Vault Enterprise Practice Test 4 — 25 Questions

Question 1

You are running a Vault Enterprise cluster with integrated storage (Raft) across three nodes. One node, vault-3, experiences a hardware failure and is offline for an extended period. After it is repaired and brought back online, you notice that it is not automatically rejoining the cluster. You run `vault operator raft list-peers` on the leader and see that vault-3 is not listed. What is the correct procedure to re-add vault-3 to the cluster?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

On vault-3, run `vault operator raft join http://<leader-api-addr>:8200`.. When a Raft node is offline for too long, it may be removed from the cluster configuration. To re-add it, you must run `vault operator raft join` on the node itself, pointing to a current leader. This initiates the join process, and the node will be added back as a follower and catch up on missed data. This is the standard recovery procedure for a node that has been absent.

Answer

On the leader, run `vault operator raft remove-peer vault-3` and then re-add it using `vault operator raft join` from vault-3.

Answer

On the leader, run `vault operator raft add-peer vault-3`.

Answer

On vault-3, run `vault operator raft snapshot restore` using the latest snapshot from the leader.

Question 2

An administrator has configured a Vault Enterprise server to use a PKCS#11 HSM for auto-unseal. After a reboot, Vault fails to start and logs show that the PKCS#11 library could not be loaded. Which action should the administrator take first to resolve the issue?

Accepted Answer

Verify that the `lib` path in the `seal` stanza points to a valid PKCS#11 shared library and that the file permissions allow the Vault process to read it.. A PKCS#11 library load failure typically stems from an incorrect `lib` path or missing file permissions. The Vault process must be able to read and load the vendor's shared library. Verifying the path and permissions is the correct first troubleshooting step, whereas reinitializing the token, changing the mechanism, or disabling Seal Wrap do not address the root cause.

Answer

Reinitialize the HSM token with a new PIN using the vendor's management utility.

Answer

Change the `mechanism` in the seal stanza to `CKM_RSA_PKCS_OAEP` and restart Vault.

Answer

Disable Seal Wrap temporarily by setting `seal_wrap = false` in the seal stanza and restart Vault.

Question 3

A Vault Enterprise administrator is reviewing the security of a new auth method that will be used by external partners. The partners will authenticate from their own networks and will receive tokens with a limited set of policies. The administrator wants to ensure that if a token is stolen, the blast radius is minimized. Which TWO controls should be applied to the auth role to reduce the impact of a stolen token? (Choose two.)

Accepted Answer

Set a short token TTL and a short max TTL on the role so that tokens expire quickly and cannot be renewed indefinitely.. Short TTLs and CIDR binding are complementary controls that reduce the usefulness of a stolen token. Short TTLs limit the time window, while CIDR binding limits the network locations from which the token can be used. Together they shrink the blast radius. Indefinite renewal, root policy, and disabling audit logging all increase risk and violate least privilege.

Answer

Enable the token to be renewed indefinitely so that partners do not need to re-authenticate frequently, reducing the chance of credential exposure during login.

Answer

Assign the root policy to the token so that administrators can quickly investigate and remediate any suspicious activity.

Answer

Disable audit logging for the auth method to prevent attackers from learning which policies are assigned to the token.

Question 4

A Vault Enterprise cluster is running with three nodes. The active node is handling both reads and writes, and the two standby nodes are idle. You want to scale read performance by allowing the standby nodes to serve read requests while maintaining the same high availability and data consistency guarantees. Which configuration should you enable?

Accepted Answer

Set `performance_standby = true` in the Vault configuration file on the standby nodes and restart the Vault service.. Performance Standby nodes are a Vault Enterprise feature that allows standby nodes to serve read requests, offloading the active node and scaling read throughput. They are enabled by setting `performance_standby = true` in the configuration file on the standby nodes. This maintains high availability because one node remains active for writes, while standbys handle reads and can take over if the active node fails.

Answer

Enable the `read_replica` option on the active node and configure the standby nodes to forward read requests to the active node.

Answer

Enable Integrated Storage (Raft) with three voters and configure `performance_standby` on the standby nodes via the `vault operator raft` command.

Answer

Deploy a separate Performance Secondary cluster and configure Performance Replication to forward read requests to it.

Question 5

A security engineer is configuring Vault Enterprise to allow an application to authenticate using AppRole. The application will run on a server that has a unique role ID and secret ID. The engineer wants to ensure that the secret ID can be used only once and expires after 24 hours. Which AppRole role configuration parameters should be set to achieve this?

Accepted Answer

secret_id_num_uses=1 and secret_id_ttl=24h. The AppRole role parameters secret_id_num_uses and secret_id_ttl control the usage limit and TTL of secret IDs. Setting secret_id_num_uses=1 restricts the secret ID to a single use, and secret_id_ttl=24h ensures it expires after 24 hours. The other options either target token parameters instead of secret ID, set TTL to zero (no expiration), or allow unlimited uses.

Answer

secret_id_num_uses=0 and secret_id_ttl=24h

Answer

token_num_uses=1 and token_ttl=24h

Answer

secret_id_num_uses=1 and secret_id_ttl=0

Question 6

You are operating a Vault Enterprise cluster using the integrated Raft storage backend with three nodes. The cluster is used for production secrets management. After a scheduled maintenance window, you notice that the Vault service on one node was not restarted automatically. When you check the node's status, it is running but not part of the Raft cluster. You need to rejoin the node to the Raft cluster without affecting the existing leader or other peers. Which command should you run on the node to achieve this?

Accepted Answer

vault operator raft join http://leader-address:8200. To rejoin a node to an existing Raft cluster, you must use the raft join command with the address of the current leader or any active peer. This safely adds the node as a follower, allowing it to synchronize with the cluster. Other commands like snapshot restore or init would disrupt the node's state and are not appropriate for this scenario. Unsealing alone does not establish cluster membership.

Answer

vault operator raft snapshot restore -file=snapshot.snap

Answer

vault operator init -key-shares=1 -key-threshold=1

Answer

vault operator unseal

Question 7

An administrator is configuring a Vault Enterprise cluster with Integrated Storage (Raft). They want to ensure that the cluster can automatically recover from a full restart without manual unseal steps, while still protecting the master key. They have deployed a supported cloud KMS. Which configuration should they use?

Accepted Answer

Enable auto-unseal using the cloud KMS seal stanza, which wraps the master key and allows Vault to unseal automatically on startup.. Auto-unseal with a cloud KMS seal stanza is the supported method for automatic recovery after a full restart. The KMS wraps the master key and performs decryption on startup, eliminating manual unseal while retaining strong protection. Storing unseal keys on disk or relying on recovery keys does not achieve the same security or functional goal.

Answer

Store the unseal keys in a file on each node and configure a systemd unit to submit them at boot.

Answer

Configure the Raft peers to share the master key among themselves so that a quorum can unseal the cluster without external input.

Answer

Use the recovery keys generated by Integrated Storage to automatically unseal the cluster on startup.

Question 8

You are configuring a Vault Enterprise cluster with integrated storage to scale for a high-read workload. You plan to add performance standby nodes. Which two statements accurately describe how performance standbys affect scaling and request handling? (Choose two.)

Accepted Answer

Performance standbys forward write requests to the active node, which then commits the change to the replicated data store.. Performance standbys scale read-heavy workloads by serving reads locally from the replicated data store, and they forward writes to the active node for commitment. They do not participate in Raft elections and cannot become active, which distinguishes them from standard standbys. These two characteristics make them ideal for read scaling without altering the write path or failover topology.

Answer

Performance standbys participate in the Raft quorum and can become the active node if the current active fails.

Answer

Performance standbys can accept write requests and commit them directly to the integrated storage backend.

Answer

Performance standbys require a separate integrated storage backend that is synchronized via performance replication.

Question 9

You are troubleshooting performance issues in a Vault Enterprise cluster that uses Integrated Storage. You notice that the Raft leader is frequently changing, causing disruptions in service. Which of the following is the most likely cause of this instability?

Accepted Answer

The Vault cluster nodes have insufficient CPU or memory resources, causing the leader to be unable to maintain heartbeats.. Frequent Raft leader elections are often a symptom of the leader being unable to send heartbeats in a timely manner. This can occur if the leader node is under-resourced (CPU, memory, disk I/O) or if there are network issues. Insufficient resources can cause the Vault process to stall, missing heartbeat deadlines. Ensuring adequate resources and stable networking is key to Raft stability.

Answer

The Raft protocol is configured with a very high election timeout, causing leaders to step down prematurely.

Answer

The Vault cluster is using a single node for storage, which is not supported for Integrated Storage.

Answer

The network latency between Vault nodes is extremely low, causing heartbeats to arrive too quickly.

Question 10

A Vault Enterprise operator has just enabled the Transit secrets engine in a namespace dedicated to a payment processing team. The team stores encryption keys in Transit and uses them to encrypt customer credit card data before writing it to an external database. An auditor asks the operator to prove that the plaintext of those credit card numbers never leaves the Vault server. Which property of the Transit secrets engine supports this claim?

Accepted Answer

Transit performs cryptographic operations inside Vault's barrier and returns only ciphertext, so plaintext submitted for encryption is never persisted or returned to callers.. Transit is a cryptographic service: callers send plaintext, Vault returns ciphertext, and no plaintext is persisted. This directly satisfies the auditor's requirement that credit card plaintext never leaves the Vault server. Options that describe storing plaintext on disk or in the barrier describe architectures that do not exist and would undermine the compliance guarantee the team needs.

Answer

Transit stores each plaintext alongside its ciphertext in the barrier so that decryption can be audited against the original input.

Answer

Transit encrypts plaintext only after it has been written to a write-ahead log, ensuring recoverability but leaving a transient plaintext copy on disk.

Answer

Transit uses the storage backend's encryption-at-rest to protect plaintext, so plaintext is stored but remains unreadable without the unseal keys.

Question 11

A Vault administrator is configuring a new auth method and wants to ensure that the auth method's configuration is protected from unauthorized changes. Which Vault feature should be used to control access to the auth method configuration endpoints?

Accepted Answer

ACL policies. ACL policies are the primary method to control access to Vault's API endpoints, including those for auth method configuration. By defining policies that allow or deny capabilities on specific paths, administrators can ensure that only authorized users or applications can modify auth method settings. The other features serve different purposes: audit devices log, seal wrapping protects the master key, and namespaces isolate resources.

Answer

Namespaces

Answer

Seal wrapping

Answer

Audit devices

Question 12

You are operating a Vault Enterprise cluster with Performance Replication. The primary cluster is in us-east-1 and a secondary cluster is in eu-west-1. Clients in eu-west-1 are configured to read secrets from the secondary cluster. You notice that after a brief network disruption between the regions, the secondary cluster's replication status shows 'stream-wals' but with a high lag. Some read requests to the secondary are returning stale data. You need to ensure that the secondary cluster serves reads only when it is sufficiently up-to-date. Which action should you take?

Accepted Answer

Monitor the replication lag using `vault read sys/replication/performance/status` and, if lag is unacceptable, temporarily redirect clients to the primary until the secondary catches up.. Performance Replication secondaries serve reads locally, which can be stale if replication lag is high. Vault does not provide an automatic mechanism to reject reads based on lag. The correct operational approach is to monitor lag via the replication status API and, when necessary, redirect clients to the primary to avoid stale data. This manual intervention ensures consistency until the secondary catches up.

Answer

Use the `vault write sys/replication/performance/secondary/update-primary` command to force the secondary to re-sync from the primary.

Answer

Enable `replication_primary_only` on the secondary cluster to prevent it from serving reads until it catches up.

Answer

Configure the secondary cluster's `max_lag` parameter in the replication configuration to a low value, and set the secondary to reject reads if lag exceeds that value.

Question 13

An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for seal wrapping and auto-unseal. After enabling the HSM, the administrator notices that the Vault cluster fails to start, reporting that the seal wrap key cannot be retrieved. Which configuration step is most likely missing?

Accepted Answer

The `seal` stanza in the Vault configuration file does not include the correct `key_label` for the seal wrap key.. When using an HSM for seal wrapping, Vault must be configured with the correct key_label in the seal stanza to locate the seal wrap key. If the key_label is missing or incorrect, Vault cannot retrieve the key and fails to start. Other HSM-related issues like PIN or firmware would produce different errors.

Answer

The HSM slot PIN was not provided to Vault via the `VAULT_HSM_PIN` environment variable.

Answer

The HSM firmware version is incompatible with Vault's PKCS#11 library.

Answer

The `disable_mlock` option is set to true, preventing Vault from accessing the HSM.

Question 14

You are deploying a Vault Enterprise cluster with Integrated Storage and want to ensure high availability. The cluster will have five nodes. What is the minimum number of nodes that must be active and healthy to maintain quorum and allow write operations?

Accepted Answer

3. Quorum in a Raft cluster is determined by a majority of nodes. For a five-node cluster, the majority is three. Therefore, at least three nodes must be active and healthy to maintain quorum and allow write operations. This provides tolerance for up to two node failures.

Answer

2

Answer

1

Answer

5

Question 15

A security team is reviewing how Vault Enterprise tokens are bound to their origin. They observe that a batch token issued by an auth method in one performance standby node is presented to a different performance standby node and is accepted. They want to understand why this behavior is expected and what security property batch tokens lack compared to service tokens. Which statement correctly describes batch tokens in Vault Enterprise?

Accepted Answer

Batch tokens are encrypted blobs that carry their own authorization data and can be validated by any node without a storage lookup, but they cannot be revoked individually.. Batch tokens are self-contained encrypted blobs validated locally by any node, which explains acceptance on a different performance standby. The trade-off is that they are not individually revocable because no storage entry exists. Service tokens, by contrast, are stored and can be revoked individually but require a storage lookup and are not portable as opaque blobs.

Answer

Batch tokens are validated by forwarding the request to the active node, which performs the storage lookup and returns the authorization decision.

Answer

Batch tokens are stored in the cluster's replicated storage and are replicated to performance standbys, which is why they are accepted on any node.

Answer

Batch tokens use the same storage-backed lease mechanism as service tokens but with a shorter TTL, which is why they appear on multiple nodes.

Question 16

You are operating a Vault Enterprise cluster with Integrated Storage (Raft) and Performance Replication enabled. The primary cluster has three nodes, and the secondary cluster has three nodes. During a planned maintenance window, you need to take down the primary cluster for two hours. You want the secondary cluster to continue serving read requests for replicated data but not accept writes to avoid conflicts when the primary returns. Which action should you take on the secondary cluster before taking down the primary?

Accepted Answer

Do nothing; the secondary cluster already serves reads and rejects writes to replicated data.. A Performance Replication secondary cluster inherently serves read requests for replicated data and rejects writes to those paths unless it is promoted to primary. This design allows for read scaling and disaster recovery without manual intervention. During primary downtime, the secondary continues to function as a read-only replica, so no configuration change is required to maintain that behavior.

Answer

Demote the primary cluster to secondary and then promote the secondary cluster to primary.

Answer

Promote the secondary cluster to primary using 'vault operator promote'.

Answer

Set the secondary cluster to 'read-only' mode using 'vault write sys/replication/performance/secondary/read-only'.

Question 17

An administrator is configuring a new Vault Enterprise server that will use Integrated Storage. They need to specify the storage stanza in the configuration file. Which TWO parameters are required within the 'storage "raft"' stanza to ensure the node can participate in the cluster? (Choose two.)

Accepted Answer

node_id. For a Vault node using Integrated Storage, the 'path' and 'node_id' parameters are required within the 'storage "raft"' stanza. The 'path' defines where data is stored, and 'node_id' uniquely identifies the node in the Raft cluster. Other parameters like 'retry_join' are used for joining but can be replaced by the 'discovery' stanza, and tuning parameters are optional.

Answer

max_entry_size

Answer

retry_join

Answer

performance_multiplier

Question 18

You are scaling a Vault Enterprise cluster to handle a high volume of database credential generation. You configure the database secrets engine with a maximum open connections setting of 100 and a maximum idle connections setting of 20. After a few hours, you notice that the number of open connections to the database frequently reaches 100 and stays there, even when request rates are moderate. You want to reduce the connection churn and improve performance without changing the maximum open connections. What should you do?

Accepted Answer

Increase the maximum idle connections setting to a value closer to the maximum open connections.. The database secrets engine maintains a connection pool to the database. When max_idle_connections is set too low relative to max_open_connections, idle connections are closed and must be recreated when new requests arrive, causing churn and performance degradation. Raising max_idle_connections allows more connections to remain idle and be reused, reducing the overhead of establishing new connections while still respecting the maximum open connections limit.

Answer

Reduce the maximum open connections setting to force the pool to recycle connections more aggressively.

Answer

Enable the database secrets engine's connection pooling by setting a longer max_connection_lifetime.

Answer

Configure the database secrets engine to use a dynamic username template to reduce the number of distinct connections.

Question 19

An operator is troubleshooting a Vault Enterprise cluster where audit logs show that a token was used from an unexpected IP address. The security team wants to enforce that a particular token can only be used from the corporate CIDR block 10.0.0.0/8. Which Vault token parameter should be set to achieve this?

Accepted Answer

token_bound_cidrs. The token_bound_cidrs parameter is specifically designed to restrict a token's usage to a set of CIDR blocks. By setting it to 10.0.0.0/8, the token will only be accepted from IP addresses within that range, directly mitigating the risk of use from unexpected locations. Other parameters like token_num_uses or token_ttl address different aspects of token security and do not provide IP-based restrictions.

Answer

token_num_uses

Answer

token_explicit_max_ttl

Answer

token_ttl

Question 20

You are configuring Vault Agent auto-auth with the AppRole auth method on a set of servers. You need to ensure that the agent can authenticate securely using role_id and secret_id. Which two configuration parameters are required within the auto_auth method block for AppRole? (Choose two.)

Accepted Answer

role_id. For AppRole authentication in Vault Agent's auto_auth stanza, both role_id and secret_id are mandatory. They provide the necessary credentials to authenticate. Optional parameters like namespace and mount_path are only needed in specific configurations, such as when using a custom namespace or mount path. wrap_ttl is unrelated to the method block and is used for response wrapping in sinks.

Answer

namespace

Answer

wrap_ttl

Answer

mount_path