Vault Enterprise Fault Tolerant Vault Environments — 10 Questions

Question 1

In a Performance Replication setup, a secondary cluster is experiencing high latency for read requests. Which action should you take to verify if the requests are being routed correctly?

Accepted Answer

Check the 'sys/metrics' endpoint to verify the number of performance standby requests.. The sys/metrics endpoint exposes internal telemetry, including counters for performance standby requests, which reveal whether read requests are being routed to the secondary cluster's performance standbys as intended. Checking this metric confirms routing behavior and helps diagnose latency caused by misrouted or overloaded standbys. It is the correct diagnostic step before changing configuration.

Answer

Increase the 'max_lease_ttl' on the primary cluster.

Answer

Run 'vault write sys/replication/performance/secondary/update' to increase synchronization speed.

Answer

Restart the secondary cluster to clear the internal request cache.

Question 2

You have a Performance Replication setup. A client sends a write request to a performance standby node. What happens to this request?

Accepted Answer

The request is forwarded to the primary cluster.. In a Vault Enterprise Performance Replication topology, a performance standby node is a read-only replica that maintains its own storage backend and can serve reads locally, but it cannot process writes. When a client sends a write request to a performance standby, Vault transparently forwards the request over the replication connection to the active node in the primary cluster, which performs the write and returns the response. This forwarding is automatic and transparent to the client, so no error is returned.

Answer

The standby node attempts to become the leader and process the write.

Answer

The request is cached locally until the primary is available.

Answer

The request is rejected with a 403 Forbidden.

Question 3

When migrating from an external storage backend to Raft, which command is used to capture the current state of the cluster for migration?

Accepted Answer

vault operator raft snapshot save. The `vault operator raft snapshot save` command captures a point-in-time snapshot of the Raft cluster's state, including all Vault data and configuration. This snapshot is essential for migrating from an external storage backend (like Consul or file) to Raft, as it allows you to restore the data into the new Raft storage. The command is specifically designed for Raft integrated storage and produces a consistent backup that can be later restored using `vault operator raft snapshot restore`.

Answer

vault operator migrate

Answer

vault write sys/storage/backup

Answer

vault operator seal

Question 4

You are configuring a Vault cluster for high availability using Consul as the storage backend. During a network partition, the standby nodes cannot reach the leader node. What must occur for a new leader to be elected?

Accepted Answer

The Consul agent must expire the leader's session, triggering an election among standby nodes.. With Consul as the storage backend, Vault HA leader election relies on Consul's session mechanism: the active node holds a Consul session lock, and if the standby nodes cannot reach the leader, the Consul agent expires the leader's session, releasing the lock and triggering an election among standbys. The node that acquires the lock becomes the new active node.

Answer

The load balancer must perform a health check and restart the standby nodes.

Answer

Vault requires a manual unseal process on all nodes to trigger a new election.

Answer

The Vault administrator must manually promote a standby node via the CLI.

Question 5

You are troubleshooting a sync issue in Performance Replication. The logs indicate 'replication lag'. Which parameter should you review to ensure optimal data synchronization between clusters?

Accepted Answer

The network connection and replication buffer throughput.. While there isn't a single 'lag' parameter, review the 'replication_buffer_size' or network throughput limits between clusters as part of diagnosing synchronization bottlenecks.

Answer

The 'disable_mlock' setting.

Answer

The 'max_lease_ttl' value.

Answer

The 'default_max_request_size'.

Question 6

In the event of a total primary cluster failure, what is the status of the secrets stored in the DR secondary cluster before promotion?

Accepted Answer

They are available for reading if the secondary is unsealed.. In a Vault Enterprise DR secondary cluster, data is replicated from the primary and stored locally. Even before promotion, if the DR secondary is unsealed, the secrets are available for read operations. This allows DR secondaries to serve read traffic during a primary outage without requiring promotion, though writes are not possible until promotion.

Answer

They are automatically synced back to a new primary.

Answer

They are encrypted and cannot be accessed.

Answer

They are unavailable and must be restored from backup.

Question 7

When configuring DR replication, what is the purpose of the 'primary_token' used on the secondary cluster?

Accepted Answer

It is used by the secondary to authenticate with the primary cluster.. During DR replication setup, the secondary cluster must be able to reach the primary's replication API and authenticate to it. The 'primary_token' is a token generated on the primary (typically with the 'vault replication' or DR secondary activation workflow) that the secondary presents to the primary to establish and maintain the replication relationship. It is not used for unsealing, writes, or transport encryption.

Answer

It is used to authorize the secondary to unseal itself.

Answer

It is used to allow the secondary to perform write operations.

Answer

It is used to encrypt data transferred over the network.

Question 8

Which TWO of the following are requirements for a successful Vault HA deployment using Raft?

Accepted Answer

The 'cluster_addr' must be configured for inter-node communication.. Option A is correct because Vault's Raft integrated storage requires the 'cluster_addr' setting so nodes can advertise a reachable address for inter-node Raft replication and cluster communication; without it, nodes cannot form or maintain the HA cluster. Option E is correct because 'api_addr' must be configured and reachable by all other nodes so that cluster peers and clients can communicate with the node's API endpoint, which is essential for request forwarding and HA operation. Option B is incorrect because Raft integrated storage does not require an external Consul agent; Consul is only needed when using Consul as the storage backend. Option C is incorrect because a load balancer is not a Raft requirement, and round-robin writes are not how Vault HA works since only the active node handles writes. Option D is incorrect because Raft uses local disk storage on each node and does not require a shared NFS directory.

Answer

An external Consul agent running on every node.

Answer

A load balancer to perform round-robin writes.

Answer

A shared network file system (NFS) for the storage directory.

Question 9

Which THREE of the following steps are necessary when performing a manual disaster recovery promotion?

Accepted Answer

Running 'vault operator dr promotion' on the secondary.. Option A is correct because the manual disaster recovery promotion of a Vault secondary cluster is performed with the 'vault operator dr promotion' command, which transitions the secondary into a primary and allows it to serve write operations. Option C is correct because after promotion, clients, agents, and other consumers must be reconfigured to send requests to the new primary's URL, since the old primary is no longer the active write node. Option D is correct because the promoted secondary must be unsealed with its existing unseal keys before it can serve requests; promotion does not bypass the seal/unseal requirement. Option B is not a required step because the secondary's replicated data is retained and used after promotion, not deleted. Option E is not required because re-initialization would destroy the existing cluster state and is not part of a promotion; the cluster keeps its existing configuration and data.

Answer

Deleting the old primary's data from the secondary.

Answer

Re-initializing the cluster.

Question 10

Which TWO of the following are valid reasons why a node might fail to join an existing Raft cluster?

Accepted Answer

The 'cluster_addr' is not reachable from the leader.. Option B is correct because Raft cluster membership requires bidirectional network reachability between nodes; if the leader cannot reach the joining node's cluster_addr (the address used for Raft replication traffic, typically port 8201), the join request cannot complete and the node will fail to join. Option C is correct because a node that already holds Raft state belonging to a different cluster will refuse to join a new cluster, since its existing configuration and log data conflict with the target cluster's identity; it must be reset or reinitialized first. Option A is not a valid reason, because 'vault operator init' initializes a Vault server's unseal keys and root token, not Raft cluster membership, and joining a cluster is a separate operation. Option D is not a valid reason, because setting the storage backend to 'consul' simply means the node is not using Raft storage at all, so it is not attempting a Raft join. Option E is not a valid reason, because differing Vault versions do not inherently prevent a Raft join; version compatibility is generally handled separately and is not a Raft membership requirement.

Answer

The node has not been initialized with 'vault operator init'.

Answer

The storage backend is set to 'consul'.

Answer

The node has a different Vault version.