Vault Enterprise Practice Test 8 — 10 Questions

Question 1

You are setting up a Vault Enterprise server and want to enable the web UI for administrators. Which configuration setting must be added to the Vault configuration file?

Accepted Answer

`ui = true` in the top-level configuration.. To enable the Vault web UI, you must set `ui = true` as a top-level configuration parameter. This activates the UI on all listeners that support it. It is a simple boolean setting and does not require any listener or storage stanza modifications. Administrators can then access the UI via the Vault address.

Answer

`ui_enabled = true` in the listener stanza.

Answer

`ui = true` in the storage stanza.

Answer

`enable_ui = true` in the seal stanza.

Question 2

A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling Seal Wrap, the operator notices that some existing secrets still appear in plaintext within the storage backend. Which statement explains this behavior?

Accepted Answer

Seal Wrap only applies to new writes; existing data must be re-written or migrated to be wrapped, so pre-existing plaintext entries remain until they are updated.. Seal Wrap protects data by wrapping values with the HSM at write time. It is not a retroactive process, so secrets written before Seal Wrap was enabled remain unwrapped in storage. Operators must re-write or migrate that data to bring it under HSM protection. This is why a mix of wrapped and unwrapped entries can appear after enabling the feature.

Answer

The HSM is not configured with a wrapping key, so Vault silently falls back to plaintext storage for all secrets until a wrapping key is generated.

Answer

Seal Wrap requires a cluster restart to take effect, so until all nodes are restarted the storage backend will continue to show plaintext for all entries.

Answer

Seal Wrap is only compatible with the transit secrets engine, so data from other engines such as KV will always remain unwrapped in storage.

Question 3

A Vault Enterprise administrator is configuring a new auth method to authenticate an on-premises application that cannot present a platform identity. The administrator wants to ensure that the initial authentication can only be performed once per login attempt and that the authentication material is bound to the application's network location. Which AppRole role configuration should the administrator apply to achieve these requirements?

Accepted Answer

Set `secret_id_num_uses=1` and `secret_id_bound_cidrs` to the application's subnet.. The requirement is to limit the SecretID to a single use and restrict it to the application's network. secret_id_num_uses=1 ensures one-time use, and secret_id_bound_cidrs binds the SecretID to specific CIDR blocks. Together they prevent replay and enforce network location. Other parameters like token_num_uses or TTLs do not address the SecretID's usage or binding.

Answer

Set `token_num_uses=1` and `token_bound_cidrs` to the application's subnet.

Answer

Set `secret_id_ttl=1m` and `token_ttl=1m` to force rapid expiration.

Answer

Set `bind_secret_id=false` and rely on `secret_id_bound_cidrs` alone.

Question 4

An operator needs to verify that a Vault Enterprise cluster is currently using a PKCS#11 HSM for its seal and that the seal is healthy. Which command provides the seal type and status without requiring unseal keys?

Accepted Answer

vault status. The vault status command reports the seal type and whether Vault is sealed. When an HSM is configured, the output includes a seal type such as pkcs11 or hsm, confirming that auto-unseal is active. This command is safe to run without unseal keys and is the quickest way to verify seal health.

Answer

vault operator unseal -status

Answer

vault debug -seal

Answer

vault read sys/seal

Question 5

Your security team requires that Vault Agent use a specific namespace in Vault Enterprise for all auto-auth and secret retrieval operations. The agent is configured with AppRole auto-auth. Which configuration parameter must you set to ensure the agent operates within the required namespace?

Accepted Answer

namespace in the vault block. In Vault Enterprise, the agent's namespace is configured in the top-level vault block. This setting applies to all agent operations, including auto-auth, templating, and caching. Setting it there ensures the agent interacts with the correct namespace, which is essential for multi-tenant environments and proper access control.

Answer

namespace in the cache block

Answer

namespace in the template block

Answer

namespace in the auto_auth block

Question 6

You are running a Vault Enterprise cluster with integrated storage (Raft) across three nodes. One node, vault-3, experiences a hardware failure and is offline for an extended period. After it is repaired and brought back online, you notice that it is not automatically rejoining the cluster. You run `vault operator raft list-peers` on the leader and see that vault-3 is not listed. What is the correct procedure to re-add vault-3 to the cluster?

Accepted Answer

On vault-3, run `vault operator raft join http://<leader-api-addr>:8200`.. When a Raft node is offline for too long, it may be removed from the cluster configuration. To re-add it, you must run `vault operator raft join` on the node itself, pointing to a current leader. This initiates the join process, and the node will be added back as a follower and catch up on missed data. This is the standard recovery procedure for a node that has been absent.

Answer

On the leader, run `vault operator raft remove-peer vault-3` and then re-add it using `vault operator raft join` from vault-3.

Answer

On the leader, run `vault operator raft add-peer vault-3`.

Answer

On vault-3, run `vault operator raft snapshot restore` using the latest snapshot from the leader.

Question 7

An administrator has configured a Vault Enterprise server to use a PKCS#11 HSM for auto-unseal. After a reboot, Vault fails to start and logs show that the PKCS#11 library could not be loaded. Which action should the administrator take first to resolve the issue?

Accepted Answer

Verify that the `lib` path in the `seal` stanza points to a valid PKCS#11 shared library and that the file permissions allow the Vault process to read it.. A PKCS#11 library load failure typically stems from an incorrect `lib` path or missing file permissions. The Vault process must be able to read and load the vendor's shared library. Verifying the path and permissions is the correct first troubleshooting step, whereas reinitializing the token, changing the mechanism, or disabling Seal Wrap do not address the root cause.

Answer

Reinitialize the HSM token with a new PIN using the vendor's management utility.

Answer

Change the `mechanism` in the seal stanza to `CKM_RSA_PKCS_OAEP` and restart Vault.

Answer

Disable Seal Wrap temporarily by setting `seal_wrap = false` in the seal stanza and restart Vault.

Question 8

A Vault Enterprise administrator is reviewing the security of a new auth method that will be used by external partners. The partners will authenticate from their own networks and will receive tokens with a limited set of policies. The administrator wants to ensure that if a token is stolen, the blast radius is minimized. Which TWO controls should be applied to the auth role to reduce the impact of a stolen token? (Choose two.)

Accepted Answer

Set a short token TTL and a short max TTL on the role so that tokens expire quickly and cannot be renewed indefinitely.. Short TTLs and CIDR binding are complementary controls that reduce the usefulness of a stolen token. Short TTLs limit the time window, while CIDR binding limits the network locations from which the token can be used. Together they shrink the blast radius. Indefinite renewal, root policy, and disabling audit logging all increase risk and violate least privilege.

Answer

Enable the token to be renewed indefinitely so that partners do not need to re-authenticate frequently, reducing the chance of credential exposure during login.

Answer

Assign the root policy to the token so that administrators can quickly investigate and remediate any suspicious activity.

Answer

Disable audit logging for the auth method to prevent attackers from learning which policies are assigned to the token.

Question 9

A Vault Enterprise cluster is running with three nodes. The active node is handling both reads and writes, and the two standby nodes are idle. You want to scale read performance by allowing the standby nodes to serve read requests while maintaining the same high availability and data consistency guarantees. Which configuration should you enable?

Accepted Answer

Set `performance_standby = true` in the Vault configuration file on the standby nodes and restart the Vault service.. Performance Standby nodes are a Vault Enterprise feature that allows standby nodes to serve read requests, offloading the active node and scaling read throughput. They are enabled by setting `performance_standby = true` in the configuration file on the standby nodes. This maintains high availability because one node remains active for writes, while standbys handle reads and can take over if the active node fails.

Answer

Enable the `read_replica` option on the active node and configure the standby nodes to forward read requests to the active node.

Answer

Enable Integrated Storage (Raft) with three voters and configure `performance_standby` on the standby nodes via the `vault operator raft` command.

Answer

Deploy a separate Performance Secondary cluster and configure Performance Replication to forward read requests to it.

Question 10

A security engineer is configuring Vault Enterprise to allow an application to authenticate using AppRole. The application will run on a server that has a unique role ID and secret ID. The engineer wants to ensure that the secret ID can be used only once and expires after 24 hours. Which AppRole role configuration parameters should be set to achieve this?

Accepted Answer

secret_id_num_uses=1 and secret_id_ttl=24h. The AppRole role parameters secret_id_num_uses and secret_id_ttl control the usage limit and TTL of secret IDs. Setting secret_id_num_uses=1 restricts the secret ID to a single use, and secret_id_ttl=24h ensures it expires after 24 hours. The other options either target token parameters instead of secret ID, set TTL to zero (no expiration), or allow unlimited uses.

Answer

secret_id_num_uses=0 and secret_id_ttl=24h

Answer

token_num_uses=1 and token_ttl=24h

Answer

secret_id_num_uses=1 and secret_id_ttl=0