Vault Enterprise Fault Tolerant Vault Environments Practice Test 3 — 15 Questions

Question 1

Which THREE actions are recommended for maintaining a healthy DR replication setup?

Accepted Answer

Monitoring replication lag metrics.. Option B is correct because continuously monitoring replication lag metrics (e.g., replication lag in seconds or bytes behind) is essential to detect degraded or broken DR replication before an actual failover is needed. Option C is correct because periodically performing a mock promotion in a staging environment validates that the DR replica can actually be promoted and that failover procedures, dependencies, and runbooks work end-to-end without impacting production. Option D is correct because the replication token used to authenticate and authorize replication between nodes must remain valid and have a sufficient TTL; if it expires or is revoked, replication silently stops and the DR copy becomes stale. Option A is not recommended because rotating the master key daily is operationally risky and unnecessary for DR health, and could disrupt replication if not coordinated. Option E is not a recommended maintenance action for DR replication health because increasing storage backend write throughput is a performance tuning change, not a routine health-maintenance practice, and may not address replication correctness or recoverability.

Answer

Rotating the master key daily.

Answer

Increasing the storage backend write throughput.

Question 2

Which TWO of the following factors can cause a Vault cluster to lose quorum in a Raft-based deployment?

Accepted Answer

Loss of a majority of the nodes in the Raft voting set.. Option A is correct because Raft requires a majority of voting nodes (quorum) to commit log entries and elect a leader; losing more than half of the voting set means no quorum can be achieved, halting writes and leader election. Option D is correct because a network partition that isolates nodes from the leader can split the cluster such that neither side retains a majority of voters, preventing quorum and causing the cluster to lose its ability to operate. Option B is wrong because a load balancer health check failure only affects traffic routing to that follower, not Raft consensus or quorum. Option C is wrong because enabling performance replication is a supported enterprise feature that does not itself break Raft quorum. Option E is wrong because an incorrect api_addr on a follower affects client redirection and cluster address advertisement, not the Raft voting quorum.

Answer

The load balancer health check fails on a follower.

Answer

Enabling performance replication on the cluster.

Answer

The 'api_addr' is configured incorrectly on a follower.

Question 3

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

Accepted Answer

api_addr. Option C (api_addr) is critical because it tells each Vault node the address clients and other clusters should use to reach its API, and an incorrect value breaks cross-cluster request routing. Option D (listener.tcp.address) is critical because the TCP listener must bind to an address reachable by the peer cluster (e.g., 0.0.0.0:8200 or the node's routable IP) rather than only loopback, otherwise incoming cross-cluster traffic cannot connect. Option E (cluster_addr) is critical because it advertises the node's address for cluster-to-cluster (Raft replication) traffic, and a wrong or unreachable value prevents nodes from joining and replicating across clusters. Option A (storage_type) is not a cross-cluster communication setting; it only selects the backend (e.g., raft, file, consul) and does not affect inter-node reachability. Option B (ui) merely enables or disables the web UI and has no bearing on cross-cluster communication.

Answer

storage_type

Answer

ui

Question 4

Which THREE components are involved in a standard high availability (HA) Vault architecture?

Accepted Answer

A load balancer.. In a standard HA Vault architecture, a load balancer (A) is required to distribute client requests across the active and standby nodes, routing traffic to the current leader and providing a stable endpoint. Multiple Vault nodes (D) are essential because HA relies on a cluster of Vault servers where one node is active and the others are standbys ready to take over via leader election. A storage backend such as Raft or Consul (E) is also required, since it provides the shared, highly available data store that all nodes use for configuration, state, and leader election coordination. A secondary Vault cluster (B) is not part of a standard HA setup; it describes disaster recovery replication (performance or DR replication) rather than HA within a single cluster. An external monitoring tool (C) is useful for observability and alerting but is not a required architectural component of Vault's HA design.

Answer

A secondary Vault cluster.

Answer

An external monitoring tool.

Question 5

You are designing a Vault Enterprise cluster for high availability. To ensure that the cluster can tolerate the failure of a single node without losing quorum, and to support Integrated Storage, what is the minimum number of nodes required in the Raft cluster?

Accepted Answer

3. Integrated Storage (Raft) requires a quorum to operate. For tolerating f failures, the cluster size must be at least 2f+1. To tolerate one node failure, the minimum size is 3. This ensures that even if one node goes down, a majority (2 out of 3) remains to elect a leader and process writes. Smaller clusters cannot tolerate failures, and larger clusters exceed the minimum requirement.

Answer

1

Answer

5

Answer

2

Question 6

You are deploying a Vault Enterprise cluster with Integrated Storage (Raft) across three availability zones. To ensure that the cluster remains available if one availability zone fails, how should you distribute the Vault nodes?

Accepted Answer

Deploy one Vault node in each of the three availability zones.. To survive a single availability zone failure, the Vault nodes must be spread across at least three zones with one node each. This ensures that a zone failure leaves two nodes in separate zones, which can still form a quorum. Distributing nodes unevenly or placing multiple nodes in one zone increases the risk of quorum loss if that zone fails. The even distribution across three zones is the standard best practice for high availability.

Answer

Deploy two Vault nodes in one availability zone and one node in another.

Answer

Deploy all three Vault nodes in a single availability zone.

Answer

Deploy one Vault node in each of two availability zones and one node outside any zone.

Question 7

You are operating a Vault Enterprise cluster with Integrated Storage (Raft) and Performance Replication enabled. The primary cluster has three nodes, and the secondary cluster has three nodes. During a planned maintenance window, you need to take down the primary cluster for two hours. You want the secondary cluster to continue serving read requests for replicated data but not accept writes to avoid conflicts when the primary returns. Which action should you take on the secondary cluster before taking down the primary?

Accepted Answer

Do nothing; the secondary cluster already serves reads and rejects writes to replicated data.. A Performance Replication secondary cluster inherently serves read requests for replicated data and rejects writes to those paths unless it is promoted to primary. This design allows for read scaling and disaster recovery without manual intervention. During primary downtime, the secondary continues to function as a read-only replica, so no configuration change is required to maintain that behavior.

Answer

Demote the primary cluster to secondary and then promote the secondary cluster to primary.

Answer

Promote the secondary cluster to primary using 'vault operator promote'.

Answer

Set the secondary cluster to 'read-only' mode using 'vault write sys/replication/performance/secondary/read-only'.

Question 8

You are operating a Vault Enterprise cluster using the integrated Raft storage backend with three nodes. The cluster is used for production secrets management. After a scheduled maintenance window, you notice that the Vault service on one node was not restarted automatically. When you check the node's status, it is running but not part of the Raft cluster. You need to rejoin the node to the Raft cluster without affecting the existing leader or other peers. Which command should you run on the node to achieve this?

Accepted Answer

vault operator raft join http://leader-address:8200. To rejoin a node to an existing Raft cluster, you must use the raft join command with the address of the current leader or any active peer. This safely adds the node as a follower, allowing it to synchronize with the cluster. Other commands like snapshot restore or init would disrupt the node's state and are not appropriate for this scenario. Unsealing alone does not establish cluster membership.

Answer

vault operator raft snapshot restore -file=snapshot.snap

Answer

vault operator init -key-shares=1 -key-threshold=1

Answer

vault operator unseal

Question 9

You have a Vault Enterprise cluster with integrated storage (Raft) running three nodes in one data center. To prepare for a potential data center outage, you add three more nodes in a second data center. After a network partition isolates the first data center, the three nodes in the second data center remain active and continue serving reads and writes. Later, the partition is resolved, but the original three nodes have not automatically rejoined. You need to restore the cluster to a healthy state with all six nodes participating, while minimizing downtime. What is the most appropriate action?

Accepted Answer

Use the `vault operator raft join` command on each of the original three nodes, specifying the API address of a current leader in the second data center.. When a network partition isolates a subset of Raft nodes, those nodes may not automatically rejoin after connectivity is restored, especially if they missed heartbeats and were removed from the active configuration. The correct recovery is to run `vault operator raft join` on each isolated node, pointing to a current leader. This re-establishes the node as a follower and allows it to catch up, restoring full cluster health with minimal disruption.

Answer

Run `vault operator raft snapshot restore` on the three nodes in the second data center to force them to recognize the original nodes as peers.

Answer

Restart the Vault service on all six nodes simultaneously to trigger a new leader election and automatic peer discovery.

Answer

Remove the three original nodes from the Raft configuration using `vault operator raft remove-peer`, then re-add them as new nodes with `vault operator raft join`.

Question 10

Your organization uses Vault Enterprise with Performance Replication to replicate secrets across multiple data centers. You are planning a failover test where the primary cluster will be taken offline. You need to ensure that the secondary cluster can be promoted to primary without data loss. Which two actions must you perform before the failover to guarantee a clean promotion? (Choose two.)

Accepted Answer

Ensure that the secondary cluster is unsealed and has a valid license that includes Performance Replication.. Before promoting a Performance Replication secondary, you must ensure it is healthy and synchronized. Checking the replication status confirms that the secondary is receiving updates and is not lagging. Additionally, the secondary must be unsealed and have a valid license that includes Performance Replication. These steps guarantee a clean promotion with minimal data loss. Other actions like snapshot restore or disabling replication are unnecessary and can disrupt the process.

Answer

Disable Performance Replication on the primary before taking it offline.

Answer

Run 'vault operator raft snapshot save' on the primary and restore it on the secondary.

Answer

Configure the secondary to use a different seal mechanism than the primary.

Question 11

You are responsible for a Vault Enterprise cluster using integrated storage (Raft). The cluster has five nodes spread across three availability zones. During a routine maintenance window, you need to replace one node's storage volume. You stop the Vault service on that node, replace the volume, and restart Vault. The node comes back up but does not rejoin the Raft cluster automatically. Which action should you take to rejoin the node to the existing cluster?

Accepted Answer

Run 'vault operator raft join' on the node, pointing it to the leader's API address.. When a Raft node's storage is replaced or wiped, it loses its Raft state and cannot automatically rejoin. The correct procedure is to use 'vault operator raft join' with the leader's API address. Snapshot restore is for whole-cluster recovery, removing a peer does not trigger auto-join, and re-initializing would create a new cluster.

Answer

Run 'vault operator init' on the node to generate new unseal keys and then unseal it.

Answer

Run 'vault operator raft snapshot restore' on the node using the latest snapshot from the leader.

Answer

Run 'vault operator raft remove-peer' on the leader to remove the old node, then restart the node; it will auto-join.

Question 12

You are operating a Vault Enterprise cluster with Performance Replication. The primary cluster is in us-east-1 and a secondary cluster is in eu-west-1. Clients in eu-west-1 are configured to read secrets from the secondary cluster. You notice that after a brief network disruption between the regions, the secondary cluster's replication status shows 'stream-wals' but with a high lag. Some read requests to the secondary are returning stale data. You need to ensure that the secondary cluster serves reads only when it is sufficiently up-to-date. Which action should you take?

Accepted Answer

Monitor the replication lag using `vault read sys/replication/performance/status` and, if lag is unacceptable, temporarily redirect clients to the primary until the secondary catches up.. Performance Replication secondaries serve reads locally, which can be stale if replication lag is high. Vault does not provide an automatic mechanism to reject reads based on lag. The correct operational approach is to monitor lag via the replication status API and, when necessary, redirect clients to the primary to avoid stale data. This manual intervention ensures consistency until the secondary catches up.

Answer

Use the `vault write sys/replication/performance/secondary/update-primary` command to force the secondary to re-sync from the primary.

Answer

Enable `replication_primary_only` on the secondary cluster to prevent it from serving reads until it catches up.

Answer

Configure the secondary cluster's `max_lag` parameter in the replication configuration to a low value, and set the secondary to reject reads if lag exceeds that value.

Question 13

You are managing a Vault Enterprise cluster with integrated Raft storage. The cluster has five nodes. During a network partition, two nodes become isolated from the other three. The three remaining nodes continue to operate and elect a leader. What is the expected behavior of the two isolated nodes?

Accepted Answer

They will remain in a non-leader state and will not serve any requests until connectivity is restored.. In a Raft cluster, a majority quorum is required to elect a leader and to commit entries. With five nodes, a quorum is three. The two isolated nodes cannot form a quorum, so they cannot elect a leader or serve requests. They will remain in a non-leader state and wait for connectivity to be restored. Once the partition is healed, they will rejoin the cluster and catch up on any missed logs.

Answer

They will attempt to elect a new leader among themselves and continue serving requests.

Answer

They will automatically promote themselves to performance standbys and serve read-only requests.

Answer

They will become standby nodes and can still serve read requests.

Question 14

You are deploying a new Vault Enterprise cluster with integrated storage (Raft) in a single data center. You have three nodes: vault-1, vault-2, and vault-3. After starting Vault on all three nodes, you initialize vault-1, which becomes the leader. You then need to join vault-2 and vault-3 to the cluster. Which command should you run on vault-2 and vault-3 to join them to the Raft cluster?

Accepted Answer

vault operator raft join http://vault-1:8200. To add a new node to an existing Vault Raft cluster, you run `vault operator raft join` on the new node, specifying the API address of an existing cluster member. This causes the node to contact the leader, receive the current Raft configuration, and begin replicating data. It is the documented and supported method for cluster expansion.

Answer

vault operator raft snapshot restore -force http://vault-1:8200

Answer

vault operator raft add-peer vault-1

Answer

vault write sys/storage/raft/join leader_api_addr=http://vault-1:8200

Question 15

You are using Vault Enterprise with Disaster Recovery (DR) replication. The primary cluster is in Region A, and the DR secondary is in Region B. A catastrophic failure occurs in Region A, and the primary cluster is completely lost. You promote the DR secondary to primary. After promotion, you need to reconfigure the old primary's remaining nodes (if any) to act as a DR secondary for the new primary. However, the old primary's nodes are completely destroyed. What is the recommended approach to re-establish DR replication with a new secondary cluster in Region A?

Accepted Answer

Generate a new DR secondary activation token on the new primary and use it to configure a new Vault cluster in Region A as a DR secondary.. After promoting a DR secondary, the new primary can generate a new activation token for a new DR secondary. You then deploy a new Vault cluster in the failed region, configure it with the same storage and seal, and use the token to enable DR replication. This creates a fresh DR relationship. Reusing old tokens or restoring snapshots is not appropriate, and Performance Replication is not a substitute for DR.

Answer

Reuse the original DR secondary activation token from the old primary to configure the new nodes.

Answer

Configure the new nodes as a Performance Replication secondary instead of DR, because DR requires the original primary.

Answer

Restore a Raft snapshot from the old primary to the new nodes and then run 'vault operator dr promote' on them.