Vault Enterprise Practice Test 5 — 25 Questions

Question 1

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

Accepted Answer

The server logs.. The server logs will provide specific information about cluster synchronization and leader election status.

Answer

The telemetry metrics.

Answer

The storage backend logs.

Answer

The audit logs.

Question 2

Which TWO of these are valid audit device types in Vault?

Accepted Answer

file. Vault supports 'file' and 'syslog' audit devices as standard options.

Answer

database

Answer

socket

Answer

stdout

Question 3

Which component is responsible for receiving and responding to read requests in a Performance Standby configuration?

Accepted Answer

The Performance Standby node.. Performance standby nodes are specifically designed to serve read requests, reducing the load on the active node.

Answer

The Active Vault node.

Answer

The Consul agent.

Answer

The Vault API Gateway.

Question 4

Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?

Accepted Answer

vault status. The 'vault status' command displays the seal type (e.g., 'shamir' or 'pkcs11') and the current seal status.

Answer

vault operator hsm-check

Answer

vault read sys/seal-config

Answer

vault seal-status

Question 5

Which telemetry type is most effective for monitoring the 'lease' count in Vault?

Accepted Answer

Gauges. Gauges are used to track values that can increase or decrease, such as the current number of active leases.

Answer

Summaries

Answer

Histograms

Answer

Counters

Question 6

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

Accepted Answer

debug. The 'debug' log level provides the most verbosity, which is useful for diagnosing complex startup or configuration errors.

Answer

warn

Answer

error

Answer

info

Question 7

Which THREE configuration options are valid within the 'template' block?

Accepted Answer

destination. These are core parameters for controlling template rendering in Vault Agent.

Answer

command

Answer

version

Question 8

Which TWO of the following are valid telemetry sinks supported by Vault?

Accepted Answer

Prometheus. Vault supports multiple telemetry sinks including StatsD and Prometheus.

Answer

Splunk

Answer

Nagios

Answer

ELK Stack

Question 9

When configuring Vault Agent auto-auth with TLS, where should you place the CA certificate file?

Accepted Answer

In the 'tls_ca_cert' parameter.. The CA certificate is specified in the 'tls_ca_cert' parameter within the 'auto_auth' block.

Answer

As an environment variable.

Answer

In the 'cache' block.

Answer

In the 'listener' block.

Question 10

You are using Seal Wrap. If you perform a 'vault operator rekey', what happens to the keys protected by Seal Wrap?

Accepted Answer

The new KEK is generated and wrapped by the HSM.. When rekeying, Vault re-encrypts the Master Key/KEK. If Seal Wrap is enabled, the HSM is used to perform the cryptographic operations for the new key, ensuring the chain of protection remains intact.

Answer

Seal Wrap is disabled and must be manually re-enabled.

Answer

Seal Wrap keys are excluded from the rekey process.

Answer

The keys must be manually unwrapped and re-wrapped.

Question 11

When configuring Vault Agent caching, you notice that the cache is not effectively reducing requests. Which configuration parameter controls the lifespan of cached items?

Accepted Answer

max_ttl. The 'max_ttl' parameter in the 'cache' block defines the maximum time an item can remain in the cache.

Answer

ttl

Answer

expiry

Answer

cache_timeout

Question 12

Which THREE of the following statements regarding PKCS#11 HSM integration in Vault are correct?

Accepted Answer

The HSM must be pre-provisioned with a key before Vault initialization.. Vault requires specific library versions, a pre-provisioned key, and proper configuration in the seal stanza for successful PKCS#11 integration.

Answer

Vault supports multiple concurrent HSM providers in a single stanza.

Answer

Seal Wrap is required for all HSM integrations.

Question 13

Which THREE pieces of information are captured in standard Vault audit logs for every request?

Accepted Answer

Requester identity.. Audit logs record the time, the request path, and the identity (token/accessor) associated with the request.

Answer

The server's CPU load at the time of request.

Answer

The client's IP address.

Question 14

When promoting a Performance Secondary to a Primary, what happens to the existing Performance Secondaries?

Accepted Answer

They must be manually re-pointed to the new Primary.. Performance secondaries are tied to a specific primary. If the primary changes or is promoted, the secondary relationships must be re-established.

Answer

They become Disaster Recovery secondaries.

Answer

They automatically promote themselves to Primary.

Answer

They are automatically removed from the cluster.

Question 15

What is the purpose of the 'prometheus_retention_time' setting in the Vault telemetry stanza?

Accepted Answer

This setting is invalid and will be ignored by Vault.. This setting does not exist in the telemetry stanza; it is a distractor. Monitoring retention is handled by the Prometheus server, not Vault itself.

Answer

To control the frequency of metric exports.

Answer

To define how long Vault keeps metrics in memory.

Answer

To tell Prometheus how long to store Vault's data.

Question 16

Which THREE types of metrics are collected by Vault's telemetry system?

Accepted Answer

Storage backend performance.. Vault telemetry includes metrics for request performance, storage backend status, and internal core operations.

Answer

Audit file size.

Answer

User password history.

Question 17

Your organization requires fine-grained control over what data is synchronized to a specific Performance Secondary cluster to reduce storage overhead. Which feature should you implement?

Accepted Answer

Replication path filters. Path filters allow administrators to define which paths are replicated to specific performance secondaries.

Answer

Namespace isolation policies

Answer

Mount tuning with local=true

Answer

Performance Standby path filtering

Question 18

If you are using Vault Agent templates to render a file, and the secret contains a newline, how can you ensure the output is correctly formatted in your template?

Accepted Answer

Use the 'indent' function.. Vault templates use Go templating; the 'indent' function or specific formatting is often needed for multi-line secrets.

Answer

Use the 'raw' function.

Answer

Use the 'base64' function.

Answer

It is not possible to render multiline secrets.

Question 19

When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?

Accepted Answer

Verify the 'aud' claim in the JWT.. The 'audience' field specifies the expected audience of the JWT, which helps in preventing token reuse attacks across different services.

Answer

Restrict access to specific K8s pods.

Answer

Define which namespaces can authenticate.

Answer

Control the maximum token TTL.

Question 20

Which TWO of the following are valid ways to improve the security of the AppRole authentication process?

Accepted Answer

Enable 'secret_id_bound_cidrs' on the role.. Response wrapping provides secure introduction, and CIDR binding adds network-level restrictions.

Answer

Disable TLS on the Vault listener.

Answer

Increase the SecretID TTL to infinity.

Answer

Share the same SecretID across all application replicas.