Vault Enterprise Practice Exam 4 — 20 Questions

Question 1

A DevOps engineer is using Vault Agent templates to render a database password from a KV v2 secrets engine. The secret is stored at secret/data/db with a key named password. The engineer wants to ensure the rendered file contains only the password value and no extra whitespace or newlines. Which template function should be used to trim whitespace from the secret value?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

trim. Vault Agent templates support the trim function to remove leading and trailing whitespace from a string. Applying it to the retrieved secret value ensures the output file contains only the password. Other functions like toUpper, base64Decode, and regexReplaceAll serve different purposes and do not provide the straightforward whitespace removal needed here.

Answer

regexReplaceAll

Answer

base64Decode

Answer

toUpper

Question 2

You are deploying a new Vault Enterprise cluster that will use a PKCS#11 HSM for auto-unseal. The HSM is a network-attached appliance reachable over TCP. Which TWO configuration elements must be present in the seal stanza to allow Vault to communicate with this HSM? (Choose two.)

Accepted Answer

The slot number or slot label that identifies the HSM partition.. To use a PKCS#11 HSM for auto-unseal, Vault needs the vendor's PKCS#11 library path and a way to select the correct slot or partition. These two elements allow Vault to load the library, initialize a session, and log in to the HSM. Other details such as management IP, serial number, or firmware version are not part of the seal stanza configuration.

Answer

The HSM's firmware version to ensure compatibility with Vault's PKCS#11 calls.

Answer

The HSM's serial number to bind the seal to a specific hardware unit.

Answer

The IP address and port of the HSM's management web interface.

Question 3

You are using Vault Enterprise with integrated storage (Raft) and have a three-node cluster. One node fails and is expected to be down for several hours. You want to ensure the cluster remains available for writes. What is the minimum number of nodes that must be running and healthy to maintain quorum and allow writes?

Accepted Answer

Two nodes, because a majority (quorum) of the three-node cluster must be available.. A three-node Raft cluster requires a quorum of two nodes to elect a leader and commit writes. One node can be down without affecting write availability, but if two nodes are down, the cluster loses quorum and writes fail. Vault does not queue writes during quorum loss.

Answer

One node, because Vault can operate in a degraded state.

Answer

Zero nodes, because Vault can queue writes until a node returns.

Answer

Three nodes, because all nodes must be available to accept writes.

Question 4

A Vault Agent is configured with auto_auth using the AWS auth method and a cache block with use_auto_auth_token = true. A client application connects to the agent's listener and sends a request to read a secret at secret/data/app. The agent's cached token lacks permission for that path, but the client also provides its own Vault token in the X-Vault-Token header. How does the agent handle the request?

Accepted Answer

The agent forwards the request to Vault using the client-provided token, because the client token takes precedence when present.. With use_auto_auth_token enabled, the agent uses its auto-auth token only when the client request lacks a token. If the client includes an X-Vault-Token header, the agent forwards that token to Vault. The agent does not evaluate permissions itself; Vault enforces policies. This design lets clients use their own tokens for specific paths while still leveraging the agent's caching and proxying.

Answer

The agent attempts to renew the auto-auth token and retries the request, ignoring the client token until the auto-auth token gains access.

Answer

The agent rejects the request with a 403 error because the auto-auth token is not authorized for the path.

Answer

The agent ignores the client token and uses the auto-auth token, causing Vault to return a permission denied error.

Question 5

A Vault Enterprise cluster is configured with Performance Replication to a secondary cluster. The secondary cluster is in a different region and is used for disaster recovery and read scaling. You notice that the secondary cluster is experiencing high replication lag, and some read requests return stale data. Which factor is most likely causing the lag?

Accepted Answer

The network latency between the primary and secondary clusters is high, and the primary is generating a high volume of writes.. Performance Replication lag is primarily influenced by network conditions and the write throughput on the primary. High latency between clusters and a heavy write load can cause the secondary to fall behind, leading to stale reads. To mitigate, ensure adequate network bandwidth and consider reducing write volume or scaling the primary.

Answer

The secondary cluster has a large number of Performance Standby nodes that are overwhelmed with read requests.

Answer

The primary cluster is using Integrated Storage (Raft) while the secondary uses Consul as its storage backend.

Answer

The secondary cluster is configured with a different seal mechanism than the primary cluster.

Question 6

An operator is configuring Vault Enterprise to send audit logs to a syslog server. The operator wants to ensure that audit logs are not lost if the syslog server becomes temporarily unavailable. Which configuration parameter should be adjusted to allow Vault to buffer audit logs in memory until the syslog server is reachable?

Accepted Answer

Vault does not support buffering audit logs; it will block requests if the audit device is unavailable.. Vault does not buffer audit logs. If an audit device is unreachable, Vault blocks requests to prevent unaudited actions. This design ensures that every request is logged, but it means that audit device availability is critical. To mitigate, operators should configure redundant audit devices or ensure the syslog server is highly available. The `log_raw` option, `facility`, and `tag` parameters do not affect buffering, and there is no `fallback` option. Thus, the correct understanding is that buffering is not supported.

Answer

The `fallback` option in the audit device configuration, which enables a secondary audit device for buffering.

Answer

The `log_raw` option in the audit device configuration.

Answer

The `syslog` audit device's `facility` and `tag` parameters.

Question 7

A Vault Enterprise cluster is configured with PKCS#11 auto-unseal. After a scheduled HSM firmware upgrade, Vault nodes fail to unseal and log 'PKCS#11 error: CKR_SLOT_ID_INVALID'. The HSM administrator confirms the partition is online and the PIN is unchanged. Which action should you take first to restore auto-unseal?

Accepted Answer

Verify the current slot ID with pkcs11-tool --list-slots and update the slot parameter in the seal stanza to match the new slot numbering.. After HSM firmware updates, slot numbering can change, causing CKR_SLOT_ID_INVALID because the seal stanza references an old slot index. Enumerating slots with pkcs11-tool --list-slots and updating the slot value restores auto-unseal. Reinitializing or restarting without fixing the slot does not resolve the mapping, and timeout tuning is irrelevant to slot validation.

Answer

Restart the Vault service on each node to force a re-read of the seal configuration.

Answer

Regenerate the Vault seal key and reinitialize the cluster with vault operator init.

Answer

Increase the hsm timeout parameter in the seal stanza to allow Vault more time to connect to the HSM.

Question 8

A Vault administrator is preparing a server configuration file for a new Vault Enterprise installation. They want to ensure that the Vault UI is accessible and that the server listens on all network interfaces for API requests. Which configuration settings should they use?

Accepted Answer

Set 'ui = true' at the top level and 'address = "0.0.0.0:8200"' in the 'listener' stanza.. To enable the Vault UI, set 'ui = true' at the top level of the configuration file. To listen on all interfaces, set 'address = "0.0.0.0:8200"' in the 'listener' stanza. This allows the UI to be accessed via any network interface and the API to accept requests from remote clients. Incorrect placement of 'ui' in other stanzas is a common mistake.

Answer

Set 'ui = true' in the 'listener' stanza and 'address = "127.0.0.1:8200"' in the same stanza.

Answer

Set 'ui = true' in the 'ui' stanza and 'address = "0.0.0.0:8200"' in the 'listener' stanza.

Answer

Set 'ui = true' in the 'storage' stanza and 'address = "0.0.0.0:8200"' in the 'listener' stanza.

Question 9

An operations team is deploying Vault Enterprise with Integrated Storage across three nodes. They want to ensure that if one node fails, the cluster remains available for both reads and writes. They also want to minimize the risk of split-brain scenarios. Which of the following configurations should they use?

Accepted Answer

Deploy three nodes, each in a different availability zone, all as voters, with automatic snapshotting enabled.. A three-node cluster with all nodes as voters provides a quorum of two, allowing the cluster to tolerate the failure of one node while maintaining write availability. Placing each node in a separate availability zone protects against zone failures. Other options either reduce quorum (non-voters or only two voters) or add unnecessary complexity (five nodes).

Answer

Deploy three nodes, each in a different availability zone, with one node configured as a non-voter.

Answer

Deploy two nodes, each in a different availability zone, both as voters, with a third node as a non-voter in a third zone.

Answer

Deploy five nodes, each in a different availability zone, all as voters, with performance standbys enabled.

Question 10

A Vault Enterprise administrator is configuring a new namespace for a subsidiary company. The subsidiary requires that only users authenticated via their corporate LDAP can access secrets in the namespace. Additionally, the subsidiary's security team must be able to manage policies and auth methods within the namespace but should not have access to the root namespace. Which combination of Vault Enterprise features should the administrator use to meet these requirements?

Accepted Answer

Create a namespace, configure LDAP auth within the namespace, and assign a policy with sudo capabilities on the namespace's sys/ path to the subsidiary's security team.. The correct solution uses a namespace to isolate the subsidiary, LDAP auth within that namespace for authentication, and sudo capabilities on the namespace's sys/ path to allow management of policies and auth methods. Sudo on the namespace's sys/ grants administrative control within that namespace only, preserving isolation from the root namespace. Other options either grant excessive root privileges or insufficient read-only access.

Answer

Create a namespace, configure LDAP auth within the namespace, and assign the subsidiary's security team a policy with read capabilities on the namespace's sys/ path.

Answer

Create a namespace, configure LDAP auth within the namespace, and assign the subsidiary's security team a policy with sudo capabilities on the root sys/ path.

Answer

Create a namespace, configure LDAP auth in the root namespace, and assign the subsidiary's security team a policy with sudo capabilities on the root sys/ path.

Question 11

You are setting up a Vault Enterprise server and want to enable the web UI for administrators. Which configuration setting must be added to the Vault configuration file?

Accepted Answer

`ui = true` in the top-level configuration.. To enable the Vault web UI, you must set `ui = true` as a top-level configuration parameter. This activates the UI on all listeners that support it. It is a simple boolean setting and does not require any listener or storage stanza modifications. Administrators can then access the UI via the Vault address.

Answer

`ui_enabled = true` in the listener stanza.

Answer

`ui = true` in the storage stanza.

Answer

`enable_ui = true` in the seal stanza.

Question 12

A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling Seal Wrap, the operator notices that some existing secrets still appear in plaintext within the storage backend. Which statement explains this behavior?

Accepted Answer

Seal Wrap only applies to new writes; existing data must be re-written or migrated to be wrapped, so pre-existing plaintext entries remain until they are updated.. Seal Wrap protects data by wrapping values with the HSM at write time. It is not a retroactive process, so secrets written before Seal Wrap was enabled remain unwrapped in storage. Operators must re-write or migrate that data to bring it under HSM protection. This is why a mix of wrapped and unwrapped entries can appear after enabling the feature.

Answer

The HSM is not configured with a wrapping key, so Vault silently falls back to plaintext storage for all secrets until a wrapping key is generated.

Answer

Seal Wrap requires a cluster restart to take effect, so until all nodes are restarted the storage backend will continue to show plaintext for all entries.

Answer

Seal Wrap is only compatible with the transit secrets engine, so data from other engines such as KV will always remain unwrapped in storage.

Question 13

A Vault Enterprise administrator is configuring a new auth method to authenticate an on-premises application that cannot present a platform identity. The administrator wants to ensure that the initial authentication can only be performed once per login attempt and that the authentication material is bound to the application's network location. Which AppRole role configuration should the administrator apply to achieve these requirements?

Accepted Answer

Set `secret_id_num_uses=1` and `secret_id_bound_cidrs` to the application's subnet.. The requirement is to limit the SecretID to a single use and restrict it to the application's network. secret_id_num_uses=1 ensures one-time use, and secret_id_bound_cidrs binds the SecretID to specific CIDR blocks. Together they prevent replay and enforce network location. Other parameters like token_num_uses or TTLs do not address the SecretID's usage or binding.

Answer

Set `token_num_uses=1` and `token_bound_cidrs` to the application's subnet.

Answer

Set `secret_id_ttl=1m` and `token_ttl=1m` to force rapid expiration.

Answer

Set `bind_secret_id=false` and rely on `secret_id_bound_cidrs` alone.

Question 14

An operator needs to verify that a Vault Enterprise cluster is currently using a PKCS#11 HSM for its seal and that the seal is healthy. Which command provides the seal type and status without requiring unseal keys?

Accepted Answer

vault status. The vault status command reports the seal type and whether Vault is sealed. When an HSM is configured, the output includes a seal type such as pkcs11 or hsm, confirming that auto-unseal is active. This command is safe to run without unseal keys and is the quickest way to verify seal health.

Answer

vault operator unseal -status

Answer

vault debug -seal

Answer

vault read sys/seal

Question 15

Your security team requires that Vault Agent use a specific namespace in Vault Enterprise for all auto-auth and secret retrieval operations. The agent is configured with AppRole auto-auth. Which configuration parameter must you set to ensure the agent operates within the required namespace?

Accepted Answer

namespace in the vault block. In Vault Enterprise, the agent's namespace is configured in the top-level vault block. This setting applies to all agent operations, including auto-auth, templating, and caching. Setting it there ensures the agent interacts with the correct namespace, which is essential for multi-tenant environments and proper access control.

Answer

namespace in the cache block

Answer

namespace in the template block

Answer

namespace in the auto_auth block

Question 16

You are running a Vault Enterprise cluster with integrated storage (Raft) across three nodes. One node, vault-3, experiences a hardware failure and is offline for an extended period. After it is repaired and brought back online, you notice that it is not automatically rejoining the cluster. You run `vault operator raft list-peers` on the leader and see that vault-3 is not listed. What is the correct procedure to re-add vault-3 to the cluster?

Accepted Answer

On vault-3, run `vault operator raft join http://<leader-api-addr>:8200`.. When a Raft node is offline for too long, it may be removed from the cluster configuration. To re-add it, you must run `vault operator raft join` on the node itself, pointing to a current leader. This initiates the join process, and the node will be added back as a follower and catch up on missed data. This is the standard recovery procedure for a node that has been absent.

Answer

On the leader, run `vault operator raft remove-peer vault-3` and then re-add it using `vault operator raft join` from vault-3.

Answer

On the leader, run `vault operator raft add-peer vault-3`.

Answer

On vault-3, run `vault operator raft snapshot restore` using the latest snapshot from the leader.

Question 17

An administrator has configured a Vault Enterprise server to use a PKCS#11 HSM for auto-unseal. After a reboot, Vault fails to start and logs show that the PKCS#11 library could not be loaded. Which action should the administrator take first to resolve the issue?

Accepted Answer

Verify that the `lib` path in the `seal` stanza points to a valid PKCS#11 shared library and that the file permissions allow the Vault process to read it.. A PKCS#11 library load failure typically stems from an incorrect `lib` path or missing file permissions. The Vault process must be able to read and load the vendor's shared library. Verifying the path and permissions is the correct first troubleshooting step, whereas reinitializing the token, changing the mechanism, or disabling Seal Wrap do not address the root cause.

Answer

Reinitialize the HSM token with a new PIN using the vendor's management utility.

Answer

Change the `mechanism` in the seal stanza to `CKM_RSA_PKCS_OAEP` and restart Vault.

Answer

Disable Seal Wrap temporarily by setting `seal_wrap = false` in the seal stanza and restart Vault.

Question 18

A Vault Enterprise administrator is reviewing the security of a new auth method that will be used by external partners. The partners will authenticate from their own networks and will receive tokens with a limited set of policies. The administrator wants to ensure that if a token is stolen, the blast radius is minimized. Which TWO controls should be applied to the auth role to reduce the impact of a stolen token? (Choose two.)

Accepted Answer

Set a short token TTL and a short max TTL on the role so that tokens expire quickly and cannot be renewed indefinitely.. Short TTLs and CIDR binding are complementary controls that reduce the usefulness of a stolen token. Short TTLs limit the time window, while CIDR binding limits the network locations from which the token can be used. Together they shrink the blast radius. Indefinite renewal, root policy, and disabling audit logging all increase risk and violate least privilege.

Answer

Enable the token to be renewed indefinitely so that partners do not need to re-authenticate frequently, reducing the chance of credential exposure during login.

Answer

Assign the root policy to the token so that administrators can quickly investigate and remediate any suspicious activity.

Answer

Disable audit logging for the auth method to prevent attackers from learning which policies are assigned to the token.

Question 19

A Vault Enterprise cluster is running with three nodes. The active node is handling both reads and writes, and the two standby nodes are idle. You want to scale read performance by allowing the standby nodes to serve read requests while maintaining the same high availability and data consistency guarantees. Which configuration should you enable?

Accepted Answer

Set `performance_standby = true` in the Vault configuration file on the standby nodes and restart the Vault service.. Performance Standby nodes are a Vault Enterprise feature that allows standby nodes to serve read requests, offloading the active node and scaling read throughput. They are enabled by setting `performance_standby = true` in the configuration file on the standby nodes. This maintains high availability because one node remains active for writes, while standbys handle reads and can take over if the active node fails.

Answer

Enable the `read_replica` option on the active node and configure the standby nodes to forward read requests to the active node.

Answer

Enable Integrated Storage (Raft) with three voters and configure `performance_standby` on the standby nodes via the `vault operator raft` command.

Answer

Deploy a separate Performance Secondary cluster and configure Performance Replication to forward read requests to it.

Question 20

A security engineer is configuring Vault Enterprise to allow an application to authenticate using AppRole. The application will run on a server that has a unique role ID and secret ID. The engineer wants to ensure that the secret ID can be used only once and expires after 24 hours. Which AppRole role configuration parameters should be set to achieve this?

Accepted Answer

secret_id_num_uses=1 and secret_id_ttl=24h. The AppRole role parameters secret_id_num_uses and secret_id_ttl control the usage limit and TTL of secret IDs. Setting secret_id_num_uses=1 restricts the secret ID to a single use, and secret_id_ttl=24h ensures it expires after 24 hours. The other options either target token parameters instead of secret ID, set TTL to zero (no expiration), or allow unlimited uses.

Answer

secret_id_num_uses=0 and secret_id_ttl=24h

Answer

token_num_uses=1 and token_ttl=24h

Answer

secret_id_num_uses=1 and secret_id_ttl=0