Vault Enterprise Practice Test 6 — 10 Questions

Question 1

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

Accepted Answer

The KMS Key ID or ARN.. To enable Auto-Unseal with a cloud KMS, Vault must know which key to use, so option B (the KMS Key ID or ARN) is required to identify the specific KMS key that Vault will call for encryption/decryption operations. Option C (a cloud provider IAM role with decrypt permissions) is also required because Vault's identity must be authorized by the cloud provider to invoke the KMS Decrypt (and typically Encrypt) API; without those permissions the unseal call fails. Option E (a 'seal' stanza in the Vault configuration) is correct because Auto-Unseal is declared in the Vault config using a seal stanza (for example seal "awskms" or seal "azurekeyvault") that specifies the KMS provider and its parameters, which Vault reads at startup. Option A is not required, since Auto-Unseal works on a single Vault node and does not mandate a 5-node cluster (that relates to integrated storage quorum, not KMS unsealing). Option D is incorrect because a local unseal key file is the manual Shamir unseal mechanism, which Auto-Unseal is specifically designed to replace.

Answer

A cluster of at least 5 nodes.

Answer

A local unseal key file.

Question 2

Which THREE components are involved in a standard high availability (HA) Vault architecture?

Accepted Answer

A load balancer.. In a standard HA Vault architecture, a load balancer (A) is required to distribute client requests across the active and standby nodes, routing traffic to the current leader and providing a stable endpoint. Multiple Vault nodes (D) are essential because HA relies on a cluster of Vault servers where one node is active and the others are standbys ready to take over via leader election. A storage backend such as Raft or Consul (E) is also required, since it provides the shared, highly available data store that all nodes use for configuration, state, and leader election coordination. A secondary Vault cluster (B) is not part of a standard HA setup; it describes disaster recovery replication (performance or DR replication) rather than HA within a single cluster. An external monitoring tool (C) is useful for observability and alerting but is not a required architectural component of Vault's HA design.

Answer

A secondary Vault cluster.

Answer

An external monitoring tool.

Question 3

Which THREE factors influence the performance of a Performance Secondary cluster?

Accepted Answer

The speed of the network between primary and secondary.. Option A is correct because a Performance Secondary receives replicated data from the Primary over the network, so the bandwidth and latency of the link between primary and secondary directly affect how quickly that replication is applied and how current the secondary's data is. Option B is correct because the secondary must persist and serve the replicated writes from its own storage backend, so disk IOPS, throughput, and latency on the secondary determine how fast it can apply and read that data. Option E is correct because the volume of write operations on the Primary drives the replication workload the secondary must process; a higher write rate increases the replication traffic and processing burden on the secondary. Option C is not correct because Performance Standby nodes are read-only replicas that scale read capacity on the Primary cluster and do not govern the performance of a Performance Secondary. Option D is not correct because root tokens are authentication credentials and have no bearing on cluster performance.

Answer

The number of Performance Standby nodes on the Primary cluster.

Answer

The number of root tokens in the system.

Question 4

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

Accepted Answer

api_addr. Option C (api_addr) is critical because it tells each Vault node the address clients and other clusters should use to reach its API, and an incorrect value breaks cross-cluster request routing. Option D (listener.tcp.address) is critical because the TCP listener must bind to an address reachable by the peer cluster (e.g., 0.0.0.0:8200 or the node's routable IP) rather than only loopback, otherwise incoming cross-cluster traffic cannot connect. Option E (cluster_addr) is critical because it advertises the node's address for cluster-to-cluster (Raft replication) traffic, and a wrong or unreachable value prevents nodes from joining and replicating across clusters. Option A (storage_type) is not a cross-cluster communication setting; it only selects the backend (e.g., raft, file, consul) and does not affect inter-node reachability. Option B (ui) merely enables or disables the web UI and has no bearing on cross-cluster communication.

Answer

storage_type

Answer

ui

Question 5

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

Accepted Answer

Use the Vault Agent injector for automatic sidecar management.. Option A is correct because the Vault Agent injector automatically manages the lifecycle of Vault tokens for pods, rendering secrets into a shared volume and renewing or re-authenticating tokens without exposing long-lived credentials to application code, which reduces the attack surface for token theft. Option B is correct because applying 'token_bound_cidrs' to the Kubernetes auth role restricts the issued token so it can only be used from specified CIDR ranges, meaning a stolen token is useless if replayed from an unauthorized network location. Option C is correct because setting short TTLs on all issued tokens limits the window of opportunity for an attacker who obtains a token, forcing frequent re-authentication and reducing the blast radius of a compromise. Option D is not recommended because disabling audit logging removes the ability to detect and investigate token theft or misuse, and audit logging is a core security control rather than an optional performance trade-off. Option E is not recommended because using the 'root' token for an application grants unrestricted, long-lived privileges across Vault, so any theft of that token results in total compromise rather than scoped access.

Answer

Disable audit logging to increase performance.

Answer

Use the 'root' token for the application.

Question 6

When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?

Accepted Answer

The scope of the service account token.. Option B is correct because the scope of the service account token determines what the Vault Kubernetes auth backend can validate and which namespaces, service accounts, and audiences are trusted; a broadly scoped or overly permissive token increases the blast radius if compromised. Option C is correct because Vault must validate the Kubernetes API server CA when calling the TokenReview API, ensuring it is communicating with the legitimate API server and preventing man-in-the-middle attacks that could forge token validation responses. Option E is correct because the TTL of the Vault token generated limits the window of exposure; shorter TTLs reduce the impact of a stolen Vault token and force periodic re-authentication. Option A is not relevant because the number of nodes in the cluster does not directly affect Vault-Kubernetes auth token compromise. Option D is not relevant because the Kubernetes binary version alone does not determine the security of the Vault auth integration, though supported versions matter for overall cluster security.

Answer

The number of nodes in the cluster.

Answer

The version of the Kubernetes binary.

Question 7

A platform engineer is configuring a Vault Agent on a database server. The agent must use the AppRole auth method and write the resulting token to a file so that a local backup script can read it. Which top-level configuration block should the engineer populate to define the AppRole role ID and secret ID?

Accepted Answer

auto_auth. Agent authentication is configured in the auto_auth block, where the method type and its parameters are declared. For AppRole, role_id and secret_id belong inside the method block nested under auto_auth. The other blocks handle caching, listeners, and secret rendering, and none of them accept authentication credentials. Without auto_auth, the agent has no token source.

Answer

cache

Answer

listener

Answer

template

Question 8

An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?

Accepted Answer

Renewing the token.. Batch tokens in Vault are lightweight, non-renewable tokens designed for high-scale, short-lived workloads. Because they are not persisted in Vault's storage backend and have a fixed TTL, they cannot be renewed — attempting to renew a batch token will fail. They can still be used to authenticate, read secrets, and perform operations like Transit encryption, provided the token's policies allow it.

Answer

Performing a Transit engine encryption.

Answer

Authenticating with a configured auth method.

Answer

Reading a secret from the KV engine.

Question 9

A Vault Enterprise operator is investigating a sudden increase in memory usage on a Vault node. They suspect that a large number of leases are accumulating. Which telemetry metric should they examine to track the total number of active leases in the cluster?

Accepted Answer

vault.expire.num_leases. The metric vault.expire.num_leases tracks the total number of leases in the expiration manager. It is the correct choice for monitoring active leases and diagnosing memory usage spikes. Other options are either non-existent or unrelated to lease counts. This metric is essential for understanding lease-related resource consumption in Vault Enterprise.

Answer

vault.lease.count

Answer

vault.lease.active

Answer

vault.token.count

Question 10

You are using Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. You need to ensure that the secondary cluster can continue to serve read requests even if the primary cluster becomes unavailable. Which statement describes the behavior of the secondary cluster in this scenario?

Accepted Answer

The secondary cluster will continue to serve read requests using its local replica of the data, but writes will fail until the primary is restored or the secondary is promoted.. Performance Replication secondaries are designed to serve read requests locally, providing read scalability and disaster recovery. If the primary becomes unavailable, the secondary can continue to serve reads from its local replica, but it cannot accept writes unless it is manually promoted to primary. This ensures that read operations remain available during a primary outage.

Answer

The secondary cluster will become read-only and reject all requests, including reads, until the primary is back online.

Answer

The secondary cluster will redirect all read requests to the primary cluster, causing failures if the primary is down.

Answer

The secondary cluster will automatically promote itself to primary and begin accepting writes.