Vault Enterprise Practice Test 5 — 25 Questions

Question 1

A security team is reviewing the configuration of a Vault Enterprise cluster that uses the Transit secrets engine for encryption as a service. They want to ensure that the encryption keys are protected against unauthorized export and that cryptographic operations are audited. Which two configurations should they implement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the audit device and configure it to log all requests to the Transit engine.. To protect Transit keys from unauthorized export, the key must be created with exportable=false, which prevents extraction of key material. To audit cryptographic operations, an audit device must be enabled and capturing requests to the Transit engine. These two configurations together ensure key protection and auditability.

Answer

Set `allow_plaintext_backup=true` to enable secure backups of the key.

Answer

Configure the key with `derived=true` to ensure keys are unique per context.

Answer

Use `type=rsa-4096` to ensure strong encryption and prevent export.

Question 2

You have a Vault Enterprise cluster with integrated storage (Raft) running three nodes in one data center. To prepare for a potential data center outage, you add three more nodes in a second data center. After a network partition isolates the first data center, the three nodes in the second data center remain active and continue serving reads and writes. Later, the partition is resolved, but the original three nodes have not automatically rejoined. You need to restore the cluster to a healthy state with all six nodes participating, while minimizing downtime. What is the most appropriate action?

Accepted Answer

Use the `vault operator raft join` command on each of the original three nodes, specifying the API address of a current leader in the second data center.. When a network partition isolates a subset of Raft nodes, those nodes may not automatically rejoin after connectivity is restored, especially if they missed heartbeats and were removed from the active configuration. The correct recovery is to run `vault operator raft join` on each isolated node, pointing to a current leader. This re-establishes the node as a follower and allows it to catch up, restoring full cluster health with minimal disruption.

Answer

Run `vault operator raft snapshot restore` on the three nodes in the second data center to force them to recognize the original nodes as peers.

Answer

Restart the Vault service on all six nodes simultaneously to trigger a new leader election and automatic peer discovery.

Answer

Remove the three original nodes from the Raft configuration using `vault operator raft remove-peer`, then re-add them as new nodes with `vault operator raft join`.

Question 3

A Vault Enterprise cluster is configured with Auto-Unseal using AWS KMS. The security team rotates the KMS key used for Auto-Unseal. After rotation, Vault nodes are restarted. What is the expected behavior when the nodes attempt to unseal?

Accepted Answer

Vault will unseal successfully because AWS KMS automatically uses the correct key version based on the ciphertext metadata.. AWS KMS key rotation creates a new key version while preserving older versions. The ciphertext of Vault's root key contains metadata indicating which key version was used for encryption. When Vault requests decryption, KMS automatically uses that version, provided it is still enabled. Therefore, Vault unseals successfully without configuration changes or manual rekeying.

Answer

Vault will require a manual rekey of the root key using the new KMS key version before it can unseal.

Answer

Vault will fail to unseal because the encrypted root key was encrypted with the old key version, and the new key version cannot decrypt it.

Answer

Vault will automatically detect the new key version and unseal successfully without any configuration changes.

Question 4

You are configuring Vault Agent with a cache stanza to cache responses from a Vault Enterprise cluster. The cache is enabled, and you want to ensure that the agent can continue to serve cached secrets even if the Vault cluster becomes temporarily unavailable. Which cache parameter should you configure to control how long the agent will serve stale data?

Accepted Answer

serve_stale. The serve_stale parameter in the cache stanza allows the agent to serve cached secrets even after their lease has expired if the Vault cluster cannot be reached. This is crucial for high availability during transient outages. Other parameters like persist affect cache durability across restarts, but not stale data serving. lease_duration and max_age are not cache configuration parameters.

Answer

lease_duration

Answer

persist

Answer

max_age

Question 5

You are managing a Vault Enterprise cluster with integrated Raft storage. The cluster has five nodes. During a network partition, two nodes become isolated from the other three. The three remaining nodes continue to operate and elect a leader. What is the expected behavior of the two isolated nodes?

Accepted Answer

They will remain in a non-leader state and will not serve any requests until connectivity is restored.. In a Raft cluster, a majority quorum is required to elect a leader and to commit entries. With five nodes, a quorum is three. The two isolated nodes cannot form a quorum, so they cannot elect a leader or serve requests. They will remain in a non-leader state and wait for connectivity to be restored. Once the partition is healed, they will rejoin the cluster and catch up on any missed logs.

Answer

They will attempt to elect a new leader among themselves and continue serving requests.

Answer

They will automatically promote themselves to performance standbys and serve read-only requests.

Answer

They will become standby nodes and can still serve read requests.

Question 6

A Vault Enterprise operator is configuring telemetry to be sent to a Prometheus server. They want to ensure that metrics are retained for at least 24 hours to allow for trend analysis. Which configuration parameter in the telemetry stanza controls the length of time that Prometheus metrics are retained in memory?

Accepted Answer

prometheus_retention_time. The parameter prometheus_retention_time in the telemetry stanza controls how long Vault retains Prometheus metrics in memory. It is the correct choice for ensuring metrics are available for at least 24 hours. Other options are invalid parameter names. This setting is crucial for maintaining a reliable metrics pipeline to Prometheus in Vault Enterprise.

Answer

metrics_retention_duration

Answer

prometheus_retention_period

Answer

telemetry_retention

Question 7

A Vault Enterprise cluster is configured with a file audit device. An operator notices that audit log entries are being written to disk, but the Vault server's memory usage is steadily increasing. They suspect that audit log buffering is causing the issue. Which configuration parameter directly controls the maximum number of audit log entries that can be buffered in memory before being flushed to the audit device?

Accepted Answer

There is no configurable buffer size; audit devices block writes when they cannot keep up, causing memory pressure.. Vault audit devices operate synchronously and do not expose a configurable memory buffer for log entries. When an audit device cannot keep up, Vault blocks further processing, which can cause memory growth due to queued requests. The solution involves using fast audit sinks, monitoring device latency, and potentially disabling a failing device rather than tuning a non-existent buffer parameter.

Answer

The 'audit_buffer_size' parameter in the telemetry stanza.

Answer

The 'audit_log_buffer_size' parameter in the Vault configuration file.

Answer

The 'max_audit_log_entries' parameter in the audit device configuration.

Question 8

You are evaluating whether to use a Batch token for a high-throughput application that performs frequent secret reads. The application runs on a container platform and can handle token renewals. What is a key characteristic of Batch tokens that affects performance?

Accepted Answer

Batch tokens are lightweight and do not require a storage write to create, reducing overhead.. Batch tokens are lightweight because they are not persisted to storage; they are self-contained and require no storage write to create. This reduces latency and increases throughput. They cannot be renewed, do not support all features, and are not stored in Integrated Storage.

Answer

Batch tokens are stored in the Integrated Storage backend, which adds write latency.

Answer

Batch tokens support all Vault features, including cubbyhole and token revocation, without performance impact.

Answer

Batch tokens can be renewed indefinitely, which reduces the need for new token creation.

Question 9

A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the `team-a` namespace with a policy that grants read access to `secret/data/team-a/*`. The administrator then uses this token to read a secret at `secret/data/team-b/config` in the `team-b` namespace. What is the outcome?

Accepted Answer

The read fails because the token is not valid in the `team-b` namespace.. Vault Enterprise namespaces provide strict isolation. A token is bound to the namespace in which it was created and cannot be used to authenticate to another namespace. Therefore, a token from team-a cannot read secrets in team-b, regardless of its policies. The correct outcome is that the read fails because the token is not valid in team-b.

Answer

The read fails because the token's TTL expires when crossing namespace boundaries.

Answer

The read succeeds if the token has a policy that allows `secret/data/*` in the root namespace.

Answer

The read succeeds because the token's policy path is relative to the root namespace.

Question 10

A Vault Enterprise cluster with integrated storage (Raft) is experiencing intermittent performance degradation. The operator observes that the 'vault_raft_leader_lastContact' metric frequently spikes above 500 ms. Which underlying issue is most likely indicated by this metric behavior?

Accepted Answer

The leader is unable to communicate with followers due to network latency or packet loss.. The 'vault_raft_leader_lastContact' metric tracks the time elapsed since the leader last successfully contacted each follower. Spikes above 500 ms indicate communication delays, commonly due to network latency or packet loss. This metric is a key indicator of Raft cluster health, and persistent spikes can lead to leader elections or degraded performance. Investigating network reliability between nodes is the appropriate next step.

Answer

The Raft log is growing too large and needs compaction.

Answer

The leader node is overloaded with client requests, causing delays in follower heartbeats.

Answer

The followers are experiencing disk I/O bottlenecks, delaying their responses to the leader.

Question 11

You are responsible for a Vault Enterprise cluster using integrated storage (Raft). The cluster has five nodes spread across three availability zones. During a routine maintenance window, you need to replace one node's storage volume. You stop the Vault service on that node, replace the volume, and restart Vault. The node comes back up but does not rejoin the Raft cluster automatically. Which action should you take to rejoin the node to the existing cluster?

Accepted Answer

Run 'vault operator raft join' on the node, pointing it to the leader's API address.. When a Raft node's storage is replaced or wiped, it loses its Raft state and cannot automatically rejoin. The correct procedure is to use 'vault operator raft join' with the leader's API address. Snapshot restore is for whole-cluster recovery, removing a peer does not trigger auto-join, and re-initializing would create a new cluster.

Answer

Run 'vault operator init' on the node to generate new unseal keys and then unseal it.

Answer

Run 'vault operator raft snapshot restore' on the node using the latest snapshot from the leader.

Answer

Run 'vault operator raft remove-peer' on the leader to remove the old node, then restart the node; it will auto-join.

Question 12

You are deploying a new Vault Enterprise cluster with integrated storage (Raft) in a single data center. You have three nodes: vault-1, vault-2, and vault-3. After starting Vault on all three nodes, you initialize vault-1, which becomes the leader. You then need to join vault-2 and vault-3 to the cluster. Which command should you run on vault-2 and vault-3 to join them to the Raft cluster?

Accepted Answer

vault operator raft join http://vault-1:8200. To add a new node to an existing Vault Raft cluster, you run `vault operator raft join` on the new node, specifying the API address of an existing cluster member. This causes the node to contact the leader, receive the current Raft configuration, and begin replicating data. It is the documented and supported method for cluster expansion.

Answer

vault operator raft snapshot restore -force http://vault-1:8200

Answer

vault operator raft add-peer vault-1

Answer

vault write sys/storage/raft/join leader_api_addr=http://vault-1:8200

Question 13

You are deploying Vault Enterprise 1.15 on three nodes and want auto-unseal backed by a PKCS#11 HSM. The HSM vendor provides a shared library at /usr/lib64/libpkcs11.so, and each node must authenticate using an HSM partition PIN. Which seal configuration key holds the PIN so Vault can open the HSM session?

Accepted Answer

pin. The PKCS#11 seal stanza requires both the token label and the user PIN to open a session against the HSM partition. The PIN is supplied through the pin field. Without the correct pin value, Vault cannot log in to the token and auto-unseal will fail, even if the library path and token label are correct.

Answer

password

Answer

key_label

Answer

token_label

Question 14

You operate a Vault Enterprise Performance Primary with a Performance Secondary. The secondary is used for read-only workloads in a disaster recovery site. During a planned maintenance window, the primary is taken offline. Which statement describes the expected behavior of the secondary?

Accepted Answer

The secondary continues to serve reads from its replicated data but cannot process writes until promoted.. Performance Secondaries are read-only replicas that serve local reads even when the primary is offline. They do not automatically promote to primary and do not forward reads to the primary. Writes are unavailable until an operator manually promotes the secondary, which prevents split-brain during a primary outage. This design supports disaster recovery with minimal read disruption.

Answer

The secondary enters a sealed state and requires unsealing before it can serve any requests.

Answer

The secondary automatically promotes itself to primary and begins accepting writes.

Answer

The secondary forwards all requests, including reads, to the primary and fails if the primary is unreachable.

Question 15

A Vault Enterprise administrator is configuring a server to use a custom plugin directory for external secrets engines. The plugin binaries are stored in /opt/vault/plugins. The administrator wants Vault to load plugins from this directory and also wants to ensure that plugins are not automatically downloaded from the internet. Which configuration parameter must be set in the Vault server configuration file?

Accepted Answer

plugin_directory = "/opt/vault/plugins". The correct parameter to specify the directory for external plugins is plugin_directory. This tells Vault where to find plugin binaries. To prevent automatic downloads, you would also ensure that plugin_auto_download is not enabled, but the primary configuration is plugin_directory. The other options are invalid parameter names and would not work.

Answer

plugin_folder = "/opt/vault/plugins"

Answer

plugins_directory = "/opt/vault/plugins"

Answer

plugin_path = "/opt/vault/plugins"

Question 16

A Vault Enterprise administrator is preparing a new cluster that will use a PKCS#11 HSM for auto-unseal. Before starting Vault, they need to confirm the HSM library is discoverable. Which environment variable or configuration field should they set to point Vault to the PKCS#11 library?

Accepted Answer

Set the lib parameter in the seal stanza to the absolute path of the PKCS#11 library.. Vault locates the PKCS#11 library through the lib field in the seal stanza, which must contain the absolute path to the vendor's shared library. Environment variables and plugin directories are not used for this purpose. Setting lib correctly is a prerequisite for PKCS#11 auto-unseal to initialize.

Answer

Set the LD_LIBRARY_PATH to include the HSM library directory and omit the lib field.

Answer

Export the VAULT_HSM_LIB environment variable to the library path before starting Vault.

Answer

Place the library in the Vault plugin directory and reference it by filename only.

Question 17

A Vault Enterprise cluster is configured with Performance Standby nodes to scale read operations. An administrator notices that some write requests are being forwarded to the active node, causing increased latency. They want to ensure that write requests are handled as efficiently as possible. Which statement correctly describes the behavior of Performance Standby nodes regarding write operations?

Accepted Answer

Performance Standby nodes forward write requests to the active node, but they can handle read requests locally, reducing load on the active node.. Performance Standby nodes in Vault Enterprise are designed to scale read operations by handling reads locally while forwarding writes to the active node. This architecture allows the active node to focus on write operations and consensus, improving overall cluster performance. Write forwarding is automatic and transparent, so clients do not need to change their behavior. This is a core feature for high-throughput read-heavy workloads.

Answer

Performance Standby nodes can process write requests locally if the write is to a performance secondary cluster.

Answer

Performance Standby nodes can process write requests if they are configured with a local storage backend that supports multi-node writes.

Answer

Performance Standby nodes reject write requests with an error, requiring clients to retry against the active node.

Question 18

A Vault Enterprise cluster uses a Control Group to require approval for reading secrets at "secret/data/prod/*". A user with a token that has a policy granting read on that path attempts to read a secret but is blocked pending approval. Which statement accurately describes the token's capabilities during the pending approval?

Accepted Answer

The token can still read other secrets not under the Control Group's path.. Control Groups restrict only the protected paths, leaving the token's other capabilities intact. The token is not revoked, its TTL is not paused, and no privilege level bypasses the approval requirement. This design allows granular control without disrupting other operations.

Answer

The token can bypass the Control Group if it has a higher privilege level.

Answer

The token is immediately revoked and must be reissued after approval.

Answer

The token's TTL is paused until approval is granted or denied.

Question 19

A Vault Enterprise cluster is configured with a performance standby and a disaster recovery (DR) replica. The administrator wants to ensure that if the primary cluster fails, the DR replica can be promoted and clients can continue to access secrets without re-authenticating. Which statement about token replication is true?

Accepted Answer

Tokens are replicated to DR replicas, allowing clients to use existing tokens after promotion.. Token replication in Vault Enterprise ensures that tokens are available on DR replicas. When a DR replica is promoted, clients can continue using their existing tokens, providing seamless failover. This is a key benefit of Vault Enterprise's replication capabilities.

Answer

Token replication only occurs if the DR replica is in the same datacenter as the primary.

Answer

Tokens are replicated to performance standbys but not to DR replicas.

Answer

Tokens are not replicated; clients must re-authenticate after DR promotion.

Question 20

A Vault Enterprise cluster is experiencing intermittent performance issues. The operations team has enabled telemetry and is collecting metrics via StatsD. They notice that the `vault.runtime.alloc_bytes` metric is steadily increasing over several days without a corresponding increase in active tokens or leases. What is the most likely explanation for this trend?

Accepted Answer

A memory leak in a plugin or Vault itself is causing allocations to accumulate without being released.. The `vault.runtime.alloc_bytes` metric is a gauge that shows the current memory allocated by Vault. A steady increase over days without increased load suggests a memory leak. This could stem from Vault's core or a plugin. Operators should investigate by checking recent changes, reviewing logs, and using profiling tools. While a restart can temporarily alleviate the issue, identifying and fixing the leak is essential. The other options either mischaracterize the metric or suggest normal behavior when the trend is abnormal.

Answer

The metric is cumulative and will always increase over time, so it should be monitored as a rate rather than a gauge.

Answer

The StatsD sink is aggregating the metric incorrectly, causing it to appear as a monotonically increasing value.

Answer

The increase is normal and reflects memory fragmentation, which Vault does not reclaim until a restart.