Vault Enterprise Practice Test 9 — 10 Questions

Question 1

You are operating a Vault Enterprise cluster using the integrated Raft storage backend with three nodes. The cluster is used for production secrets management. After a scheduled maintenance window, you notice that the Vault service on one node was not restarted automatically. When you check the node's status, it is running but not part of the Raft cluster. You need to rejoin the node to the Raft cluster without affecting the existing leader or other peers. Which command should you run on the node to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vault operator raft join http://leader-address:8200. To rejoin a node to an existing Raft cluster, you must use the raft join command with the address of the current leader or any active peer. This safely adds the node as a follower, allowing it to synchronize with the cluster. Other commands like snapshot restore or init would disrupt the node's state and are not appropriate for this scenario. Unsealing alone does not establish cluster membership.

Answer

vault operator raft snapshot restore -file=snapshot.snap

Answer

vault operator init -key-shares=1 -key-threshold=1

Answer

vault operator unseal

Question 2

An administrator is configuring a Vault Enterprise cluster with Integrated Storage (Raft). They want to ensure that the cluster can automatically recover from a full restart without manual unseal steps, while still protecting the master key. They have deployed a supported cloud KMS. Which configuration should they use?

Accepted Answer

Enable auto-unseal using the cloud KMS seal stanza, which wraps the master key and allows Vault to unseal automatically on startup.. Auto-unseal with a cloud KMS seal stanza is the supported method for automatic recovery after a full restart. The KMS wraps the master key and performs decryption on startup, eliminating manual unseal while retaining strong protection. Storing unseal keys on disk or relying on recovery keys does not achieve the same security or functional goal.

Answer

Store the unseal keys in a file on each node and configure a systemd unit to submit them at boot.

Answer

Configure the Raft peers to share the master key among themselves so that a quorum can unseal the cluster without external input.

Answer

Use the recovery keys generated by Integrated Storage to automatically unseal the cluster on startup.

Question 3

You are configuring a Vault Enterprise cluster with integrated storage to scale for a high-read workload. You plan to add performance standby nodes. Which two statements accurately describe how performance standbys affect scaling and request handling? (Choose two.)

Accepted Answer

Performance standbys forward write requests to the active node, which then commits the change to the replicated data store.. Performance standbys scale read-heavy workloads by serving reads locally from the replicated data store, and they forward writes to the active node for commitment. They do not participate in Raft elections and cannot become active, which distinguishes them from standard standbys. These two characteristics make them ideal for read scaling without altering the write path or failover topology.

Answer

Performance standbys participate in the Raft quorum and can become the active node if the current active fails.

Answer

Performance standbys can accept write requests and commit them directly to the integrated storage backend.

Answer

Performance standbys require a separate integrated storage backend that is synchronized via performance replication.

Question 4

You are troubleshooting performance issues in a Vault Enterprise cluster that uses Integrated Storage. You notice that the Raft leader is frequently changing, causing disruptions in service. Which of the following is the most likely cause of this instability?

Accepted Answer

The Vault cluster nodes have insufficient CPU or memory resources, causing the leader to be unable to maintain heartbeats.. Frequent Raft leader elections are often a symptom of the leader being unable to send heartbeats in a timely manner. This can occur if the leader node is under-resourced (CPU, memory, disk I/O) or if there are network issues. Insufficient resources can cause the Vault process to stall, missing heartbeat deadlines. Ensuring adequate resources and stable networking is key to Raft stability.

Answer

The Raft protocol is configured with a very high election timeout, causing leaders to step down prematurely.

Answer

The Vault cluster is using a single node for storage, which is not supported for Integrated Storage.

Answer

The network latency between Vault nodes is extremely low, causing heartbeats to arrive too quickly.

Question 5

A Vault Enterprise operator has just enabled the Transit secrets engine in a namespace dedicated to a payment processing team. The team stores encryption keys in Transit and uses them to encrypt customer credit card data before writing it to an external database. An auditor asks the operator to prove that the plaintext of those credit card numbers never leaves the Vault server. Which property of the Transit secrets engine supports this claim?

Accepted Answer

Transit performs cryptographic operations inside Vault's barrier and returns only ciphertext, so plaintext submitted for encryption is never persisted or returned to callers.. Transit is a cryptographic service: callers send plaintext, Vault returns ciphertext, and no plaintext is persisted. This directly satisfies the auditor's requirement that credit card plaintext never leaves the Vault server. Options that describe storing plaintext on disk or in the barrier describe architectures that do not exist and would undermine the compliance guarantee the team needs.

Answer

Transit stores each plaintext alongside its ciphertext in the barrier so that decryption can be audited against the original input.

Answer

Transit encrypts plaintext only after it has been written to a write-ahead log, ensuring recoverability but leaving a transient plaintext copy on disk.

Answer

Transit uses the storage backend's encryption-at-rest to protect plaintext, so plaintext is stored but remains unreadable without the unseal keys.

Question 6

A Vault administrator is configuring a new auth method and wants to ensure that the auth method's configuration is protected from unauthorized changes. Which Vault feature should be used to control access to the auth method configuration endpoints?

Accepted Answer

ACL policies. ACL policies are the primary method to control access to Vault's API endpoints, including those for auth method configuration. By defining policies that allow or deny capabilities on specific paths, administrators can ensure that only authorized users or applications can modify auth method settings. The other features serve different purposes: audit devices log, seal wrapping protects the master key, and namespaces isolate resources.

Answer

Namespaces

Answer

Seal wrapping

Answer

Audit devices

Question 7

You are operating a Vault Enterprise cluster using the integrated Raft storage backend with three nodes. The cluster is used for production secrets management. After a scheduled maintenance window, you notice that the Vault service on one node was not restarted automatically. When you check the node's status, it is running but not part of the Raft cluster. You need to rejoin the node to the Raft cluster without affecting the existing leader or other peers. Which command should you run on the node to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor the replication lag using `vault read sys/replication/performance/status` and, if lag is unacceptable, temporarily redirect clients to the primary until the secondary catches up.. Performance Replication secondaries serve reads locally, which can be stale if replication lag is high. Vault does not provide an automatic mechanism to reject reads based on lag. The correct operational approach is to monitor lag via the replication status API and, when necessary, redirect clients to the primary to avoid stale data. This manual intervention ensures consistency until the secondary catches up.

Answer

Use the `vault write sys/replication/performance/secondary/update-primary` command to force the secondary to re-sync from the primary.

Answer

Enable `replication_primary_only` on the secondary cluster to prevent it from serving reads until it catches up.

Answer

Configure the secondary cluster's `max_lag` parameter in the replication configuration to a low value, and set the secondary to reject reads if lag exceeds that value.

Question 8

An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for seal wrapping and auto-unseal. After enabling the HSM, the administrator notices that the Vault cluster fails to start, reporting that the seal wrap key cannot be retrieved. Which configuration step is most likely missing?

Accepted Answer

The `seal` stanza in the Vault configuration file does not include the correct `key_label` for the seal wrap key.. When using an HSM for seal wrapping, Vault must be configured with the correct key_label in the seal stanza to locate the seal wrap key. If the key_label is missing or incorrect, Vault cannot retrieve the key and fails to start. Other HSM-related issues like PIN or firmware would produce different errors.

Answer

The HSM slot PIN was not provided to Vault via the `VAULT_HSM_PIN` environment variable.

Answer

The HSM firmware version is incompatible with Vault's PKCS#11 library.

Answer

The `disable_mlock` option is set to true, preventing Vault from accessing the HSM.

Question 9

You are deploying a Vault Enterprise cluster with Integrated Storage and want to ensure high availability. The cluster will have five nodes. What is the minimum number of nodes that must be active and healthy to maintain quorum and allow write operations?

Accepted Answer

3. Quorum in a Raft cluster is determined by a majority of nodes. For a five-node cluster, the majority is three. Therefore, at least three nodes must be active and healthy to maintain quorum and allow write operations. This provides tolerance for up to two node failures.

Answer

2

Answer

1

Answer

5

Question 10

A security team is reviewing how Vault Enterprise tokens are bound to their origin. They observe that a batch token issued by an auth method in one performance standby node is presented to a different performance standby node and is accepted. They want to understand why this behavior is expected and what security property batch tokens lack compared to service tokens. Which statement correctly describes batch tokens in Vault Enterprise?

Accepted Answer

Batch tokens are encrypted blobs that carry their own authorization data and can be validated by any node without a storage lookup, but they cannot be revoked individually.. Batch tokens are self-contained encrypted blobs validated locally by any node, which explains acceptance on a different performance standby. The trade-off is that they are not individually revocable because no storage entry exists. Service tokens, by contrast, are stored and can be revoked individually but require a storage lookup and are not portable as opaque blobs.

Answer

Batch tokens are validated by forwarding the request to the active node, which performs the storage lookup and returns the authorization decision.

Answer

Batch tokens are stored in the cluster's replicated storage and are replicated to performance standbys, which is why they are accepted on any node.

Answer

Batch tokens use the same storage-backed lease mechanism as service tokens but with a shorter TTL, which is why they appear on multiple nodes.