Vault Enterprise Practice Exam 3 — 20 Questions

Question 1

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

Accepted Answer

The server logs.. Leader election events in a Vault HA cluster are logged by the Vault server itself, so the server logs are where you find messages about acquiring/losing leadership, stepping down, and transitioning between active and standby states. These logs include timestamps and the node identity, making them the authoritative source for election history. Telemetry and audit logs do not record election mechanics.

Answer

The telemetry metrics.

Answer

The storage backend logs.

Answer

The audit logs.

Question 2

Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?

Accepted Answer

Performance Replication.. Performance Replication (B) is a Vault Enterprise-only feature that lets a cluster serve read-heavy workloads across multiple secondary clusters while writes are forwarded to the primary, and it is configured at the server level via the replication stanza and related server settings. HSM Seal Wrapping (D) is also Enterprise-only and directly tied to server configuration: it uses an HSM to wrap the root key so that unsealing can be performed automatically via the seal "pkcs11" stanza in the Vault server configuration. Audit logging (A), KV Secret Engine (C), and Token management (E) are all core Vault capabilities available in the open-source edition and are not Enterprise-specific server-configuration features, so they do not fit the scenario.

Answer

Audit logging.

Answer

KV Secret Engine.

Answer

Token management.

Question 3

When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?

Accepted Answer

To avoid accidental data loss or interference with production keys.. Using a separate HSM partition for development isolates dev/test keys from production keys, preventing accidental overwrites, deletions, or cryptographic operations that could corrupt or expose production key material. Partitions in an HSM are logically isolated security domains, so operations in one partition cannot affect objects in another. This is a best practice for safe testing of new HSM configurations.

Answer

The PKCS#11 library requires a unique partition for every Vault instance.

Answer

It reduces the memory footprint of the Vault service.

Answer

To increase the speed of the cryptographic operations.

Question 4

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

Accepted Answer

It allows Vault to unseal without manual intervention.. HSM Auto-Unseal delegates the unseal operation to a hardware security module (or a cloud KMS acting as one) that holds the master key. When Vault starts, it sends the encrypted master key to the HSM for decryption, allowing the node to unseal automatically without an operator supplying unseal keys. This eliminates manual unseal ceremonies after restarts and enables fully automated cluster recovery.

Answer

It provides backup redundancy for the Vault data.

Answer

It replaces the need for TLS encryption.

Answer

It increases the throughput of the storage backend.

Question 5

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

Accepted Answer

vault operator rekey -init. 'vault operator rekey -init' starts a rekey operation and, when combined with flags like '-key-shares' and '-key-threshold', allows you to change the unseal key configuration while generating a new master key. This is the only command that both rotates the master key and lets you alter the share/threshold parameters in a single operation.

Answer

vault operator unseal

Answer

vault secrets tune

Answer

vault operator rotate

Question 6

Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?

Accepted Answer

Check Vault logs for specific PKCS#11 error codes.. Option B is correct because when Vault fails to unseal via HSM, the Vault server logs typically surface PKCS#11 error codes (e.g., CKR_SLOT_ID_INVALID, CKR_TOKEN_NOT_PRESENT) that pinpoint whether the failure is a slot, token, PIN, or session issue, making log inspection a standard first troubleshooting step. Option D is correct because Vault's seal stanza requires a valid path to the HSM vendor's PKCS#11 library (e.g., /usr/lib/libpkcs11.so or /opt/vendor/lib/libpkcs11.so); if that path is wrong, missing, or unreadable by the vault user, Vault cannot load the library and unsealing fails. Option E is correct because using the HSM vendor's own CLI tools (e.g., pkcs11-tool --list-slots or the vendor utility) confirms the slot/token is present, initialized, and accessible outside Vault, isolating whether the problem is in the HSM itself versus Vault's configuration. Option A is not a troubleshooting step for HSM unsealing failures because 'vault operator unseal' is the normal unseal operation itself, not a diagnostic action, and it will simply fail again if the underlying PKCS#11 issue is unresolved. Option C is incorrect because the storage backend driver is unrelated to HSM-based auto-unseal; upgrading it would not address PKCS#11 library, slot, or token problems.

Answer

Run 'vault operator unseal' manually.

Answer

Upgrade the storage backend driver.

Question 7

Which THREE conditions might result in a Vault node becoming unhealthy?

Accepted Answer

Storage backend connection failure.. Option A is correct because Vault's health status depends on its storage backend; if Vault cannot reach or use its configured storage (e.g., Consul, Raft, file, or cloud storage), it cannot serve requests and reports unhealthy. Option B is correct because a sealed Vault node has no access to its master key or unseal keys, so it cannot decrypt the barrier or serve secrets, and its health endpoint returns a sealed, unhealthy status. Option D is correct because a non-leader node that cannot reach the active cluster leader cannot forward requests or participate properly in the cluster, causing it to report unhealthy. Option C is not correct because telemetry endpoints (such as Prometheus or StatsD sinks) are optional observability outputs; their failure does not affect Vault's core health status. Option E is not correct because audit log devices are configured sinks, and while audit failures can block requests, 'audit logs are full' is not a standard Vault health condition and does not by itself make the node unhealthy.

Answer

Telemetry endpoint is down.

Answer

Audit logs are full.

Question 8

Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?

Accepted Answer

It allows wildcards to match multiple service accounts.. Option B is correct because the Vault Kubernetes Auth Method's bound_service_account_names parameter accepts glob-style wildcards (for example, 'app-*') so a single role can match multiple service account names. Option D is correct because this parameter defines the allowlist of Kubernetes service account names permitted to authenticate against that Vault role, so any service account not listed is rejected. Option A is wrong because the parameter has nothing to do with cluster-admin privileges; it merely constrains service account identities and works with any service account. Option C is wrong because Vault policies are still required to define the actual permissions granted after authentication; bound_service_account_names only governs who may log in. Option E is wrong because bound_service_account_names is a required parameter for the Kubernetes auth role, not something that becomes optional when bound_namespaces is configured.

Answer

It can only be applied to cluster-admin accounts.

Answer

It replaces the need for Vault policies.

Answer

It is optional if 'bound_namespaces' is set.

Question 9

Which THREE actions are permitted by the 'vault operator' command group?

Accepted Answer

Rekey the master key.. Option A is correct because 'vault operator rekey' is part of the operator command group and is used to generate a new master key (or recovery key) by re-entering the required threshold of unseal/recovery keys. Option C is correct because 'vault operator step-down' forces the active Vault node to give up its active status and trigger a leader election, which is an operator-level cluster management action. Option D is correct because 'vault operator unseal' submits an unseal key share to progress the Vault server out of its sealed state, a core operator responsibility. Option B does not belong because creating a user login is an authentication/userpass operation (e.g., 'vault write auth/userpass/users/...'), not an operator command. Option E does not belong because enabling a new secrets engine is done with 'vault secrets enable' (or the sys/mounts API), which is not part of the operator command group.

Answer

Create a user login.

Answer

Create a new secret engine.

Question 10

Which TWO statements are true about the relationship between Performance Standby nodes and Performance Replication?

Accepted Answer

Performance Standby allows read scaling within a single cluster.. Option C is correct because Performance Standby nodes in Vault are read-only replicas within the same cluster that serve read requests, thereby enabling read scaling within a single cluster. Option D is correct because Performance Replication and Performance Standby are complementary features that can coexist on the same cluster, allowing both cross-cluster replication and intra-cluster read scaling. Option A is incorrect because Performance Replication and Performance Standby are distinct features, not a subtype relationship. Option B is incorrect because Performance Replication does not require Performance Standby nodes; replication can function without them. Option E is incorrect because replication does not require performance standby nodes for all nodes.

Answer

Performance Replication is a type of Performance Standby.

Answer

Performance Standby nodes are required for Performance Replication.

Answer

Replication requires performance standby for all nodes.

Question 11

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

Accepted Answer

The KMS Key ID or ARN.. To enable Auto-Unseal with a cloud KMS, Vault must know which key to use, so option B (the KMS Key ID or ARN) is required to identify the specific KMS key that Vault will call for encryption/decryption operations. Option C (a cloud provider IAM role with decrypt permissions) is also required because Vault's identity must be authorized by the cloud provider to invoke the KMS Decrypt (and typically Encrypt) API; without those permissions the unseal call fails. Option E (a 'seal' stanza in the Vault configuration) is correct because Auto-Unseal is declared in the Vault config using a seal stanza (for example seal "awskms" or seal "azurekeyvault") that specifies the KMS provider and its parameters, which Vault reads at startup. Option A is not required, since Auto-Unseal works on a single Vault node and does not mandate a 5-node cluster (that relates to integrated storage quorum, not KMS unsealing). Option D is incorrect because a local unseal key file is the manual Shamir unseal mechanism, which Auto-Unseal is specifically designed to replace.

Answer

A cluster of at least 5 nodes.

Answer

A local unseal key file.

Question 12

Which THREE components are involved in a standard high availability (HA) Vault architecture?

Accepted Answer

A load balancer.. In a standard HA Vault architecture, a load balancer (A) is required to distribute client requests across the active and standby nodes, routing traffic to the current leader and providing a stable endpoint. Multiple Vault nodes (D) are essential because HA relies on a cluster of Vault servers where one node is active and the others are standbys ready to take over via leader election. A storage backend such as Raft or Consul (E) is also required, since it provides the shared, highly available data store that all nodes use for configuration, state, and leader election coordination. A secondary Vault cluster (B) is not part of a standard HA setup; it describes disaster recovery replication (performance or DR replication) rather than HA within a single cluster. An external monitoring tool (C) is useful for observability and alerting but is not a required architectural component of Vault's HA design.

Answer

A secondary Vault cluster.

Answer

An external monitoring tool.

Question 13

Which THREE factors influence the performance of a Performance Secondary cluster?

Accepted Answer

The speed of the network between primary and secondary.. Option A is correct because a Performance Secondary receives replicated data from the Primary over the network, so the bandwidth and latency of the link between primary and secondary directly affect how quickly that replication is applied and how current the secondary's data is. Option B is correct because the secondary must persist and serve the replicated writes from its own storage backend, so disk IOPS, throughput, and latency on the secondary determine how fast it can apply and read that data. Option E is correct because the volume of write operations on the Primary drives the replication workload the secondary must process; a higher write rate increases the replication traffic and processing burden on the secondary. Option C is not correct because Performance Standby nodes are read-only replicas that scale read capacity on the Primary cluster and do not govern the performance of a Performance Secondary. Option D is not correct because root tokens are authentication credentials and have no bearing on cluster performance.

Answer

The number of Performance Standby nodes on the Primary cluster.

Answer

The number of root tokens in the system.

Question 14

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

Accepted Answer

api_addr. Option C (api_addr) is critical because it tells each Vault node the address clients and other clusters should use to reach its API, and an incorrect value breaks cross-cluster request routing. Option D (listener.tcp.address) is critical because the TCP listener must bind to an address reachable by the peer cluster (e.g., 0.0.0.0:8200 or the node's routable IP) rather than only loopback, otherwise incoming cross-cluster traffic cannot connect. Option E (cluster_addr) is critical because it advertises the node's address for cluster-to-cluster (Raft replication) traffic, and a wrong or unreachable value prevents nodes from joining and replicating across clusters. Option A (storage_type) is not a cross-cluster communication setting; it only selects the backend (e.g., raft, file, consul) and does not affect inter-node reachability. Option B (ui) merely enables or disables the web UI and has no bearing on cross-cluster communication.

Answer

storage_type

Answer

ui

Question 15

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

Accepted Answer

Use the Vault Agent injector for automatic sidecar management.. Option A is correct because the Vault Agent injector automatically manages the lifecycle of Vault tokens for pods, rendering secrets into a shared volume and renewing or re-authenticating tokens without exposing long-lived credentials to application code, which reduces the attack surface for token theft. Option B is correct because applying 'token_bound_cidrs' to the Kubernetes auth role restricts the issued token so it can only be used from specified CIDR ranges, meaning a stolen token is useless if replayed from an unauthorized network location. Option C is correct because setting short TTLs on all issued tokens limits the window of opportunity for an attacker who obtains a token, forcing frequent re-authentication and reducing the blast radius of a compromise. Option D is not recommended because disabling audit logging removes the ability to detect and investigate token theft or misuse, and audit logging is a core security control rather than an optional performance trade-off. Option E is not recommended because using the 'root' token for an application grants unrestricted, long-lived privileges across Vault, so any theft of that token results in total compromise rather than scoped access.

Answer

Disable audit logging to increase performance.

Answer

Use the 'root' token for the application.

Question 16

When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?

Accepted Answer

The scope of the service account token.. Option B is correct because the scope of the service account token determines what the Vault Kubernetes auth backend can validate and which namespaces, service accounts, and audiences are trusted; a broadly scoped or overly permissive token increases the blast radius if compromised. Option C is correct because Vault must validate the Kubernetes API server CA when calling the TokenReview API, ensuring it is communicating with the legitimate API server and preventing man-in-the-middle attacks that could forge token validation responses. Option E is correct because the TTL of the Vault token generated limits the window of exposure; shorter TTLs reduce the impact of a stolen Vault token and force periodic re-authentication. Option A is not relevant because the number of nodes in the cluster does not directly affect Vault-Kubernetes auth token compromise. Option D is not relevant because the Kubernetes binary version alone does not determine the security of the Vault auth integration, though supported versions matter for overall cluster security.

Answer

The number of nodes in the cluster.

Answer

The version of the Kubernetes binary.

Question 17

A platform engineer is configuring a Vault Agent on a database server. The agent must use the AppRole auth method and write the resulting token to a file so that a local backup script can read it. Which top-level configuration block should the engineer populate to define the AppRole role ID and secret ID?

Accepted Answer

auto_auth. Agent authentication is configured in the auto_auth block, where the method type and its parameters are declared. For AppRole, role_id and secret_id belong inside the method block nested under auto_auth. The other blocks handle caching, listeners, and secret rendering, and none of them accept authentication credentials. Without auto_auth, the agent has no token source.

Answer

cache

Answer

listener

Answer

template

Question 18

An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?

Accepted Answer

Renewing the token.. Batch tokens in Vault are lightweight, non-renewable tokens designed for high-scale, short-lived workloads. Because they are not persisted in Vault's storage backend and have a fixed TTL, they cannot be renewed — attempting to renew a batch token will fail. They can still be used to authenticate, read secrets, and perform operations like Transit encryption, provided the token's policies allow it.

Answer

Performing a Transit engine encryption.

Answer

Authenticating with a configured auth method.

Answer

Reading a secret from the KV engine.

Question 19

A Vault Enterprise operator is investigating a sudden increase in memory usage on a Vault node. They suspect that a large number of leases are accumulating. Which telemetry metric should they examine to track the total number of active leases in the cluster?

Accepted Answer

vault.expire.num_leases. The metric vault.expire.num_leases tracks the total number of leases in the expiration manager. It is the correct choice for monitoring active leases and diagnosing memory usage spikes. Other options are either non-existent or unrelated to lease counts. This metric is essential for understanding lease-related resource consumption in Vault Enterprise.

Answer

vault.lease.count

Answer

vault.lease.active

Answer

vault.token.count

Question 20

You are using Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. You need to ensure that the secondary cluster can continue to serve read requests even if the primary cluster becomes unavailable. Which statement describes the behavior of the secondary cluster in this scenario?

Accepted Answer

The secondary cluster will continue to serve read requests using its local replica of the data, but writes will fail until the primary is restored or the secondary is promoted.. Performance Replication secondaries are designed to serve read requests locally, providing read scalability and disaster recovery. If the primary becomes unavailable, the secondary can continue to serve reads from its local replica, but it cannot accept writes unless it is manually promoted to primary. This ensures that read operations remain available during a primary outage.

Answer

The secondary cluster will become read-only and reject all requests, including reads, until the primary is back online.

Answer

The secondary cluster will redirect all read requests to the primary cluster, causing failures if the primary is down.

Answer

The secondary cluster will automatically promote itself to primary and begin accepting writes.