Vault Enterprise Fault Tolerant Vault Environments — 20 Questions

Question 1

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Accepted Answer

The storage backend (e.g., Consul).. The storage backend (e.g., Consul, Raft) provides a distributed locking mechanism that Vault uses to ensure only one leader exists.

Answer

The load balancer.

Answer

The Vault server process configuration file.

Answer

The Vault CLI.

Question 2

In a Performance Replication setup, a secondary cluster is experiencing high latency for read requests. Which action should you take to verify if the requests are being routed correctly?

Accepted Answer

Check the 'sys/metrics' endpoint to verify the number of performance standby requests.. Checking the X-Vault-Index headers and looking at performance standby metrics helps determine if requests are hitting the local cluster or being forwarded to the primary.

Answer

Increase the 'max_lease_ttl' on the primary cluster.

Answer

Run 'vault write sys/replication/performance/secondary/update' to increase synchronization speed.

Answer

Restart the secondary cluster to clear the internal request cache.

Question 3

You have a Performance Replication setup. A client sends a write request to a performance standby node. What happens to this request?

Accepted Answer

The request is forwarded to the primary cluster.. Performance standby nodes are read-only. Any write requests sent to them must be forwarded to the primary cluster.

Answer

The standby node attempts to become the leader and process the write.

Answer

The request is cached locally until the primary is available.

Answer

The request is rejected with a 403 Forbidden.

Question 4

In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?

Accepted Answer

3 nodes.. A minimum of 3 nodes is standard for Raft to allow for majority consensus (quorum) if one node fails.

Answer

1 node.

Answer

2 nodes.

Answer

10 nodes.

Question 5

When migrating from an external storage backend to Raft, which command is used to capture the current state of the cluster for migration?

Accepted Answer

vault operator raft snapshot save. The 'vault operator raft snapshot save' command is used to export the current data state to a file, which can then be restored into a new Raft-based cluster.

Answer

vault operator migrate

Answer

vault write sys/storage/backup

Answer

vault operator seal

Question 6

You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?

Accepted Answer

Update your load balancer configuration to point to the new promoted cluster.. Once a DR secondary is promoted, it becomes a standalone primary. You must ensure that clients are updated to point to this new cluster and that new authentication/authorization policies are synced.

Answer

Manually re-import all secret engines from an external backup file.

Answer

Enable Performance Replication between the new primary and the old primary.

Answer

Re-initialize the cluster using 'vault operator init'.

Question 7

You are deploying Vault with the integrated Raft storage backend. How is high availability achieved?

Accepted Answer

By configuring nodes to join a Raft cluster and establishing consensus.. Raft storage is integrated into Vault, and the cluster uses the Raft consensus protocol to elect a leader and replicate data across peers.

Answer

By using a shared NFS mount for the data directory.

Answer

By manually mounting the storage partition across all nodes.

Answer

By using an external Consul agent as a lock provider.

Question 8

You are configuring a Vault cluster for high availability using Consul as the storage backend. During a network partition, the standby nodes cannot reach the leader node. What must occur for a new leader to be elected?

Accepted Answer

The Consul agent must expire the leader's session, triggering an election among standby nodes.. In an HA cluster using Consul, the leader node holds a session lock. If the leader fails or loses connectivity, the session expires, allowing standby nodes to attempt to acquire the lock and become the new leader.

Answer

The load balancer must perform a health check and restart the standby nodes.

Answer

Vault requires a manual unseal process on all nodes to trigger a new election.

Answer

The Vault administrator must manually promote a standby node via the CLI.

Question 9

What is the primary difference between HA replication and DR replication in Vault?

Accepted Answer

HA replication is for performance, DR is for data durability.. HA is about local node availability, while DR is about replicating data across clusters for geographic or systemic failure recovery.

Answer

HA replication requires Enterprise, DR does not.

Answer

DR replication uses a different storage backend.

Answer

DR replication is faster than HA replication.

Question 10

You are troubleshooting a sync issue in Performance Replication. The logs indicate 'replication lag'. Which parameter should you review to ensure optimal data synchronization between clusters?

Accepted Answer

The network connection and replication buffer throughput.. While there isn't a single 'lag' parameter, review the 'replication_buffer_size' or network throughput limits between clusters as part of diagnosing synchronization bottlenecks.

Answer

The 'disable_mlock' setting.

Answer

The 'max_lease_ttl' value.

Answer

The 'default_max_request_size'.

Question 11

You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?

Accepted Answer

Port 8200 and port 8201.. Vault replication typically requires the API port (default 8200) and the cluster port (default 8201) to be reachable between nodes for cross-cluster communication.

Answer

Only port 8200.

Answer

Port 443 and port 80.

Answer

Only port 8201.

Question 12

In the event of a total primary cluster failure, what is the status of the secrets stored in the DR secondary cluster before promotion?

Accepted Answer

They are available for reading if the secondary is unsealed.. Secrets are replicated to the DR secondary; however, the secondary is in a read-only state and cannot serve them until it is promoted to primary.

Answer

They are automatically synced back to a new primary.

Answer

They are encrypted and cannot be accessed.

Answer

They are unavailable and must be restored from backup.

Question 13

What is the primary function of a 'Performance Standby' node in Vault Enterprise?

Accepted Answer

To scale read throughput by processing requests locally.. Performance standby nodes allow local read-only requests to be served, reducing the load on the primary node.

Answer

To act as a warm standby for automatic failover.

Answer

To replicate the vault to a different geographic region.

Answer

To provide high availability for administrative writes.

Question 14

When running 'vault operator raft list-peers', you notice one node is listed but its status is 'dead'. What is the correct procedure to remove it from the Raft cluster?

Accepted Answer

Run 'vault operator raft remove-peer'.. Using 'vault operator raft remove-peer' allows you to gracefully remove a stale or dead peer from the consensus list.

Answer

Re-run the join command for the node.

Answer

Restart the leader node.

Answer

Delete the node's data directory manually.

Question 15

When configuring DR replication, what is the purpose of the 'primary_token' used on the secondary cluster?

Accepted Answer

It is used by the secondary to authenticate with the primary cluster.. The primary token is used by the secondary cluster to authenticate with the primary and establish the replication link.

Answer

It is used to authorize the secondary to unseal itself.

Answer

It is used to allow the secondary to perform write operations.

Answer

It is used to encrypt data transferred over the network.

Question 16

You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?

Accepted Answer

The secondary requires its own unseal process to function.. If a DR secondary is sealed, it cannot participate in replication. It must be unsealed separately from the primary.

Answer

The replication token has expired.

Answer

The primary is also sealed.

Answer

The primary has failed.

Question 17

Which TWO of the following statements are true regarding Performance Standby nodes?

Accepted Answer

They forward all write operations to the primary cluster.. Performance standbys handle reads and improve throughput but cannot perform writes.

Answer

They maintain their own independent master key.

Answer

They can serve requests for secrets written to any cluster.

Answer

They automatically promote themselves if the primary fails.

Question 18

Which TWO of the following are requirements for a successful Vault HA deployment using Raft?

Accepted Answer

The 'cluster_addr' must be configured for inter-node communication.. Raft requires specific configuration for consensus and networking to function correctly in an HA environment.

Answer

An external Consul agent running on every node.

Answer

A load balancer to perform round-robin writes.

Answer

A shared network file system (NFS) for the storage directory.

Question 19

Which THREE of the following steps are necessary when performing a manual disaster recovery promotion?

Accepted Answer

Running 'vault operator dr promotion' on the secondary.. Promotion involves authenticating, executing the promotion command, and ensuring the new primary is reachable.

Answer

Deleting the old primary's data from the secondary.

Answer

Re-initializing the cluster.

Question 20

When using Vault with an external storage backend like Consul, what is the effect of changing the 'api_addr' in the Vault configuration file?

Accepted Answer

It updates the address clients and peers use to communicate with the node.. The 'api_addr' is used by the leader to tell other nodes how to reach it. Changing it affects cluster communication and how clients connect.

Answer

It forces a cluster leader election.

Answer

It disables high availability mode.

Answer

It changes the storage backend connection string.