Vault Enterprise Practice Test 2 — 25 Questions

Question 1

What does the 'vault_core_seal_setup_duration' metric represent?

Accepted Answer

The duration of the unseal process.. The 'vault_core_seal_setup_duration' metric measures the time taken to complete the unseal process — specifically, the duration of the seal setup operations that occur when Vault transitions from sealed to unsealed. It is a core telemetry metric used to monitor unseal performance.

Answer

The time taken to initialize the storage backend.

Answer

The time between audit log rotations.

Answer

The time spent waiting for a lease to expire.

Question 2

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

Accepted Answer

debug. The debug log level captures the most granular diagnostic output from Vault, including internal subsystem activity, plugin initialization steps, and configuration parsing details that occur during startup. When troubleshooting startup failures, this verbosity is essential because errors often originate before the listener or storage backends fully initialize, and lower log levels suppress those early messages. Setting log_level = "debug" in the Vault configuration or passing -log-level=debug at startup surfaces the exact sequence of operations leading to the failure.

Answer

warn

Answer

error

Answer

info

Question 3

What is the benefit of using Performance Replication over standard DR Replication?

Accepted Answer

Performance replication allows the secondary to serve read requests.. Performance Replication is designed to let secondary clusters serve read requests locally, offloading read traffic from the primary and reducing latency for geographically distributed users. This is its defining benefit over DR Replication, which keeps secondaries in a warm standby state that cannot serve client reads.

Answer

Performance replication supports write operations.

Answer

Performance replication provides disaster recovery capabilities.

Answer

Performance replication is cheaper to license.

Question 4

When running 'vault operator raft list-peers', you notice one node is listed but its status is 'dead'. What is the correct procedure to remove it from the Raft cluster?

Accepted Answer

Run 'vault operator raft remove-peer'.. The 'vault operator raft remove-peer' command is the supported, safe way to evict a dead node from the Raft cluster. It instructs the leader to remove the peer from the Raft configuration, allowing the remaining nodes to re-establish quorum without the failed member. This is the documented procedure for decommissioning or replacing a failed Raft node in Vault Enterprise.

Answer

Re-run the join command for the node.

Answer

Restart the leader node.

Answer

Delete the node's data directory manually.

Question 5

When using Vault with an external storage backend like Consul, what is the effect of changing the 'api_addr' in the Vault configuration file?

Accepted Answer

It updates the address clients and peers use to communicate with the node.. The 'api_addr' in Vault's configuration specifies the address that Vault advertises to clients and other cluster nodes for API communication. Changing it updates the address used for client requests, redirects, and peer communication. It does not affect storage backend connectivity or trigger leader election.

Answer

It forces a cluster leader election.

Answer

It disables high availability mode.

Answer

It changes the storage backend connection string.

Question 6

You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?

Accepted Answer

Port 8200 and port 8201.. Vault replication requires both the API port (8200) and the cluster port (8201) to be open between primary and secondary clusters. Port 8200 carries client API traffic and replication API calls, while port 8201 is the dedicated cluster-to-cluster port used for replication data streaming and internal RPC between nodes. Both must be reachable bidirectionally for replication to establish and stay healthy.

Answer

Only port 8200.

Answer

Port 443 and port 80.

Answer

Only port 8201.

Question 7

You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?

Accepted Answer

Set a different 'kubernetes_host' for each cluster.. Setting a different 'kubernetes_host' for each cluster's auth method configuration ensures that Vault validates service account tokens against the correct Kubernetes API server. The kubernetes_host is the API endpoint Vault uses to verify the token's issuer and audience via TokenReview. If both clusters pointed to the same host, a token from Cluster B could be validated by Cluster A's Vault, enabling cross-cluster authentication.

Answer

Use the same 'kubernetes_ca_cert' for both clusters.

Answer

Enable 'token_bound_cidrs' on the roles.

Answer

Assign different 'token_policies' to the roles.

Question 8

What permission level is required for the user account used to authenticate with the HSM?

Accepted Answer

The account must have Crypto User (CU) privileges.. The HSM user account used by Vault must have Crypto User (CU) privileges because Vault only needs to perform cryptographic operations (encrypt/decrypt/wrap/unwrap) against the HSM — it does not need to manage partitions, users, or policies. CU is the standard PKCS#11 role that grants access to cryptographic mechanisms and key objects without administrative control. This least-privilege model is what HashiCorp documents for Vault Enterprise HSM auto-unseal.

Answer

The account must be the partition owner.

Answer

The account must have anonymous access.

Answer

The account must have full Administrative (SO) privileges.

Question 9

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

Accepted Answer

Vault requires a manual update to the seal configuration and a restart.. Vault does not automatically failover to a secondary HSM; when the primary HSM becomes unavailable, Vault loses its seal and will not function until the seal is restored. To use a secondary HSM, an operator must manually update the seal configuration to point to the secondary HSM and then restart Vault. This manual intervention is required because the seal configuration is static and Vault does not support automatic HSM failover.

Answer

Vault waits until the primary HSM is back online.

Answer

Vault automatically detects the secondary HSM and switches over.

Answer

Vault fails over to Shamir's Secret Sharing mode.

Question 10

A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?

Accepted Answer

No action is required, assuming IAM permissions are correctly maintained.. When AWS KMS auto-unseal is configured, Vault stores the encrypted master key and calls KMS Decrypt to unwrap it. AWS KMS key rotation creates a new backing key version under the same key ID, and KMS transparently uses the correct version for decrypt operations. As long as the IAM principal Vault uses retains kms:Decrypt on that key, no Vault configuration change or restart is required.

Answer

Update the 'kms_key_id' in the configuration file.

Answer

Restart the Vault process to reload the KMS configuration.

Answer

Run vault operator rekey to update the master key.

Question 11

In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?

Accepted Answer

3 nodes.. A three-node Raft cluster is the minimum recommended for production because it tolerates the failure of one node while maintaining quorum. Raft requires a majority of nodes to be available for writes, so with three nodes, two must be up — allowing one failure without losing availability. This is the standard recommendation for Vault HA deployments using integrated storage.

Answer

1 node.

Answer

2 nodes.

Answer

10 nodes.

Question 12

When utilizing performance replication, your Vault cluster experiences high replication lag between the primary and secondary sites. Which action would most effectively reduce this lag?

Accepted Answer

Configure path filters to exclude high-churn paths from replication.. Performance replication lag is most directly reduced by filtering out high-churn paths (e.g., transit secrets engine, high-volume KV writes) that don't need to be replicated to the secondary. Path filters let you exclude specific mounts from replication, cutting the volume of data that must traverse the link and thus reducing lag. This is the targeted, effective action for a bandwidth-bound replication lag problem.

Answer

Convert the secondary cluster to a Disaster Recovery secondary.

Answer

Increase the number of Performance Standby nodes.

Answer

Enable Batch token replication.

Question 13

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

Accepted Answer

In the AppRole Role definition. Token restrictions like 'bound_cidrs' are configured on the 'role' within the AppRole auth method.

Answer

In the Namespace configuration

Answer

In the Identity Entity

Answer

In the Token Auth Method

Answer

Inside the ACL policy

Question 14

When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?

Accepted Answer

Vault stops processing requests.. By default, if Vault cannot write to the audit device, it will stop processing requests to ensure no un-audited operations occur.

Answer

Vault alerts the admin via email.

Answer

Vault ignores the error and continues.

Answer

Vault switches to a backup audit device.

Question 15

How do you properly revoke a root token after it has been used to perform initialization tasks?

Accepted Answer

Use the 'vault token revoke' command.. The correct way to revoke a root token is to use the `vault token revoke` command, which sends a revocation request to Vault's token store. This immediately invalidates the token, ensuring it cannot be used for any further operations. Since root tokens are highly privileged, proper revocation is critical for security. The command works whether the token is provided via argument or through the `VAULT_TOKEN` environment variable.

Answer

Restart the server.

Answer

Overwrite it with a new token.

Answer

Delete the token file.

Question 16

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

Accepted Answer

The server logs.. Leader election events in a Vault HA cluster are logged by the Vault server itself, so the server logs are where you find messages about acquiring/losing leadership, stepping down, and transitioning between active and standby states. These logs include timestamps and the node identity, making them the authoritative source for election history. Telemetry and audit logs do not record election mechanics.

Answer

The telemetry metrics.

Answer

The storage backend logs.

Answer

The audit logs.

Question 17

Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?

Accepted Answer

Performance Replication.. Performance Replication (B) is a Vault Enterprise-only feature that lets a cluster serve read-heavy workloads across multiple secondary clusters while writes are forwarded to the primary, and it is configured at the server level via the replication stanza and related server settings. HSM Seal Wrapping (D) is also Enterprise-only and directly tied to server configuration: it uses an HSM to wrap the root key so that unsealing can be performed automatically via the seal "pkcs11" stanza in the Vault server configuration. Audit logging (A), KV Secret Engine (C), and Token management (E) are all core Vault capabilities available in the open-source edition and are not Enterprise-specific server-configuration features, so they do not fit the scenario.

Answer

Audit logging.

Answer

KV Secret Engine.

Answer

Token management.

Question 18

When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?

Accepted Answer

To avoid accidental data loss or interference with production keys.. Using a separate HSM partition for development isolates dev/test keys from production keys, preventing accidental overwrites, deletions, or cryptographic operations that could corrupt or expose production key material. Partitions in an HSM are logically isolated security domains, so operations in one partition cannot affect objects in another. This is a best practice for safe testing of new HSM configurations.

Answer

The PKCS#11 library requires a unique partition for every Vault instance.

Answer

It reduces the memory footprint of the Vault service.

Answer

To increase the speed of the cryptographic operations.

Question 19

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

Accepted Answer

It allows Vault to unseal without manual intervention.. HSM Auto-Unseal delegates the unseal operation to a hardware security module (or a cloud KMS acting as one) that holds the master key. When Vault starts, it sends the encrypted master key to the HSM for decryption, allowing the node to unseal automatically without an operator supplying unseal keys. This eliminates manual unseal ceremonies after restarts and enables fully automated cluster recovery.

Answer

It provides backup redundancy for the Vault data.

Answer

It replaces the need for TLS encryption.

Answer

It increases the throughput of the storage backend.

Question 20

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

Accepted Answer

vault operator rekey -init. 'vault operator rekey -init' starts a rekey operation and, when combined with flags like '-key-shares' and '-key-threshold', allows you to change the unseal key configuration while generating a new master key. This is the only command that both rotates the master key and lets you alter the share/threshold parameters in a single operation.

Answer

vault operator unseal

Answer

vault secrets tune

Answer

vault operator rotate