Vault Enterprise Practice Test 7 — 10 Questions

Question 1

Which tool is commonly used to view Vault metrics in a graphical format?

Accepted Answer

Grafana. Grafana is the standard tool used to visualize Prometheus metrics, which Vault exports.

Answer

Vault Audit Viewer

Answer

Vault UI

Answer

Logstash

Question 2

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Accepted Answer

The storage backend (e.g., Consul).. The storage backend (e.g., Consul, Raft) provides a distributed locking mechanism that Vault uses to ensure only one leader exists.

Answer

The load balancer.

Answer

The Vault server process configuration file.

Answer

The Vault CLI.

Question 3

What is the benefit of using Performance Replication over standard DR Replication?

Accepted Answer

Performance replication allows the secondary to serve read requests.. Performance replication allows the secondary to serve read requests, unlike DR replication which is strictly for failover.

Answer

Performance replication supports write operations.

Answer

Performance replication provides disaster recovery capabilities.

Answer

Performance replication is cheaper to license.

Question 4

Which THREE features are part of Vault Enterprise performance scaling?

Accepted Answer

Namespace support.. Performance replication, performance standby, and seal wrapping/HSM support are key enterprise scaling features.

Answer

Dynamic secrets.

Answer

Integrated storage (Raft).

Question 5

Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?

Accepted Answer

Incompatibility between the library version and the HSM firmware.. Common causes include incorrect PIN credentials, library incompatibility, or the HSM partition being inaccessible.

Answer

The Vault token has expired.

Answer

The storage backend is full.

Answer

The network is blocked by a local firewall.

Question 6

What does the 'vault_core_seal_setup_duration' metric represent?

Accepted Answer

The duration of the unseal process.. This metric measures the time taken for Vault to perform the seal setup process during initialization or unsealing.

Answer

The time taken to initialize the storage backend.

Answer

The time between audit log rotations.

Answer

The time spent waiting for a lease to expire.

Question 7

How can an administrator ensure that a secret is only accessible if the requester has a specific identity group membership?

Accepted Answer

By using a Sentinel policy to validate the entity's group membership.. By using path-level ACLs that leverage the identity information or by integrating Sentinel policies to check group membership.

Answer

By adding the group name to the path.

Answer

By modifying the auth method.

Answer

By setting a TTL on the group.

Answer

By creating a new namespace.

Question 8

When configuring DR replication, what is the purpose of the 'primary_token' used on the secondary cluster?

Accepted Answer

It is used by the secondary to authenticate with the primary cluster.. The primary token is used by the secondary cluster to authenticate with the primary and establish the replication link.

Answer

It is used to authorize the secondary to unseal itself.

Answer

It is used to allow the secondary to perform write operations.

Answer

It is used to encrypt data transferred over the network.

Question 9

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

Accepted Answer

The library must be PKCS#11 compliant.. Vault requires the HSM vendor's shared object library (.so or .dll) to support the PKCS#11 interface standard.

Answer

The library must be statically linked into the Vault binary.

Answer

The library must be written in Go.

Answer

The library must support the KMIP protocol.

Question 10

What is the primary difference between HA replication and DR replication in Vault?

Accepted Answer

HA replication is for performance, DR is for data durability.. HA is about local node availability, while DR is about replicating data across clusters for geographic or systemic failure recovery.

Answer

HA replication requires Enterprise, DR does not.

Answer

DR replication uses a different storage backend.

Answer

DR replication is faster than HA replication.