Vault Enterprise Fault Tolerant Vault Environments Practice Test 2 — 15 Questions

Question 1

You are running a Vault Enterprise cluster with Performance Replication. The primary cluster is in AWS us-east-1, and the secondary cluster is in AWS eu-west-1. You have configured the secondary to be a performance standby to offload read requests from the primary. A client attempts to write a secret to a replicated path via the secondary cluster's load balancer. What is the expected behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The write request is forwarded to the primary cluster and processed there.. A performance standby cluster in Vault Enterprise is designed to forward write requests to the primary cluster while serving reads locally. This allows for read scaling and reduced latency for read-heavy workloads. When a client sends a write to the performance standby, Vault recognizes the request type and proxies it to the primary. The primary processes the write, replicates it back, and the standby acknowledges the client. This behavior ensures data consistency while offloading read traffic.

Answer

The write request is processed locally on the secondary and then replicated to the primary.

Answer

The write request is queued on the secondary until the primary becomes available.

Answer

The write request is rejected with a 'permission denied' error because the secondary is read-only.

Question 2

You are deploying a Vault Enterprise cluster with integrated storage (Raft) in a high-availability configuration across three availability zones. You want to ensure that the cluster can tolerate the failure of one availability zone without losing quorum. How many Vault nodes should you deploy in total, and what is the minimum number of nodes required to maintain quorum?

Accepted Answer

Deploy 3 nodes; quorum requires at least 2 nodes.. For a Vault cluster using integrated storage (Raft), the minimum number of nodes to tolerate a single availability zone failure is 3. With 3 nodes, quorum is 2, so the cluster can continue operating if one node (or one availability zone) fails. Deploying 2 nodes would not provide fault tolerance because both nodes are required for quorum. Even-numbered clusters are generally not recommended because they do not improve fault tolerance over the next lower odd number.

Answer

Deploy 4 nodes; quorum requires at least 3 nodes.

Answer

Deploy 5 nodes; quorum requires at least 3 nodes.

Answer

Deploy 2 nodes; quorum requires both nodes to be online.

Question 3

You are designing a Vault Enterprise deployment that must survive the loss of an entire AWS region. The primary cluster is in us-east-1, and you have a disaster recovery (DR) secondary in us-west-2. The DR secondary is currently in a standby state. A catastrophic event destroys us-east-1. You need to promote the DR secondary to primary and ensure that clients can write to it. What is the correct sequence of actions?

Accepted Answer

Run 'vault operator promote' on the DR secondary, then verify the replication status and update clients to use the new primary's address.. To fail over to a DR secondary, use 'vault operator promote' (or 'vault operator dr promote') to make it writable, then verify replication status and redirect clients. Unsealing, snapshot restore, or re-initialization are not part of the promotion process and would be incorrect or harmful.

Answer

Run 'vault operator init' on the DR secondary to generate new unseal keys, then unseal it and promote it with 'vault operator promote'.

Answer

Run 'vault operator raft snapshot restore' on the DR secondary using the latest snapshot from the primary, then promote it.

Answer

Run 'vault operator dr promote' on the DR secondary, then unseal it with the original unseal keys, and update clients to point to the new primary.

Question 4

You are managing a Vault Enterprise cluster with Disaster Recovery (DR) replication. The primary cluster is in us-east-1 and the DR secondary is in us-west-2. A disaster occurs in us-east-1, and the primary cluster is completely lost. You need to promote the DR secondary to become the new primary. After promotion, you must ensure that the new primary can accept writes and that clients can connect. Which two actions are required to complete the promotion and make the DR secondary fully operational as a primary? (Choose two.)

Accepted Answer

Run `vault operator dr promote` on the DR secondary cluster.. To promote a DR secondary, you must run `vault operator dr promote`. This action makes the cluster writable and promotes it to a primary. Additionally, clients must be reconfigured to connect to the new primary's API address, as the old primary is unavailable. These two steps are essential for a successful DR failover and continued operations.

Answer

Generate a new root token using `vault operator generate-root` on the new primary.

Answer

Update the `api_addr` and `cluster_addr` in the Vault configuration on the new primary to reflect its new role, then restart Vault.

Answer

Run `vault operator raft snapshot restore` on the new primary to apply the latest data.

Question 5

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Accepted Answer

The storage backend (e.g., Consul).. In a Vault HA cluster, the storage backend (typically Consul or Vault's integrated Raft storage) is responsible for leader election. Vault nodes compete for a lock in the storage backend, and whichever node acquires the lock becomes the active leader while the others become standbys. This lock-based mechanism guarantees only one active node at a time.

Answer

The load balancer.

Answer

The Vault server process configuration file.

Answer

The Vault CLI.

Question 6

In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?

Accepted Answer

3 nodes.. A three-node Raft cluster is the minimum recommended for production because it tolerates the failure of one node while maintaining quorum. Raft requires a majority of nodes to be available for writes, so with three nodes, two must be up — allowing one failure without losing availability. This is the standard recommendation for Vault HA deployments using integrated storage.

Answer

1 node.

Answer

2 nodes.

Answer

10 nodes.

Question 7

You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?

Accepted Answer

Update your load balancer configuration to point to the new promoted cluster.. After promoting a secondary to primary with 'vault operator dr promotion', the cluster is functional but clients still resolve the old primary's address. The immediate next step is to update the load balancer (or DNS/service discovery) so traffic is directed to the newly promoted cluster. Until that routing change is made, the promotion has no user-visible effect.

Answer

Manually re-import all secret engines from an external backup file.

Answer

Enable Performance Replication between the new primary and the old primary.

Answer

Re-initialize the cluster using 'vault operator init'.

Question 8

You are deploying Vault with the integrated Raft storage backend. How is high availability achieved?

Accepted Answer

By configuring nodes to join a Raft cluster and establishing consensus.. High availability with Vault's integrated Raft storage is achieved by configuring multiple Vault nodes to join a Raft cluster, where they participate in leader election and maintain consensus. The Raft protocol ensures that a quorum of nodes is required for operations, providing fault tolerance and automatic failover.

Answer

By using a shared NFS mount for the data directory.

Answer

By manually mounting the storage partition across all nodes.

Answer

By using an external Consul agent as a lock provider.

Question 9

What is the primary difference between HA replication and DR replication in Vault?

Accepted Answer

HA replication is for performance, DR is for data durability.. HA replication in Vault Enterprise is designed to improve read scalability and reduce latency by allowing secondary clusters to serve reads from replicated data, while writes still go to the primary. DR replication is designed for disaster recovery: it maintains a copy of data on a secondary that can be promoted to primary if the primary fails, prioritizing data durability and recovery over performance.

Answer

HA replication requires Enterprise, DR does not.

Answer

DR replication uses a different storage backend.

Answer

DR replication is faster than HA replication.

Question 10

You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?

Accepted Answer

Port 8200 and port 8201.. Vault replication requires both the API port (8200) and the cluster port (8201) to be open between primary and secondary clusters. Port 8200 carries client API traffic and replication API calls, while port 8201 is the dedicated cluster-to-cluster port used for replication data streaming and internal RPC between nodes. Both must be reachable bidirectionally for replication to establish and stay healthy.

Answer

Only port 8200.

Answer

Port 443 and port 80.

Answer

Only port 8201.

Question 11

What is the primary function of a 'Performance Standby' node in Vault Enterprise?

Accepted Answer

To scale read throughput by processing requests locally.. A Performance Standby node in Vault Enterprise is designed to scale read throughput by servicing read-only requests locally while still forwarding writes to the active node. This allows horizontal scaling of read operations without affecting the write path or requiring additional active nodes.

Answer

To act as a warm standby for automatic failover.

Answer

To replicate the vault to a different geographic region.

Answer

To provide high availability for administrative writes.

Question 12

When running 'vault operator raft list-peers', you notice one node is listed but its status is 'dead'. What is the correct procedure to remove it from the Raft cluster?

Accepted Answer

Run 'vault operator raft remove-peer'.. The 'vault operator raft remove-peer' command is the supported, safe way to evict a dead node from the Raft cluster. It instructs the leader to remove the peer from the Raft configuration, allowing the remaining nodes to re-establish quorum without the failed member. This is the documented procedure for decommissioning or replacing a failed Raft node in Vault Enterprise.

Answer

Re-run the join command for the node.

Answer

Restart the leader node.

Answer

Delete the node's data directory manually.

Question 13

You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?

Accepted Answer

The secondary requires its own unseal process to function.. In Vault Enterprise Disaster Recovery (DR) Replication, the DR secondary cluster maintains its own seal status independent of the primary. If the DR secondary's seal status differs from the primary (e.g., primary unsealed, secondary sealed), it indicates that the secondary has not been unsealed since its last restart or initialization. Each cluster in a DR replication relationship must be unsealed separately because the unseal keys are not replicated across clusters.

Answer

The replication token has expired.

Answer

The primary is also sealed.

Answer

The primary has failed.

Question 14

Which TWO of the following statements are true regarding Performance Standby nodes?

Accepted Answer

They forward all write operations to the primary cluster.. Option B is correct because Performance Standby nodes do not process write operations locally; they forward all write requests to the active primary cluster, which is the only node that can persist writes to storage. Option C is correct because Performance Standby nodes are designed to handle read-only requests locally, allowing horizontal scaling of read throughput across multiple standby nodes. Option A is not correct because Performance Standby nodes share the primary's master key rather than maintaining an independent one. Option D is not correct because a Performance Standby can only serve secrets that have been replicated to it, not secrets written to any cluster. Option E is not correct because automatic promotion applies to HA standby nodes, whereas Performance Standby nodes do not automatically promote themselves if the primary fails.

Answer

They maintain their own independent master key.

Answer

They can serve requests for secrets written to any cluster.

Answer

They automatically promote themselves if the primary fails.

Question 15

When using Vault with an external storage backend like Consul, what is the effect of changing the 'api_addr' in the Vault configuration file?

Accepted Answer

It updates the address clients and peers use to communicate with the node.. The 'api_addr' in Vault's configuration specifies the address that Vault advertises to clients and other cluster nodes for API communication. Changing it updates the address used for client requests, redirects, and peer communication. It does not affect storage backend connectivity or trigger leader election.

Answer

It forces a cluster leader election.

Answer

It disables high availability mode.

Answer

It changes the storage backend connection string.