Question 17

When utilizing performance replication, your Vault cluster experiences high replication lag between the primary and secondary sites. Which action would most effectively reduce this lag?

Accepted Answer

Configure path filters to exclude high-churn paths from replication.. Performance replication lag is most directly reduced by filtering out high-churn paths (e.g., transit secrets engine, high-volume KV writes) that don't need to be replicated to the secondary. Path filters let you exclude specific mounts from replication, cutting the volume of data that must traverse the link and thus reducing lag. This is the targeted, effective action for a bandwidth-bound replication lag problem.

Answer

Convert the secondary cluster to a Disaster Recovery secondary.

Answer

Increase the number of Performance Standby nodes.

Answer

Enable Batch token replication.

Question 18

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

Accepted Answer

In the AppRole Role definition. Token restrictions like 'bound_cidrs' are configured on the 'role' within the AppRole auth method.

Answer

In the Namespace configuration

Answer

In the Identity Entity

Answer

In the Token Auth Method

Answer

Inside the ACL policy

Question 19

When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?

Accepted Answer

Vault stops processing requests.. By default, if Vault cannot write to the audit device, it will stop processing requests to ensure no un-audited operations occur.

Answer

Vault alerts the admin via email.

Answer

Vault ignores the error and continues.

Answer

Vault switches to a backup audit device.

Question 20

How do you properly revoke a root token after it has been used to perform initialization tasks?

Accepted Answer

Use the 'vault token revoke' command.. The correct way to revoke a root token is to use the `vault token revoke` command, which sends a revocation request to Vault's token store. This immediately invalidates the token, ensuring it cannot be used for any further operations. Since root tokens are highly privileged, proper revocation is critical for security. The command works whether the token is provided via argument or through the `VAULT_TOKEN` environment variable.

Answer

Restart the server.

Answer

Overwrite it with a new token.

Answer

Delete the token file.