Vault Enterprise Practice Test 5 — 10 Questions

Question 1

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

Accepted Answer

The server logs.. Leader election events in a Vault HA cluster are logged by the Vault server itself, so the server logs are where you find messages about acquiring/losing leadership, stepping down, and transitioning between active and standby states. These logs include timestamps and the node identity, making them the authoritative source for election history. Telemetry and audit logs do not record election mechanics.

Answer

The telemetry metrics.

Answer

The storage backend logs.

Answer

The audit logs.

Question 2

Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?

Accepted Answer

Performance Replication.. Performance Replication (B) is a Vault Enterprise-only feature that lets a cluster serve read-heavy workloads across multiple secondary clusters while writes are forwarded to the primary, and it is configured at the server level via the replication stanza and related server settings. HSM Seal Wrapping (D) is also Enterprise-only and directly tied to server configuration: it uses an HSM to wrap the root key so that unsealing can be performed automatically via the seal "pkcs11" stanza in the Vault server configuration. Audit logging (A), KV Secret Engine (C), and Token management (E) are all core Vault capabilities available in the open-source edition and are not Enterprise-specific server-configuration features, so they do not fit the scenario.

Answer

Audit logging.

Answer

KV Secret Engine.

Answer

Token management.

Question 3

When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?

Accepted Answer

To avoid accidental data loss or interference with production keys.. Using a separate HSM partition for development isolates dev/test keys from production keys, preventing accidental overwrites, deletions, or cryptographic operations that could corrupt or expose production key material. Partitions in an HSM are logically isolated security domains, so operations in one partition cannot affect objects in another. This is a best practice for safe testing of new HSM configurations.

Answer

The PKCS#11 library requires a unique partition for every Vault instance.

Answer

It reduces the memory footprint of the Vault service.

Answer

To increase the speed of the cryptographic operations.

Question 4

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

Accepted Answer

It allows Vault to unseal without manual intervention.. HSM Auto-Unseal delegates the unseal operation to a hardware security module (or a cloud KMS acting as one) that holds the master key. When Vault starts, it sends the encrypted master key to the HSM for decryption, allowing the node to unseal automatically without an operator supplying unseal keys. This eliminates manual unseal ceremonies after restarts and enables fully automated cluster recovery.

Answer

It provides backup redundancy for the Vault data.

Answer

It replaces the need for TLS encryption.

Answer

It increases the throughput of the storage backend.

Question 5

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

Accepted Answer

vault operator rekey -init. 'vault operator rekey -init' starts a rekey operation and, when combined with flags like '-key-shares' and '-key-threshold', allows you to change the unseal key configuration while generating a new master key. This is the only command that both rotates the master key and lets you alter the share/threshold parameters in a single operation.

Answer

vault operator unseal

Answer

vault secrets tune

Answer

vault operator rotate

Question 6

Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?

Accepted Answer

Check Vault logs for specific PKCS#11 error codes.. Option B is correct because when Vault fails to unseal via HSM, the Vault server logs typically surface PKCS#11 error codes (e.g., CKR_SLOT_ID_INVALID, CKR_TOKEN_NOT_PRESENT) that pinpoint whether the failure is a slot, token, PIN, or session issue, making log inspection a standard first troubleshooting step. Option D is correct because Vault's seal stanza requires a valid path to the HSM vendor's PKCS#11 library (e.g., /usr/lib/libpkcs11.so or /opt/vendor/lib/libpkcs11.so); if that path is wrong, missing, or unreadable by the vault user, Vault cannot load the library and unsealing fails. Option E is correct because using the HSM vendor's own CLI tools (e.g., pkcs11-tool --list-slots or the vendor utility) confirms the slot/token is present, initialized, and accessible outside Vault, isolating whether the problem is in the HSM itself versus Vault's configuration. Option A is not a troubleshooting step for HSM unsealing failures because 'vault operator unseal' is the normal unseal operation itself, not a diagnostic action, and it will simply fail again if the underlying PKCS#11 issue is unresolved. Option C is incorrect because the storage backend driver is unrelated to HSM-based auto-unseal; upgrading it would not address PKCS#11 library, slot, or token problems.

Answer

Run 'vault operator unseal' manually.

Answer

Upgrade the storage backend driver.

Question 7

Which THREE conditions might result in a Vault node becoming unhealthy?

Accepted Answer

Storage backend connection failure.. Option A is correct because Vault's health status depends on its storage backend; if Vault cannot reach or use its configured storage (e.g., Consul, Raft, file, or cloud storage), it cannot serve requests and reports unhealthy. Option B is correct because a sealed Vault node has no access to its master key or unseal keys, so it cannot decrypt the barrier or serve secrets, and its health endpoint returns a sealed, unhealthy status. Option D is correct because a non-leader node that cannot reach the active cluster leader cannot forward requests or participate properly in the cluster, causing it to report unhealthy. Option C is not correct because telemetry endpoints (such as Prometheus or StatsD sinks) are optional observability outputs; their failure does not affect Vault's core health status. Option E is not correct because audit log devices are configured sinks, and while audit failures can block requests, 'audit logs are full' is not a standard Vault health condition and does not by itself make the node unhealthy.

Answer

Telemetry endpoint is down.

Answer

Audit logs are full.

Question 8

Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?

Accepted Answer

It allows wildcards to match multiple service accounts.. Option B is correct because the Vault Kubernetes Auth Method's bound_service_account_names parameter accepts glob-style wildcards (for example, 'app-*') so a single role can match multiple service account names. Option D is correct because this parameter defines the allowlist of Kubernetes service account names permitted to authenticate against that Vault role, so any service account not listed is rejected. Option A is wrong because the parameter has nothing to do with cluster-admin privileges; it merely constrains service account identities and works with any service account. Option C is wrong because Vault policies are still required to define the actual permissions granted after authentication; bound_service_account_names only governs who may log in. Option E is wrong because bound_service_account_names is a required parameter for the Kubernetes auth role, not something that becomes optional when bound_namespaces is configured.

Answer

It can only be applied to cluster-admin accounts.

Answer

It replaces the need for Vault policies.

Answer

It is optional if 'bound_namespaces' is set.

Question 9

Which THREE actions are permitted by the 'vault operator' command group?

Accepted Answer

Rekey the master key.. Option A is correct because 'vault operator rekey' is part of the operator command group and is used to generate a new master key (or recovery key) by re-entering the required threshold of unseal/recovery keys. Option C is correct because 'vault operator step-down' forces the active Vault node to give up its active status and trigger a leader election, which is an operator-level cluster management action. Option D is correct because 'vault operator unseal' submits an unseal key share to progress the Vault server out of its sealed state, a core operator responsibility. Option B does not belong because creating a user login is an authentication/userpass operation (e.g., 'vault write auth/userpass/users/...'), not an operator command. Option E does not belong because enabling a new secrets engine is done with 'vault secrets enable' (or the sys/mounts API), which is not part of the operator command group.

Answer

Create a user login.

Answer

Create a new secret engine.

Question 10

Which TWO statements are true about the relationship between Performance Standby nodes and Performance Replication?

Accepted Answer

Performance Standby allows read scaling within a single cluster.. Option C is correct because Performance Standby nodes in Vault are read-only replicas within the same cluster that serve read requests, thereby enabling read scaling within a single cluster. Option D is correct because Performance Replication and Performance Standby are complementary features that can coexist on the same cluster, allowing both cross-cluster replication and intra-cluster read scaling. Option A is incorrect because Performance Replication and Performance Standby are distinct features, not a subtype relationship. Option B is incorrect because Performance Replication does not require Performance Standby nodes; replication can function without them. Option E is incorrect because replication does not require performance standby nodes for all nodes.

Answer

Performance Replication is a type of Performance Standby.

Answer

Performance Standby nodes are required for Performance Replication.

Answer

Replication requires performance standby for all nodes.