Vault Enterprise Practice Test 4 — 25 Questions

Question 1

When configuring the PKCS#11 library, how does Vault find the library on the host OS?

Accepted Answer

The path is provided in the 'lib' field of the seal configuration.. The 'lib' parameter in the seal stanza must contain the absolute file system path to the PKCS#11 shared library provided by the HSM vendor.

Answer

The path is defined in the Vault environment variables.

Answer

Vault expects the library to be located in '/usr/lib/vault'.

Answer

Vault looks in the LD_LIBRARY_PATH environment variable by default.

Question 2

Which component of Vault is responsible for communicating with the HSM?

Accepted Answer

The seal component.. The 'seal' component in the Vault configuration is specifically designed to interface with HSMs via the PKCS#11 standard.

Answer

The audit log manager.

Answer

The storage backend.

Answer

The transit engine.

Question 3

Which command is used to rotate the audit log file on a Vault server to ensure logs are written to a new file?

Accepted Answer

vault audit rotate. vault audit rotate is the specific command to instruct Vault to close the current audit log file and open a new one.

Answer

vault server reload

Answer

vault operator seal

Answer

vault log rotate

Question 4

You are troubleshooting high CPU usage in Vault. Which telemetry metric category should you examine first?

Accepted Answer

vault.route.request. Request handling metrics allow you to see if specific paths or operations are causing high demand on the CPU.

Answer

vault.core.token.create

Answer

vault.audit.request

Answer

vault.storage.read

Question 5

Which THREE of the following steps are necessary when performing a manual disaster recovery promotion?

Accepted Answer

Running 'vault operator dr promotion' on the secondary.. Promotion involves authenticating, executing the promotion command, and ensuring the new primary is reachable.

Answer

Deleting the old primary's data from the secondary.

Answer

Re-initializing the cluster.

Question 6

Which THREE factors influence the performance of a Performance Secondary cluster?

Accepted Answer

The speed of the network between primary and secondary.. Disk I/O, network latency, and the number of active requests are primary factors.

Answer

The number of Performance Standby nodes on the Primary cluster.

Answer

The number of root tokens in the system.

Question 7

Which TWO factors contribute to the 'cost' of using Batch tokens in a high-performance environment?

Accepted Answer

The inability to track tokens for audit compliance.. Batch tokens reduce storage load, but they increase the CPU/memory overhead for verification and the complexity of managing policies.

Answer

The need to replicate all tokens across regions.

Answer

Increased memory footprint for token storage.

Answer

Increased storage IOPS on the backend.

Question 8

You are using Vault Agent templates to generate a configuration file. You need the template to include a secret from a KV v2 engine. What is the correct syntax within the template file?

Accepted Answer

{{ secret "kv/data/config" }}. The 'secret' function is used in Vault templates to retrieve data from KV engines.

Answer

Answer

Answer

$vault.read("kv/config")

Question 9

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

Accepted Answer

It allows Vault to unseal without manual intervention.. Auto-Unseal removes the need for manual distribution of unseal keys, reducing operational overhead and the risk of human error during the unseal process.

Answer

It provides backup redundancy for the Vault data.

Answer

It replaces the need for TLS encryption.

Answer

It increases the throughput of the storage backend.

Question 10

How can you view the currently enabled audit devices in a Vault cluster?

Accepted Answer

vault audit list. The 'vault audit list' command displays all currently enabled audit devices and their configuration paths.

Answer

vault read sys/audit

Answer

vault list audit/devices

Answer

vault status -audit

Question 11

When reviewing Vault server logs, you see 'request_path' entries that are redacted. Why is this occurring?

Accepted Answer

The audit device is configured with 'log_raw=false'.. By default, audit logs redact sensitive information if the audit device is not configured to include sensitive payloads, or if the request contains sensitive parameters.

Answer

Vault is in recovery mode.

Answer

You are not logged in as a root user.

Answer

The log level is set to 'info'.

Question 12

Which THREE conditions might result in a Vault node becoming unhealthy?

Accepted Answer

Storage backend connection failure.. A node can become unhealthy if the storage backend is unreachable, the node is sealed, or it cannot reach the cluster leader.

Answer

Telemetry endpoint is down.

Answer

Audit logs are full.

Question 13

Which TWO of the following are valid ways to monitor replication health between clusters?

Accepted Answer

Using the vault read sys/replication/status command.. Vault provides metrics and the `operator` CLI command for health checks.

Answer

Querying the consul health check API.

Answer

Using the vault sys/health endpoint.

Answer

Watching the system logs for 'replication successful' messages.

Question 14

Which component of the Vault Agent is responsible for managing the lifecycle of the vault token retrieved via auto-auth?

Accepted Answer

Auto-auth. The 'auto_auth' component manages the token lifecycle, including renewal and rotation.

Answer

Sink

Answer

Template engine

Answer

Cache

Question 15

You have enabled 'seal_wrap' in Vault Enterprise. Which specific cryptographic operation is performed by the HSM under this feature?

Accepted Answer

Encrypting the Master Key Encryption Key (KEK).. Seal Wrap uses the HSM to encrypt the Master Key or specific data keys, ensuring the encryption keys never leave the HSM boundary in plaintext.

Answer

Signing Vault audit logs.

Answer

Generating random numbers for the entropy pool.

Answer

Performing TLS termination for Vault clients.

Question 16

When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?

Accepted Answer

To avoid accidental data loss or interference with production keys.. Using a separate partition prevents accidental interference with production cryptographic material and provides an isolated environment for testing keys and PINs.

Answer

The PKCS#11 library requires a unique partition for every Vault instance.

Answer

It reduces the memory footprint of the Vault service.

Answer

To increase the speed of the cryptographic operations.

Question 17

You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?

Accepted Answer

All incoming requests will be rejected until the audit device is restored.. Vault is designed to fail-closed regarding audit logs. If the audit device fails, requests are blocked to prevent un-audited operations.

Answer

Vault automatically switches to the secondary audit device.

Answer

Requests are permitted for read-only operations.

Answer

All requests are allowed but a warning is logged.

Question 18

You want to prevent audit logs from being written to a specific device if the disk is full. What happens to Vault?

Accepted Answer

Vault enters a blocked state for all client requests.. If a configured audit device cannot write, Vault blocks requests until the device is removed or restored, adhering to the fail-closed design.

Answer

Vault switches to a secondary file automatically.

Answer

Vault stops recording logs but continues operation.

Answer

Vault deletes the oldest logs to make room.

Question 19

You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?

Accepted Answer

Set a different 'kubernetes_host' for each cluster.. You must ensure that each Vault instance is configured with the correct 'kubernetes_host' and its own unique 'kubernetes_ca_cert' for the specific K8s cluster it is meant to trust.

Answer

Use the same 'kubernetes_ca_cert' for both clusters.

Answer

Enable 'token_bound_cidrs' on the roles.

Answer

Assign different 'token_policies' to the roles.

Question 20

When scaling Vault using Performance Standby nodes, how does the load balancer choose which node to direct the read traffic to?

Accepted Answer

The Consul agent performs automatic load balancing.. Vault's architecture relies on the load balancer to perform health checks on the nodes, and Performance Standby nodes will report as 'healthy' to indicate their readiness to serve reads.

Answer

The Active node dictates the traffic flow.

Answer

Vault uses a proprietary load balancing protocol.

Answer

The client performs the load balancing based on a local config file.