Vault Enterprise Practice Questions 2 — 50 Questions

Question 1

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

Accepted Answer

The KMS Key ID or ARN.. To enable Auto-Unseal with a cloud KMS, Vault must know which key to use, so option B (the KMS Key ID or ARN) is required to identify the specific KMS key that Vault will call for encryption/decryption operations. Option C (a cloud provider IAM role with decrypt permissions) is also required because Vault's identity must be authorized by the cloud provider to invoke the KMS Decrypt (and typically Encrypt) API; without those permissions the unseal call fails. Option E (a 'seal' stanza in the Vault configuration) is correct because Auto-Unseal is declared in the Vault config using a seal stanza (for example seal "awskms" or seal "azurekeyvault") that specifies the KMS provider and its parameters, which Vault reads at startup. Option A is not required, since Auto-Unseal works on a single Vault node and does not mandate a 5-node cluster (that relates to integrated storage quorum, not KMS unsealing). Option D is incorrect because a local unseal key file is the manual Shamir unseal mechanism, which Auto-Unseal is specifically designed to replace.

Answer

A cluster of at least 5 nodes.

Answer

A local unseal key file.

Question 2

Which THREE components are involved in a standard high availability (HA) Vault architecture?

Accepted Answer

A load balancer.. In a standard HA Vault architecture, a load balancer (A) is required to distribute client requests across the active and standby nodes, routing traffic to the current leader and providing a stable endpoint. Multiple Vault nodes (D) are essential because HA relies on a cluster of Vault servers where one node is active and the others are standbys ready to take over via leader election. A storage backend such as Raft or Consul (E) is also required, since it provides the shared, highly available data store that all nodes use for configuration, state, and leader election coordination. A secondary Vault cluster (B) is not part of a standard HA setup; it describes disaster recovery replication (performance or DR replication) rather than HA within a single cluster. An external monitoring tool (C) is useful for observability and alerting but is not a required architectural component of Vault's HA design.

Answer

A secondary Vault cluster.

Answer

An external monitoring tool.

Question 3

Which THREE factors influence the performance of a Performance Secondary cluster?

Accepted Answer

The speed of the network between primary and secondary.. Option A is correct because a Performance Secondary receives replicated data from the Primary over the network, so the bandwidth and latency of the link between primary and secondary directly affect how quickly that replication is applied and how current the secondary's data is. Option B is correct because the secondary must persist and serve the replicated writes from its own storage backend, so disk IOPS, throughput, and latency on the secondary determine how fast it can apply and read that data. Option E is correct because the volume of write operations on the Primary drives the replication workload the secondary must process; a higher write rate increases the replication traffic and processing burden on the secondary. Option C is not correct because Performance Standby nodes are read-only replicas that scale read capacity on the Primary cluster and do not govern the performance of a Performance Secondary. Option D is not correct because root tokens are authentication credentials and have no bearing on cluster performance.

Answer

The number of Performance Standby nodes on the Primary cluster.

Answer

The number of root tokens in the system.

Question 4

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

Accepted Answer

api_addr. Option C (api_addr) is critical because it tells each Vault node the address clients and other clusters should use to reach its API, and an incorrect value breaks cross-cluster request routing. Option D (listener.tcp.address) is critical because the TCP listener must bind to an address reachable by the peer cluster (e.g., 0.0.0.0:8200 or the node's routable IP) rather than only loopback, otherwise incoming cross-cluster traffic cannot connect. Option E (cluster_addr) is critical because it advertises the node's address for cluster-to-cluster (Raft replication) traffic, and a wrong or unreachable value prevents nodes from joining and replicating across clusters. Option A (storage_type) is not a cross-cluster communication setting; it only selects the backend (e.g., raft, file, consul) and does not affect inter-node reachability. Option B (ui) merely enables or disables the web UI and has no bearing on cross-cluster communication.

Answer

storage_type

Answer

ui

Question 5

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

Accepted Answer

Use the Vault Agent injector for automatic sidecar management.. Option A is correct because the Vault Agent injector automatically manages the lifecycle of Vault tokens for pods, rendering secrets into a shared volume and renewing or re-authenticating tokens without exposing long-lived credentials to application code, which reduces the attack surface for token theft. Option B is correct because applying 'token_bound_cidrs' to the Kubernetes auth role restricts the issued token so it can only be used from specified CIDR ranges, meaning a stolen token is useless if replayed from an unauthorized network location. Option C is correct because setting short TTLs on all issued tokens limits the window of opportunity for an attacker who obtains a token, forcing frequent re-authentication and reducing the blast radius of a compromise. Option D is not recommended because disabling audit logging removes the ability to detect and investigate token theft or misuse, and audit logging is a core security control rather than an optional performance trade-off. Option E is not recommended because using the 'root' token for an application grants unrestricted, long-lived privileges across Vault, so any theft of that token results in total compromise rather than scoped access.

Answer

Disable audit logging to increase performance.

Answer

Use the 'root' token for the application.

Question 6

When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?

Accepted Answer

The scope of the service account token.. Option B is correct because the scope of the service account token determines what the Vault Kubernetes auth backend can validate and which namespaces, service accounts, and audiences are trusted; a broadly scoped or overly permissive token increases the blast radius if compromised. Option C is correct because Vault must validate the Kubernetes API server CA when calling the TokenReview API, ensuring it is communicating with the legitimate API server and preventing man-in-the-middle attacks that could forge token validation responses. Option E is correct because the TTL of the Vault token generated limits the window of exposure; shorter TTLs reduce the impact of a stolen Vault token and force periodic re-authentication. Option A is not relevant because the number of nodes in the cluster does not directly affect Vault-Kubernetes auth token compromise. Option D is not relevant because the Kubernetes binary version alone does not determine the security of the Vault auth integration, though supported versions matter for overall cluster security.

Answer

The number of nodes in the cluster.

Answer

The version of the Kubernetes binary.

Question 7

A platform engineer is configuring a Vault Agent on a database server. The agent must use the AppRole auth method and write the resulting token to a file so that a local backup script can read it. Which top-level configuration block should the engineer populate to define the AppRole role ID and secret ID?

Accepted Answer

auto_auth. Agent authentication is configured in the auto_auth block, where the method type and its parameters are declared. For AppRole, role_id and secret_id belong inside the method block nested under auto_auth. The other blocks handle caching, listeners, and secret rendering, and none of them accept authentication credentials. Without auto_auth, the agent has no token source.

Answer

cache

Answer

listener

Answer

template

Question 8

An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?

Accepted Answer

Renewing the token.. Batch tokens in Vault are lightweight, non-renewable tokens designed for high-scale, short-lived workloads. Because they are not persisted in Vault's storage backend and have a fixed TTL, they cannot be renewed — attempting to renew a batch token will fail. They can still be used to authenticate, read secrets, and perform operations like Transit encryption, provided the token's policies allow it.

Answer

Performing a Transit engine encryption.

Answer

Authenticating with a configured auth method.

Answer

Reading a secret from the KV engine.

Question 9

A Vault Enterprise operator is investigating a sudden increase in memory usage on a Vault node. They suspect that a large number of leases are accumulating. Which telemetry metric should they examine to track the total number of active leases in the cluster?

Accepted Answer

vault.expire.num_leases. The metric vault.expire.num_leases tracks the total number of leases in the expiration manager. It is the correct choice for monitoring active leases and diagnosing memory usage spikes. Other options are either non-existent or unrelated to lease counts. This metric is essential for understanding lease-related resource consumption in Vault Enterprise.

Answer

vault.lease.count

Answer

vault.lease.active

Answer

vault.token.count

Question 10

You are using Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. You need to ensure that the secondary cluster can continue to serve read requests even if the primary cluster becomes unavailable. Which statement describes the behavior of the secondary cluster in this scenario?

Accepted Answer

The secondary cluster will continue to serve read requests using its local replica of the data, but writes will fail until the primary is restored or the secondary is promoted.. Performance Replication secondaries are designed to serve read requests locally, providing read scalability and disaster recovery. If the primary becomes unavailable, the secondary can continue to serve reads from its local replica, but it cannot accept writes unless it is manually promoted to primary. This ensures that read operations remain available during a primary outage.

Answer

The secondary cluster will become read-only and reject all requests, including reads, until the primary is back online.

Answer

The secondary cluster will redirect all read requests to the primary cluster, causing failures if the primary is down.

Answer

The secondary cluster will automatically promote itself to primary and begin accepting writes.

Question 11

A DevOps engineer is using Vault Agent templates to render a database password from a KV v2 secrets engine. The secret is stored at secret/data/db with a key named password. The engineer wants to ensure the rendered file contains only the password value and no extra whitespace or newlines. Which template function should be used to trim whitespace from the secret value?

Accepted Answer

trim. Vault Agent templates support the trim function to remove leading and trailing whitespace from a string. Applying it to the retrieved secret value ensures the output file contains only the password. Other functions like toUpper, base64Decode, and regexReplaceAll serve different purposes and do not provide the straightforward whitespace removal needed here.

Answer

regexReplaceAll

Answer

base64Decode

Answer

toUpper

Question 12

You are deploying a new Vault Enterprise cluster that will use a PKCS#11 HSM for auto-unseal. The HSM is a network-attached appliance reachable over TCP. Which TWO configuration elements must be present in the seal stanza to allow Vault to communicate with this HSM? (Choose two.)

Accepted Answer

The slot number or slot label that identifies the HSM partition.. To use a PKCS#11 HSM for auto-unseal, Vault needs the vendor's PKCS#11 library path and a way to select the correct slot or partition. These two elements allow Vault to load the library, initialize a session, and log in to the HSM. Other details such as management IP, serial number, or firmware version are not part of the seal stanza configuration.

Answer

The HSM's firmware version to ensure compatibility with Vault's PKCS#11 calls.

Answer

The HSM's serial number to bind the seal to a specific hardware unit.

Answer

The IP address and port of the HSM's management web interface.

Question 13

You are using Vault Enterprise with integrated storage (Raft) and have a three-node cluster. One node fails and is expected to be down for several hours. You want to ensure the cluster remains available for writes. What is the minimum number of nodes that must be running and healthy to maintain quorum and allow writes?

Accepted Answer

Two nodes, because a majority (quorum) of the three-node cluster must be available.. A three-node Raft cluster requires a quorum of two nodes to elect a leader and commit writes. One node can be down without affecting write availability, but if two nodes are down, the cluster loses quorum and writes fail. Vault does not queue writes during quorum loss.

Answer

One node, because Vault can operate in a degraded state.

Answer

Zero nodes, because Vault can queue writes until a node returns.

Answer

Three nodes, because all nodes must be available to accept writes.

Question 14

A Vault Agent is configured with auto_auth using the AWS auth method and a cache block with use_auto_auth_token = true. A client application connects to the agent's listener and sends a request to read a secret at secret/data/app. The agent's cached token lacks permission for that path, but the client also provides its own Vault token in the X-Vault-Token header. How does the agent handle the request?

Accepted Answer

The agent forwards the request to Vault using the client-provided token, because the client token takes precedence when present.. With use_auto_auth_token enabled, the agent uses its auto-auth token only when the client request lacks a token. If the client includes an X-Vault-Token header, the agent forwards that token to Vault. The agent does not evaluate permissions itself; Vault enforces policies. This design lets clients use their own tokens for specific paths while still leveraging the agent's caching and proxying.

Answer

The agent attempts to renew the auto-auth token and retries the request, ignoring the client token until the auto-auth token gains access.

Answer

The agent rejects the request with a 403 error because the auto-auth token is not authorized for the path.

Answer

The agent ignores the client token and uses the auto-auth token, causing Vault to return a permission denied error.

Question 15

A Vault Enterprise cluster is configured with Performance Replication to a secondary cluster. The secondary cluster is in a different region and is used for disaster recovery and read scaling. You notice that the secondary cluster is experiencing high replication lag, and some read requests return stale data. Which factor is most likely causing the lag?

Accepted Answer

The network latency between the primary and secondary clusters is high, and the primary is generating a high volume of writes.. Performance Replication lag is primarily influenced by network conditions and the write throughput on the primary. High latency between clusters and a heavy write load can cause the secondary to fall behind, leading to stale reads. To mitigate, ensure adequate network bandwidth and consider reducing write volume or scaling the primary.

Answer

The secondary cluster has a large number of Performance Standby nodes that are overwhelmed with read requests.

Answer

The primary cluster is using Integrated Storage (Raft) while the secondary uses Consul as its storage backend.

Answer

The secondary cluster is configured with a different seal mechanism than the primary cluster.

Question 16

An operator is configuring Vault Enterprise to send audit logs to a syslog server. The operator wants to ensure that audit logs are not lost if the syslog server becomes temporarily unavailable. Which configuration parameter should be adjusted to allow Vault to buffer audit logs in memory until the syslog server is reachable?

Accepted Answer

Vault does not support buffering audit logs; it will block requests if the audit device is unavailable.. Vault does not buffer audit logs. If an audit device is unreachable, Vault blocks requests to prevent unaudited actions. This design ensures that every request is logged, but it means that audit device availability is critical. To mitigate, operators should configure redundant audit devices or ensure the syslog server is highly available. The `log_raw` option, `facility`, and `tag` parameters do not affect buffering, and there is no `fallback` option. Thus, the correct understanding is that buffering is not supported.

Answer

The `fallback` option in the audit device configuration, which enables a secondary audit device for buffering.

Answer

The `log_raw` option in the audit device configuration.

Answer

The `syslog` audit device's `facility` and `tag` parameters.

Question 17

A Vault Enterprise cluster is configured with PKCS#11 auto-unseal. After a scheduled HSM firmware upgrade, Vault nodes fail to unseal and log 'PKCS#11 error: CKR_SLOT_ID_INVALID'. The HSM administrator confirms the partition is online and the PIN is unchanged. Which action should you take first to restore auto-unseal?

Accepted Answer

Verify the current slot ID with pkcs11-tool --list-slots and update the slot parameter in the seal stanza to match the new slot numbering.. After HSM firmware updates, slot numbering can change, causing CKR_SLOT_ID_INVALID because the seal stanza references an old slot index. Enumerating slots with pkcs11-tool --list-slots and updating the slot value restores auto-unseal. Reinitializing or restarting without fixing the slot does not resolve the mapping, and timeout tuning is irrelevant to slot validation.

Answer

Restart the Vault service on each node to force a re-read of the seal configuration.

Answer

Regenerate the Vault seal key and reinitialize the cluster with vault operator init.

Answer

Increase the hsm timeout parameter in the seal stanza to allow Vault more time to connect to the HSM.

Question 18

A Vault administrator is preparing a server configuration file for a new Vault Enterprise installation. They want to ensure that the Vault UI is accessible and that the server listens on all network interfaces for API requests. Which configuration settings should they use?

Accepted Answer

Set 'ui = true' at the top level and 'address = "0.0.0.0:8200"' in the 'listener' stanza.. To enable the Vault UI, set 'ui = true' at the top level of the configuration file. To listen on all interfaces, set 'address = "0.0.0.0:8200"' in the 'listener' stanza. This allows the UI to be accessed via any network interface and the API to accept requests from remote clients. Incorrect placement of 'ui' in other stanzas is a common mistake.

Answer

Set 'ui = true' in the 'listener' stanza and 'address = "127.0.0.1:8200"' in the same stanza.

Answer

Set 'ui = true' in the 'ui' stanza and 'address = "0.0.0.0:8200"' in the 'listener' stanza.

Answer

Set 'ui = true' in the 'storage' stanza and 'address = "0.0.0.0:8200"' in the 'listener' stanza.

Question 19

An operations team is deploying Vault Enterprise with Integrated Storage across three nodes. They want to ensure that if one node fails, the cluster remains available for both reads and writes. They also want to minimize the risk of split-brain scenarios. Which of the following configurations should they use?

Accepted Answer

Deploy three nodes, each in a different availability zone, all as voters, with automatic snapshotting enabled.. A three-node cluster with all nodes as voters provides a quorum of two, allowing the cluster to tolerate the failure of one node while maintaining write availability. Placing each node in a separate availability zone protects against zone failures. Other options either reduce quorum (non-voters or only two voters) or add unnecessary complexity (five nodes).

Answer

Deploy three nodes, each in a different availability zone, with one node configured as a non-voter.

Answer

Deploy two nodes, each in a different availability zone, both as voters, with a third node as a non-voter in a third zone.

Answer

Deploy five nodes, each in a different availability zone, all as voters, with performance standbys enabled.

Question 20

A Vault Enterprise administrator is configuring a new namespace for a subsidiary company. The subsidiary requires that only users authenticated via their corporate LDAP can access secrets in the namespace. Additionally, the subsidiary's security team must be able to manage policies and auth methods within the namespace but should not have access to the root namespace. Which combination of Vault Enterprise features should the administrator use to meet these requirements?

Accepted Answer

Create a namespace, configure LDAP auth within the namespace, and assign a policy with sudo capabilities on the namespace's sys/ path to the subsidiary's security team.. The correct solution uses a namespace to isolate the subsidiary, LDAP auth within that namespace for authentication, and sudo capabilities on the namespace's sys/ path to allow management of policies and auth methods. Sudo on the namespace's sys/ grants administrative control within that namespace only, preserving isolation from the root namespace. Other options either grant excessive root privileges or insufficient read-only access.

Answer

Create a namespace, configure LDAP auth within the namespace, and assign the subsidiary's security team a policy with read capabilities on the namespace's sys/ path.

Answer

Create a namespace, configure LDAP auth within the namespace, and assign the subsidiary's security team a policy with sudo capabilities on the root sys/ path.

Answer

Create a namespace, configure LDAP auth in the root namespace, and assign the subsidiary's security team a policy with sudo capabilities on the root sys/ path.