Vault Enterprise Hard Questions — 25 Difficult Questions

Question 1

You are operating a Vault Enterprise cluster with Performance Replication. The primary cluster is in us-east-1, and a performance secondary is in eu-west-1. You notice that token creation operations on the secondary are taking significantly longer than on the primary, despite low replication lag. What is the most likely cause of this increased latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The secondary cluster is using a different seal mechanism, causing token creation to require additional cryptographic operations.. Token creation on a performance secondary is handled locally, but the seal mechanism can introduce latency. If the secondary uses a different seal (e.g., a remote KMS) that is slower or has network overhead, token creation will take longer. Other options incorrectly assume forwarding to primary or replication of audit logs, which are not part of Performance Replication behavior.

Answer

The secondary cluster is forwarding token creation requests to the primary for signing, causing cross-region latency.

Answer

The secondary cluster is performing a local token creation but must wait for the primary to acknowledge the write to the token store before returning.

Answer

The secondary cluster's integrated storage is experiencing high disk I/O due to replication of audit logs from the primary.

Question 2

A Vault Enterprise administrator is configuring a secrets engine to use response wrapping to securely distribute credentials to a trusted application. The application will unwrap the token to retrieve the secret. Which two statements about response wrapping are true? (Choose two.)

Accepted Answer

The wrapping TTL determines how long the wrapped token remains valid before it expires.. Response wrapping is a secure way to deliver secrets. The wrapped token is single-use by default, and it expires after the wrapping TTL. These properties ensure that the secret is only accessible once and within a limited time. The other statements are false: multiple unwraps are not default, the wrapped token does not grant broader access, and no special policy is required for unwrapping.

Answer

Response wrapping requires the client to have a policy that allows unwrapping.

Answer

The wrapped token can be unwrapped multiple times if the wrapping TTL is long enough.

Answer

The wrapped token can be used to access any secrets that the original token could access.

Question 3

An administrator is configuring a Vault Enterprise cluster to use the Kubernetes auth method. They need to ensure that only pods with specific service account annotations can authenticate and receive a token with a policy that allows reading secrets from 'secret/data/app'. Which two steps are required to achieve this? (Choose two.)

Accepted Answer

Configure the Kubernetes auth method with a token reviewer service account that has the necessary RBAC permissions to validate service account tokens.. To configure Kubernetes auth, you must set up the auth method with a token reviewer service account that can validate service account tokens. Then, you create a role that specifies the allowed service accounts and namespaces, and attaches the necessary policies. These two steps ensure that only pods with the correct service account can authenticate and receive a token with the desired permissions.

Answer

Create an identity entity for each pod and attach the policy directly to the entity.

Answer

Attach a Sentinel EGP to the Kubernetes auth method's login path to check the service account annotations.

Answer

Use a token role to limit the TTL of tokens issued to pods based on their service account annotations.

Question 4

A Vault Enterprise administrator is configuring a new namespace for a team and wants to enforce strict isolation. The team should only be able to create tokens within their namespace, and these tokens must not be able to access resources in other namespaces. Which two configurations are necessary to achieve this? (Choose two.)

Accepted Answer

Use a token role that specifies the 'allowed_policies' to limit which policies can be attached.. To enforce strict namespace isolation, policies must be scoped to the namespace, and token roles must limit which policies can be attached. This prevents tokens from accessing resources outside the namespace. The other options are either invalid or unrelated to namespace isolation.

Answer

Set the 'namespace' parameter on the token role to restrict token creation to the namespace.

Answer

Ensure that the team's tokens are created with the 'no_parent' option to prevent cross-namespace access.

Answer

Enable the 'isolated' flag on the namespace to block all cross-namespace communication.

Question 5

A Vault Enterprise administrator is configuring an LDAP auth method in a namespace. The organization uses nested groups in Active Directory, and the administrator needs to ensure that a user who is a member of a nested group (e.g., 'Engineering' which is a member of 'AllEmployees') receives the policies attached to both groups when logging in. The LDAP auth method is configured with a group DN of 'ou=groups,dc=example,dc=com' and user DN of 'ou=users,dc=example,dc=com'. Which configuration change is required to achieve this?

Accepted Answer

Set the 'groupattr' parameter to 'memberOf' and enable 'use_token_groups=true', and ensure the LDAP bind account has read access to the tokenGroups attribute.. To resolve nested groups in Active Directory, Vault's LDAP auth method can use the tokenGroups attribute by setting 'use_token_groups=true' along with 'groupattr=memberOf'. The tokenGroups attribute contains all security groups the user belongs to, including nested ones. The bind account must have read access to this attribute. This approach is supported and avoids non-existent parameters, ensuring that users receive policies from both direct and nested groups.

Answer

Set the 'groupattr' parameter to 'memberOf' and configure the LDAP auth method with 'use_token_groups=true' and 'transitive_groups=true'.

Answer

Configure the LDAP auth method with 'discoverdn=true' and 'groupfilter' set to '(memberOf=cn=Engineering,ou=groups,dc=example,dc=com)'.

Answer

Set the 'groupattr' parameter to 'memberOf' and enable 'use_token_groups' to true.

Question 6

You are designing a Vault Enterprise deployment that uses Integrated Storage (Raft) and Performance Replication. The primary cluster is in us-east-1 and a performance secondary is in eu-west-1. You need to ensure that the secondary cluster can continue to serve reads and writes even if the primary cluster becomes unavailable for an extended period. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the secondary cluster with a sufficient number of nodes to handle the full production workload independently.. To ensure a performance secondary can take over during a primary outage, it must be properly sized to handle the full workload and the promotion process must be tested and client redirection planned. Promotion is done via `vault operator promote`, not snapshot restore or flags. DR replication is not used for this purpose, as performance secondaries are read-only until promoted.

Answer

Promote the performance secondary to a primary cluster using the `vault operator raft snapshot restore` command.

Answer

Enable `dr_replication` on the performance secondary to allow it to accept writes during a primary outage.

Answer

Set the `replication_primary` flag on the secondary to force it to accept writes immediately.

Question 7

You are using Vault Enterprise Performance Replication to replicate data from a primary cluster to multiple secondary clusters. You need to ensure that a specific secondary cluster does not receive certain sensitive secrets. Which two actions should you take? (Choose two.)

Accepted Answer

Configure a replication filter on the primary to exclude the specific mount paths containing the sensitive secrets from replication to that secondary.. To prevent specific secrets from replicating to a secondary, you must configure a replication filter on the primary cluster. This can be done either by setting a filter on the secondary activation token or by configuring a filter directly on the primary for that secondary. These actions ensure that only the desired data is replicated.

Answer

Disable replication for the entire secondary cluster and use a separate backup mechanism for other data.

Answer

Set the 'replication_deny' parameter on the secondary cluster for the mount paths of the sensitive secrets.

Answer

Manually delete the sensitive secrets from the secondary cluster after replication occurs.

Question 8

You are troubleshooting a Vault Enterprise cluster where clients connected to a Performance Secondary are intermittently receiving 500 errors during high read load. The secondary has three Performance Standby nodes and one active node. Replication lag is low. You notice that the active node on the secondary is using a significant amount of CPU. What is the most likely cause?

Accepted Answer

The active node on the secondary is handling replication writes from the primary, which is consuming CPU and causing errors under read load.. On a Performance Secondary, the active node applies replication updates from the primary, which can consume significant CPU. Under high read load, if the active node is saturated by replication, it may fail to process forwarded operations or health checks, leading to 500 errors. Performance Standby nodes serve reads locally, but the active node still handles replication and some forwarded requests.

Answer

The Performance Standby nodes are forwarding all read requests to the active node due to a misconfiguration.

Answer

The secondary cluster's license is invalid, causing it to throttle performance.

Answer

The Performance Standby nodes are not properly joined to the Raft cluster, causing the active node to handle all reads.

Question 9

A Vault Enterprise administrator is configuring a new server to use Auto-Unseal with a Hardware Security Module (HSM) that supports PKCS#11. The administrator has installed the HSM vendor's PKCS#11 library and wants Vault to use it for seal wrapping. Which configuration block must be added to the Vault server configuration file to enable this integration?

Accepted Answer

seal "pkcs11" { lib = "/usr/lib/libpkcs11.so" slot = "1" pin = "1234" key_label = "vault-key" mechanism = "0x1082" }. To configure a PKCS#11 HSM for Auto-Unseal, the seal stanza must use type pkcs11 and include the correct parameters: lib, slot, pin, key_label, and optionally mechanism. The correct option provides these with proper naming. The other options contain invalid parameter names or incorrect seal types, which would prevent Vault from initializing the seal.

Answer

seal "pkcs11" { lib = "/usr/lib/libpkcs11.so" slot = "1" pin = "1234" key_label = "vault-key" }

Answer

seal "hsm" { library = "/usr/lib/libpkcs11.so" slot = "1" pin = "1234" key_label = "vault-key" }

Answer

seal "pkcs11" { mechanism = "0x1082" library = "/usr/lib/libpkcs11.so" slot = "1" pin = "1234" key_label = "vault-key" }

Question 10

A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)

Accepted Answer

tls_key_file. To enable TLS in a Vault listener stanza, you must provide the server certificate and its corresponding private key using tls_cert_file and tls_key_file. These are the only required parameters for TLS. The CA file is only needed for client certificate verification, and tls_min_version is optional. The other options are either not required or invalid parameter names.

Answer

tls_client_ca_file

Answer

tls_min_version

Answer

tls_ca_file

Question 11

A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the 'engineering' namespace and wants to ensure that the token cannot be used to access secrets in the 'finance' namespace. Which statement about token scope in Vault Enterprise namespaces is correct?

Accepted Answer

Tokens are scoped to the namespace where they are created and cannot access other namespaces.. Tokens in Vault Enterprise are strictly scoped to the namespace in which they are created. They cannot be used to access secrets or perform operations in other namespaces, regardless of policies. This isolation is fundamental to the namespace feature, which allows secure multi-tenancy. The other options incorrectly suggest that tokens can cross namespace boundaries under certain conditions.

Answer

Tokens are global and can access any namespace if the policy allows.

Answer

Tokens can access child namespaces but not sibling or parent namespaces.

Answer

Tokens can be used across namespaces only if they have a policy with a wildcard path.

Question 12

A Vault Enterprise administrator is designing a control group to enforce additional authorization for accessing a highly sensitive secrets engine. The control group should require approval from two members of the security team before a secret can be read. The security team is defined as an identity group named 'security-team'. Which two steps are necessary to configure this control group? (Choose two.)

Accepted Answer

Create a control group policy that references the identity group 'security-team' and requires two approvals.. To configure a control group, you must create a control group policy that defines the approvers (such as the security-team identity group) and the number of approvals required. Then, you must attach that policy to the target path or role so that requests trigger the control group workflow. The other options are either unnecessary (license enablement, Sentinel policy) or belong to prior identity setup (aliases).

Answer

Create a Sentinel EGP policy that denies access unless two approvals are present.

Answer

Enable the control group feature in the Vault Enterprise license.

Answer

Configure an identity alias for each member of the security team to map to the 'security-team' group.

Question 13

A Vault Enterprise cluster is configured with a performance secondary. An administrator creates a new auth method role in the primary cluster and attaches a policy that allows reading secrets at 'secret/data/finance'. A user authenticates against the secondary cluster using that auth method. However, the user receives a permission denied error when trying to read the secret. The administrator verifies that the policy exists in the secondary and the role is replicated. What is the most likely reason for the failure?

Accepted Answer

The user's token in the secondary does not have the policy attached because token policies are determined at authentication time and the auth method's mount accessor differs between clusters.. In Performance Replication, auth method roles are replicated, but the mount accessor of the auth method is unique per cluster. If an entity alias in the primary references the primary's auth mount accessor, that alias will not match the secondary's auth method when the user authenticates there. Consequently, the token is not associated with the entity, and policies attached to the entity (or its groups) are not applied. The role's policies are attached at token creation, but if the role itself has the policy, it should work. However, if the policy is attached via entity group, the alias mismatch causes failure.

Answer

The policy is not effective because the secret engine at 'secret/data/finance' is not replicated to the secondary.

Answer

The auth method role in the secondary is not associated with the correct policy because role configurations are not replicated.

Answer

The policy was created in the primary but not replicated to the secondary because policies are not replicated in Performance Replication.

Question 14

A Vault Enterprise operator uses Seal Wrap with a PKCS#11 HSM. During a disaster recovery drill, the operator needs to restore a snapshot to a new cluster that uses a different HSM with a different key. What must the operator do to ensure the restored data can be decrypted?

Accepted Answer

Export the seal wrap key from the original HSM and import it into the new HSM before restoring the snapshot.. Seal Wrap uses an HSM-backed key to encrypt Vault's critical security parameters. When migrating to a different HSM, the original key must be transferred to the new HSM to decrypt the wrapped data. Generating a new key, disabling Seal Wrap, or rekeying does not provide the necessary decryption capability.

Answer

Generate a new seal wrap key on the new HSM and update the seal stanza to reference it.

Answer

Disable Seal Wrap on the new cluster before restoring the snapshot.

Answer

Restore the snapshot and then rekey Vault using the new HSM's key.

Question 15

A Vault Enterprise administrator is deploying a new cluster that will use a PKCS#11 HSM for auto-unseal. The administrator must ensure the Vault process can communicate with the HSM and that the required cryptographic material is available. Which TWO configuration elements are required in the `seal` stanza for PKCS#11 auto-unseal? (Choose two.)

Accepted Answer

`lib` — the path to the PKCS#11 library on the host.. For PKCS#11 auto-unseal, Vault must load the vendor's PKCS#11 library and identify the specific HSM key to use. The `lib` parameter provides the library path, and `key_label` selects the key object. Other parameters like `slot`, `pin`, and `mechanism` are optional because Vault can discover slots, obtain PINs from environment variables, and default to standard mechanisms.

Answer

`pin` — the user PIN to authenticate to the HSM token.

Answer

`slot` — the numeric slot ID where the HSM token is inserted.

Answer

`mechanism` — the cryptographic mechanism Vault should use for wrapping.

Question 16

A Vault Enterprise cluster uses a PKCS#11 HSM for seal wrap and auto-unseal. The security team rotates the HSM partition PIN. Vault nodes are still running with the old PIN in their configuration files. What is the most likely operational impact?

Accepted Answer

Vault nodes will fail to unseal after a restart because they cannot authenticate to the HSM with the old PIN.. The PKCS#11 PIN is used to authenticate to the HSM partition whenever Vault needs to open a session, including during unseal. Rotating the PIN without updating Vault's seal configuration means the old PIN is rejected, so nodes cannot unseal after a restart. The correct remediation is to update the pin value in the seal stanza and restart Vault.

Answer

Vault will automatically fall back to Shamir unseal and prompt for unseal keys.

Answer

Vault continues to operate normally because the PIN is only used during initial unseal and is cached in memory.

Answer

Seal wrap operations will continue using the old PIN until the next key rotation, then fail.

Question 17

A security administrator is configuring a Vault Enterprise cluster with multiple namespaces. They need to ensure that a policy defined in the root namespace grants read access to a secrets engine mounted in a child namespace, but only when the request originates from a token that has an entity alias from a specific auth method in that child namespace. Which Vault feature should be used to enforce this conditional access?

Accepted Answer

Sentinel EGP (Endpoint Governing Policy) attached to the child namespace's secrets engine path.. Sentinel Endpoint Governing Policies (EGPs) are evaluated for each request to a specific endpoint or path. By attaching an EGP to the secrets engine path in the child namespace, you can enforce conditions on the request, such as requiring the token to have a specific entity alias from an auth method. This allows fine-grained, path-specific access control that cannot be achieved with standard ACL policies or role-based policies.

Answer

Sentinel RGP (Role Governing Policy) attached to the auth method's role in the child namespace.

Answer

A policy in the root namespace that uses the 'path' parameter with a wildcard to match the child namespace's secrets engine, combined with a condition on the entity alias.

Answer

Identity groups in the root namespace that include entities from the child namespace's auth method, with a policy attached that grants access to the child namespace's secrets engine.

Question 18

A Vault Enterprise administrator is configuring a secrets engine to use a root token for initial setup. After completing the setup, they revoke the root token. Later, they discover that a child token created from the root token still has access to the secrets engine. Why does this occur?

Accepted Answer

The child token was created with the 'orphan' flag, making it independent of the parent.. Orphan tokens are created without a parent and are not revoked when the creating token is revoked. This allows them to persist independently, which can be a security risk if not managed properly. In this scenario, the child token likely had the orphan flag set.

Answer

Child tokens are not automatically revoked when the parent token is revoked.

Answer

The child token was created with a longer TTL than the root token, so it outlives the parent.

Answer

The secrets engine was mounted with the 'delegated' option, granting persistent access.

Question 19

A Vault Enterprise administrator is configuring a new auth method for an application. The application runs on a server that has a fixed IP address. The security policy requires that the authentication token issued to the application be limited to a maximum of 10 uses and must be renewable up to a maximum TTL of 24 hours. Which combination of role parameters should be set to enforce these requirements?

Accepted Answer

token_num_uses=10, token_ttl=1h, and token_max_ttl=24h. To enforce a maximum of 10 uses, set token_num_uses=10. To allow renewal up to a maximum TTL of 24 hours, set token_ttl to a value less than 24h (e.g., 1h) and token_max_ttl to 24h. The token_ttl determines the initial lease duration and renewal increment, while token_max_ttl caps the total lifetime. This ensures the token can be renewed but not beyond 24 hours. Other options either omit token_max_ttl or use token_period, which allows indefinite renewal.

Answer

token_num_uses=10 and token_max_ttl=24h

Answer

token_num_uses=10 and token_ttl=24h

Answer

token_num_uses=10 and token_period=24h

Question 20

A Vault Enterprise cluster is configured with a performance replication secondary. An administrator creates a new namespace and a policy within that namespace on the primary cluster. The administrator then checks the secondary cluster and finds that the namespace and policy are not present. What is the most likely reason for this?

Accepted Answer

The namespace and policy were created in a mount that is not replicated to the secondary due to a replication filter.. In Vault Enterprise performance replication, replication filters can be used to selectively replicate data. If a filter is set to exclude certain namespaces or mounts, objects created there will not appear on the secondary. The other options are less likely: namespaces and policies are normally replicated, a failed state would be evident, and license discrepancies are rare in a functioning replication setup. Thus, a replication filter is the most probable cause.

Answer

The performance replication secondary is in a failed state and is not receiving updates from the primary.

Answer

Namespaces and policies are not replicated to performance secondary clusters; they must be created manually on each secondary.

Answer

The secondary cluster has a different license that does not support namespaces, so it cannot replicate them.