Vault Enterprise Fault Tolerant Vault Environments — Timed 20 Questions

Question 1

In a Performance Replication setup, a secondary cluster is experiencing high latency for read requests. Which action should you take to verify if the requests are being routed correctly?

Accepted Answer

Check the 'sys/metrics' endpoint to verify the number of performance standby requests.. The sys/metrics endpoint exposes internal telemetry, including counters for performance standby requests, which reveal whether read requests are being routed to the secondary cluster's performance standbys as intended. Checking this metric confirms routing behavior and helps diagnose latency caused by misrouted or overloaded standbys. It is the correct diagnostic step before changing configuration.

Answer

Increase the 'max_lease_ttl' on the primary cluster.

Answer

Run 'vault write sys/replication/performance/secondary/update' to increase synchronization speed.

Answer

Restart the secondary cluster to clear the internal request cache.

Question 2

You have a Performance Replication setup. A client sends a write request to a performance standby node. What happens to this request?

Accepted Answer

The request is forwarded to the primary cluster.. In a Vault Enterprise Performance Replication topology, a performance standby node is a read-only replica that maintains its own storage backend and can serve reads locally, but it cannot process writes. When a client sends a write request to a performance standby, Vault transparently forwards the request over the replication connection to the active node in the primary cluster, which performs the write and returns the response. This forwarding is automatic and transparent to the client, so no error is returned.

Answer

The standby node attempts to become the leader and process the write.

Answer

The request is cached locally until the primary is available.

Answer

The request is rejected with a 403 Forbidden.

Question 3

When migrating from an external storage backend to Raft, which command is used to capture the current state of the cluster for migration?

Accepted Answer

vault operator raft snapshot save. The `vault operator raft snapshot save` command captures a point-in-time snapshot of the Raft cluster's state, including all Vault data and configuration. This snapshot is essential for migrating from an external storage backend (like Consul or file) to Raft, as it allows you to restore the data into the new Raft storage. The command is specifically designed for Raft integrated storage and produces a consistent backup that can be later restored using `vault operator raft snapshot restore`.

Answer

vault operator migrate

Answer

vault write sys/storage/backup

Answer

vault operator seal

Question 4

You are configuring a Vault cluster for high availability using Consul as the storage backend. During a network partition, the standby nodes cannot reach the leader node. What must occur for a new leader to be elected?

Accepted Answer

The Consul agent must expire the leader's session, triggering an election among standby nodes.. With Consul as the storage backend, Vault HA leader election relies on Consul's session mechanism: the active node holds a Consul session lock, and if the standby nodes cannot reach the leader, the Consul agent expires the leader's session, releasing the lock and triggering an election among standbys. The node that acquires the lock becomes the new active node.

Answer

The load balancer must perform a health check and restart the standby nodes.

Answer

Vault requires a manual unseal process on all nodes to trigger a new election.

Answer

The Vault administrator must manually promote a standby node via the CLI.

Question 5

You are troubleshooting a sync issue in Performance Replication. The logs indicate 'replication lag'. Which parameter should you review to ensure optimal data synchronization between clusters?

Accepted Answer

The network connection and replication buffer throughput.. While there isn't a single 'lag' parameter, review the 'replication_buffer_size' or network throughput limits between clusters as part of diagnosing synchronization bottlenecks.

Answer

The 'disable_mlock' setting.

Answer

The 'max_lease_ttl' value.

Answer

The 'default_max_request_size'.

Question 6

In the event of a total primary cluster failure, what is the status of the secrets stored in the DR secondary cluster before promotion?

Accepted Answer

They are available for reading if the secondary is unsealed.. In a Vault Enterprise DR secondary cluster, data is replicated from the primary and stored locally. Even before promotion, if the DR secondary is unsealed, the secrets are available for read operations. This allows DR secondaries to serve read traffic during a primary outage without requiring promotion, though writes are not possible until promotion.

Answer

They are automatically synced back to a new primary.

Answer

They are encrypted and cannot be accessed.

Answer

They are unavailable and must be restored from backup.

Question 7

When configuring DR replication, what is the purpose of the 'primary_token' used on the secondary cluster?

Accepted Answer

It is used by the secondary to authenticate with the primary cluster.. During DR replication setup, the secondary cluster must be able to reach the primary's replication API and authenticate to it. The 'primary_token' is a token generated on the primary (typically with the 'vault replication' or DR secondary activation workflow) that the secondary presents to the primary to establish and maintain the replication relationship. It is not used for unsealing, writes, or transport encryption.

Answer

It is used to authorize the secondary to unseal itself.

Answer

It is used to allow the secondary to perform write operations.

Answer

It is used to encrypt data transferred over the network.

Question 8

Which TWO of the following are requirements for a successful Vault HA deployment using Raft?

Accepted Answer

The 'cluster_addr' must be configured for inter-node communication.. Option A is correct because Vault's Raft integrated storage requires the 'cluster_addr' setting so nodes can advertise a reachable address for inter-node Raft replication and cluster communication; without it, nodes cannot form or maintain the HA cluster. Option E is correct because 'api_addr' must be configured and reachable by all other nodes so that cluster peers and clients can communicate with the node's API endpoint, which is essential for request forwarding and HA operation. Option B is incorrect because Raft integrated storage does not require an external Consul agent; Consul is only needed when using Consul as the storage backend. Option C is incorrect because a load balancer is not a Raft requirement, and round-robin writes are not how Vault HA works since only the active node handles writes. Option D is incorrect because Raft uses local disk storage on each node and does not require a shared NFS directory.

Answer

An external Consul agent running on every node.

Answer

A load balancer to perform round-robin writes.

Answer

A shared network file system (NFS) for the storage directory.

Question 9

Which THREE of the following steps are necessary when performing a manual disaster recovery promotion?

Accepted Answer

Running 'vault operator dr promotion' on the secondary.. Option A is correct because the manual disaster recovery promotion of a Vault secondary cluster is performed with the 'vault operator dr promotion' command, which transitions the secondary into a primary and allows it to serve write operations. Option C is correct because after promotion, clients, agents, and other consumers must be reconfigured to send requests to the new primary's URL, since the old primary is no longer the active write node. Option D is correct because the promoted secondary must be unsealed with its existing unseal keys before it can serve requests; promotion does not bypass the seal/unseal requirement. Option B is not a required step because the secondary's replicated data is retained and used after promotion, not deleted. Option E is not required because re-initialization would destroy the existing cluster state and is not part of a promotion; the cluster keeps its existing configuration and data.

Answer

Deleting the old primary's data from the secondary.

Answer

Re-initializing the cluster.

Question 10

Which TWO of the following are valid reasons why a node might fail to join an existing Raft cluster?

Accepted Answer

The 'cluster_addr' is not reachable from the leader.. Option B is correct because Raft cluster membership requires bidirectional network reachability between nodes; if the leader cannot reach the joining node's cluster_addr (the address used for Raft replication traffic, typically port 8201), the join request cannot complete and the node will fail to join. Option C is correct because a node that already holds Raft state belonging to a different cluster will refuse to join a new cluster, since its existing configuration and log data conflict with the target cluster's identity; it must be reset or reinitialized first. Option A is not a valid reason, because 'vault operator init' initializes a Vault server's unseal keys and root token, not Raft cluster membership, and joining a cluster is a separate operation. Option D is not a valid reason, because setting the storage backend to 'consul' simply means the node is not using Raft storage at all, so it is not attempting a Raft join. Option E is not a valid reason, because differing Vault versions do not inherently prevent a Raft join; version compatibility is generally handled separately and is not a Raft membership requirement.

Answer

The node has not been initialized with 'vault operator init'.

Answer

The storage backend is set to 'consul'.

Answer

The node has a different Vault version.

Question 11

You are configuring a Vault Enterprise cluster with Performance Replication to a secondary cluster. You need to ensure that the secondary cluster can handle read requests locally to reduce latency for clients in a remote region. Which two configurations or features must be enabled to achieve this? (Choose two.)

Accepted Answer

Configure the secondary cluster with a mount filter that includes the required secrets engines.. To enable local reads on a Performance Replication secondary, you must run Performance Standby nodes on the secondary and ensure that the secrets engines you want to read locally are included in the mount filter. Performance Standby nodes allow the secondary to serve reads without forwarding to the primary, and the mount filter determines which mounts are replicated and available locally. Without both, reads will be forwarded to the primary, increasing latency.

Answer

Configure the primary cluster to forward all read requests to the secondary.

Answer

Enable the 'read-only' mode on the secondary cluster.

Answer

Set the secondary cluster to act as a Disaster Recovery (DR) secondary.

Question 12

You are operating a Vault Enterprise cluster with integrated storage (Raft) and Performance Replication enabled. The primary cluster has three voters. The secondary cluster is in a remote data center. After a scheduled maintenance that rebooted all nodes in the secondary cluster simultaneously, you notice that the secondary is no longer forwarding token creation requests to the primary. Instead, it is servicing reads from its local replica. Which Vault Enterprise feature allows the secondary to continue servicing reads while the primary is unreachable, and what is the state of the secondary during this time?

Accepted Answer

The secondary continues to operate in a 'secondary' state, servicing reads from its local replica, and will forward writes to the primary when connectivity is restored.. Performance Replication allows secondary clusters to service read requests locally, reducing latency and offloading the primary. When the primary is unreachable, the secondary remains in its secondary state and continues to serve reads from its replicated data. Writes are not accepted locally; they are either queued or fail until the primary is reachable again. This behavior provides fault tolerance for read operations but does not provide automatic write failover, which requires manual promotion.

Answer

The secondary enters a 'standby' state and only services reads from its local replica until connectivity to the primary is restored.

Answer

The secondary automatically promotes itself to primary and begins accepting writes to avoid downtime.

Answer

The secondary enters a 'sealed' state and cannot service any requests until the primary is reachable.

Question 13

You are managing a Vault Enterprise cluster with integrated storage (Raft) and Disaster Recovery (DR) replication. The DR primary is in Region A, and the DR secondary is in Region B. A network partition occurs, isolating Region B from Region A. The DR secondary in Region B is configured with 'dr_operation_token' and is currently in a 'secondary' state. During the partition, an operator in Region B attempts to promote the DR secondary to primary using 'vault operator promote'. What will happen?

Accepted Answer

The promotion will fail because the DR secondary cannot contact the primary to verify the replication state and obtain the necessary promotion token.. Promoting a DR secondary requires a promotion token generated by the primary. This token ensures that the secondary is authorized and synchronized. During a network partition, the secondary cannot contact the primary to obtain or validate the token, so the promotion fails. This is a safety mechanism to prevent split-brain and data loss. The operator must wait for connectivity to be restored or use alternative recovery methods if the primary is permanently lost.

Answer

The promotion will succeed only if the operator uses the '-force' flag with 'vault operator promote'.

Answer

The promotion will succeed but the DR secondary will remain read-only until it reconnects to the primary.

Answer

The promotion will succeed immediately, and the DR secondary will become the new primary, allowing writes in Region B.

Question 14

You are deploying a Vault Enterprise cluster with Integrated Storage (Raft) across three availability zones. You want to ensure that the cluster can tolerate the failure of an entire availability zone without losing quorum. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Ensure that the Vault nodes are placed in at least three different availability zones and that no single AZ contains a majority of nodes.. To tolerate the failure of an entire availability zone, the Vault Raft cluster must have an odd number of nodes (minimum three) distributed such that no single AZ holds a majority. This ensures that if one AZ fails, the remaining nodes still form a quorum. Even distribution across AZs is essential; otherwise, a failure could leave the cluster without quorum. These two configurations—odd number of nodes spread across AZs and even distribution—are required.

Answer

Configure each Vault node with a unique 'node_id' and ensure they can communicate over port 8200 and 8201.

Answer

Configure a load balancer to distribute traffic evenly across all Vault nodes in all AZs.

Answer

Enable 'raft' as the storage backend and set 'cluster_addr' to the node's address in each AZ.

Question 15

You are configuring a Vault Enterprise cluster with integrated storage (Raft) and Performance Replication. The primary cluster is in the US, and a secondary cluster is in Europe. You need to ensure that the secondary can service read requests locally and that write requests are forwarded to the primary. Which two configurations or behaviors are required to achieve this? (Choose two.)

Accepted Answer

The secondary cluster must have a direct network connection to the primary on port 8201 for replication traffic.. To enable Performance Replication, the secondary cluster must be activated with a replication token from the primary, and network connectivity on the replication port (e.g., 8201) must be allowed. Once activated, the secondary receives replicated data and can service reads locally while forwarding writes to the primary. Promotion is not required and would change the cluster's role. The storage backend and configuration file do not determine replication mode.

Answer

The secondary cluster must be configured with 'performance_replication' mode in its Vault configuration file.

Answer

The secondary cluster must be promoted to primary to service reads locally.

Answer

The secondary cluster must use a different storage backend than the primary.

Question 16

You are running a Vault Enterprise cluster with Performance Replication. The primary cluster is in AWS us-east-1, and the secondary cluster is in AWS eu-west-1. You have configured the secondary to be a performance standby to offload read requests from the primary. A client attempts to write a secret to a replicated path via the secondary cluster's load balancer. What is the expected behavior?

Accepted Answer

The write request is forwarded to the primary cluster and processed there.. A performance standby cluster in Vault Enterprise is designed to forward write requests to the primary cluster while serving reads locally. This allows for read scaling and reduced latency for read-heavy workloads. When a client sends a write to the performance standby, Vault recognizes the request type and proxies it to the primary. The primary processes the write, replicates it back, and the standby acknowledges the client. This behavior ensures data consistency while offloading read traffic.

Answer

The write request is processed locally on the secondary and then replicated to the primary.

Answer

The write request is queued on the secondary until the primary becomes available.

Answer

The write request is rejected with a 'permission denied' error because the secondary is read-only.

Question 17

You are deploying a Vault Enterprise cluster with integrated storage (Raft) in a high-availability configuration across three availability zones. You want to ensure that the cluster can tolerate the failure of one availability zone without losing quorum. How many Vault nodes should you deploy in total, and what is the minimum number of nodes required to maintain quorum?

Accepted Answer

Deploy 3 nodes; quorum requires at least 2 nodes.. For a Vault cluster using integrated storage (Raft), the minimum number of nodes to tolerate a single availability zone failure is 3. With 3 nodes, quorum is 2, so the cluster can continue operating if one node (or one availability zone) fails. Deploying 2 nodes would not provide fault tolerance because both nodes are required for quorum. Even-numbered clusters are generally not recommended because they do not improve fault tolerance over the next lower odd number.

Answer

Deploy 4 nodes; quorum requires at least 3 nodes.

Answer

Deploy 5 nodes; quorum requires at least 3 nodes.

Answer

Deploy 2 nodes; quorum requires both nodes to be online.

Question 18

You are designing a Vault Enterprise deployment that must survive the loss of an entire AWS region. The primary cluster is in us-east-1, and you have a disaster recovery (DR) secondary in us-west-2. The DR secondary is currently in a standby state. A catastrophic event destroys us-east-1. You need to promote the DR secondary to primary and ensure that clients can write to it. What is the correct sequence of actions?

Accepted Answer

Run 'vault operator promote' on the DR secondary, then verify the replication status and update clients to use the new primary's address.. To fail over to a DR secondary, use 'vault operator promote' (or 'vault operator dr promote') to make it writable, then verify replication status and redirect clients. Unsealing, snapshot restore, or re-initialization are not part of the promotion process and would be incorrect or harmful.

Answer

Run 'vault operator init' on the DR secondary to generate new unseal keys, then unseal it and promote it with 'vault operator promote'.

Answer

Run 'vault operator raft snapshot restore' on the DR secondary using the latest snapshot from the primary, then promote it.

Answer

Run 'vault operator dr promote' on the DR secondary, then unseal it with the original unseal keys, and update clients to point to the new primary.

Question 19

You are managing a Vault Enterprise cluster with Disaster Recovery (DR) replication. The primary cluster is in us-east-1 and the DR secondary is in us-west-2. A disaster occurs in us-east-1, and the primary cluster is completely lost. You need to promote the DR secondary to become the new primary. After promotion, you must ensure that the new primary can accept writes and that clients can connect. Which two actions are required to complete the promotion and make the DR secondary fully operational as a primary? (Choose two.)

Accepted Answer

Run `vault operator dr promote` on the DR secondary cluster.. To promote a DR secondary, you must run `vault operator dr promote`. This action makes the cluster writable and promotes it to a primary. Additionally, clients must be reconfigured to connect to the new primary's API address, as the old primary is unavailable. These two steps are essential for a successful DR failover and continued operations.

Answer

Generate a new root token using `vault operator generate-root` on the new primary.

Answer

Update the `api_addr` and `cluster_addr` in the Vault configuration on the new primary to reflect its new role, then restart Vault.

Answer

Run `vault operator raft snapshot restore` on the new primary to apply the latest data.

Question 20

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Accepted Answer

The storage backend (e.g., Consul).. In a Vault HA cluster, the storage backend (typically Consul or Vault's integrated Raft storage) is responsible for leader election. Vault nodes compete for a lock in the storage backend, and whichever node acquires the lock becomes the active leader while the others become standbys. This lock-based mechanism guarantees only one active node at a time.

Answer

The load balancer.

Answer

The Vault server process configuration file.

Answer

The Vault CLI.