Vault Enterprise Hsm Integration Practice Test 2 — 15 Questions

Question 1

A Vault Enterprise cluster uses PKCS#11 auto-unseal with an HSM. The security team requires that all Vault data be protected by the HSM even when Vault is unsealed. They enable `seal_wrap = true` in the seal stanza. After a restart, Vault fails to start, and the logs show errors related to seal wrapping. Which two actions should the operator take to resolve the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the HSM key specified in the seal stanza has the CKA_WRAP and CKA_UNWRAP attributes set to true.. Seal wrapping requires the HSM to support key wrapping mechanisms and the key to have CKA_WRAP and CKA_UNWRAP attributes enabled. Without these, Vault cannot perform the necessary cryptographic operations and fails to start. Operators must verify HSM capabilities and key attributes. Disabling seal wrapping or altering unrelated parameters does not address the root cause and would compromise the security requirement.

Answer

Disable `seal_wrap` and rely solely on auto-unseal, because seal wrapping is not supported with PKCS#11 HSMs.

Answer

Increase the `hmac_key_label` parameter in the seal stanza to a longer value to accommodate seal wrapping metadata.

Answer

Set `disable_sealwrap = true` in the Vault server configuration to bypass seal wrapping for system paths.

Question 2

A Vault Enterprise administrator is configuring a new Vault cluster to use a PKCS#11 HSM for auto-unseal. The administrator wants to ensure that if the HSM becomes unavailable, Vault can still be unsealed using recovery keys. Which Vault feature must be enabled during initialization to allow this?

Accepted Answer

Recovery keys. When Vault is initialized with auto-unseal, recovery keys are generated instead of unseal keys. These recovery keys can be used to unseal Vault if the HSM is unavailable, and they are also required for certain privileged operations. Enabling recovery keys during initialization (by setting recovery shares and threshold) is essential for disaster recovery when the HSM cannot be reached. Other features like seal wrapping or Shamir shares do not provide this fallback capability.

Answer

Auto-unseal with multiple HSM slots

Answer

Shamir's Secret Sharing

Answer

Seal wrapping

Question 3

A Vault Enterprise cluster uses a PKCS#11 HSM for auto-unseal and Seal Wrap. During a planned HSM firmware upgrade, the HSM vendor tells the administrator that the existing wrapping key must be destroyed and a new one generated. What must the administrator do to keep Vault operational?

Accepted Answer

Run `vault operator rewrap` to migrate existing Seal Wrap data to the new HSM wrapping key, then restart the Vault nodes.. Seal Wrap protects sensitive values by encrypting them with an HSM-backed wrapping key. When the HSM wrapping key is rotated, existing seal-wrapped data must be migrated before the old key is destroyed. The `vault operator rewrap` command performs this migration by decrypting with the old key and re-encrypting with the new key. A rekey or configuration reload does not transform existing Seal Wrap data.

Answer

Take a snapshot of Vault storage, restore it after the HSM upgrade, and let Vault re-establish the wrapping key automatically.

Answer

Rewrap all seal-wrapped data by running `vault operator rekey -target=recovery` and then restart the Vault nodes.

Answer

Update the `seal` stanza in the Vault configuration to point to the new HSM key label and reload Vault with SIGHUP.

Question 4

A Vault Enterprise administrator is deploying a new cluster that will use a PKCS#11 HSM for auto-unseal. The administrator must ensure the Vault process can communicate with the HSM and that the required cryptographic material is available. Which TWO configuration elements are required in the `seal` stanza for PKCS#11 auto-unseal? (Choose two.)

Accepted Answer

`lib` — the path to the PKCS#11 library on the host.. For PKCS#11 auto-unseal, Vault must load the vendor's PKCS#11 library and identify the specific HSM key to use. The `lib` parameter provides the library path, and `key_label` selects the key object. Other parameters like `slot`, `pin`, and `mechanism` are optional because Vault can discover slots, obtain PINs from environment variables, and default to standard mechanisms.

Answer

`pin` — the user PIN to authenticate to the HSM token.

Answer

`slot` — the numeric slot ID where the HSM token is inserted.

Answer

`mechanism` — the cryptographic mechanism Vault should use for wrapping.

Question 5

A Vault Enterprise operator uses Seal Wrap with a PKCS#11 HSM. During a disaster recovery drill, the operator needs to restore a snapshot to a new cluster that uses a different HSM with a different key. What must the operator do to ensure the restored data can be decrypted?

Accepted Answer

Export the seal wrap key from the original HSM and import it into the new HSM before restoring the snapshot.. Seal Wrap uses an HSM-backed key to encrypt Vault's critical security parameters. When migrating to a different HSM, the original key must be transferred to the new HSM to decrypt the wrapped data. Generating a new key, disabling Seal Wrap, or rekeying does not provide the necessary decryption capability.

Answer

Generate a new seal wrap key on the new HSM and update the seal stanza to reference it.

Answer

Disable Seal Wrap on the new cluster before restoring the snapshot.

Answer

Restore the snapshot and then rekey Vault using the new HSM's key.

Question 6

A Vault Enterprise cluster is configured with a PKCS#11 HSM for auto-unseal. The security team requires that all Vault nodes authenticate to the HSM using a PIN that is not stored in the Vault configuration file. Which method should the administrator use to supply the PIN securely?

Accepted Answer

Set the `VAULT_HSM_PIN` environment variable before starting the Vault process.. Vault supports supplying the PKCS#11 PIN via the `VAULT_HSM_PIN` environment variable, which allows secrets managers or orchestration tools to inject it at runtime. This avoids storing the PIN in the configuration file. There is no `pin_file` parameter or `VAULT_HSM_PIN_PATH` variable, and embedding the PIN in the configuration, even if encrypted externally, does not meet the requirement.

Answer

Use the `VAULT_HSM_PIN_PATH` environment variable to point to a file containing the PIN.

Answer

Embed the PIN in the `pin` field of the seal stanza but encrypt the configuration file with Vault's own encryption.

Answer

Store the PIN in a file and reference it using the `pin_file` parameter in the seal stanza.

Question 7

Your Vault Enterprise cluster uses a PKCS#11 HSM for auto-unseal. During a maintenance window, the HSM vendor requires you to change the HSM partition password. Vault nodes are currently unsealed and serving traffic. What is the correct operational sequence to update Vault so it continues to auto-unseal after the HSM restart?

Accepted Answer

Update the PIN in the seal stanza on all nodes using the API or config file, change the password on the HSM, then restart Vault nodes one at a time.. The PIN used for PKCS#11 login is part of Vault's seal configuration. To avoid a window where Vault presents an old PIN to an HSM that now expects a new one, you must update the seal stanza on all nodes first, then change the HSM password, then restart nodes in a rolling manner. This preserves availability and ensures auto-unseal continues to function.

Answer

Perform a seal migration to Shamir, change the HSM password, then reconfigure the seal stanza with the new PIN and migrate back to PKCS#11.

Answer

Update the HSM partition password directly on the HSM, then restart each Vault node one at a time without changing Vault configuration.

Answer

Update the PIN in the seal stanza configuration on each node, restart the HSM with the new password, then restart Vault nodes in a rolling fashion.

Question 8

You are enabling seal wrap on a Vault Enterprise cluster that uses a PKCS#11 HSM. You want to verify that the seal wrap feature is active and that the HSM is being used for cryptographic operations. Which Vault command provides the seal status, including whether seal wrap is enabled?

Accepted Answer

vault status. The vault status command reports the seal type, seal status, and whether seal wrap is enabled. In a PKCS#11 HSM deployment, the output will show pkcs11 as the seal type and indicate seal wrap status. This is the correct way to verify that the HSM is integrated and seal wrap is active.

Answer

vault read sys/seal-status

Answer

vault operator diagnose

Answer

vault operator seal status

Question 9

You are configuring a Vault Enterprise cluster to use a PKCS#11 HSM for auto-unseal. Which two parameters are required in the seal stanza to allow Vault to locate and authenticate to the HSM? (Choose two.)

Accepted Answer

lib. To use a PKCS#11 HSM for auto-unseal, Vault must load the vendor's shared library and authenticate to the token. The lib parameter specifies the library path, and pin provides the authentication credential. While token_label or slot may be needed to select the correct token, they are not both required in the same way; lib and pin are the fundamental required parameters.

Answer

slot

Answer

key_label

Answer

token_label

Question 10

A Vault Enterprise cluster uses a PKCS#11 HSM for auto-unseal with Seal Wrap enabled. During a disaster recovery test, the operator needs to restore a snapshot to a new cluster that will use a different HSM partition. Which statement describes the correct approach?

Accepted Answer

Use the original HSM to unseal the restored cluster, then perform a seal migration to the new HSM partition using vault operator unseal -migrate.. Restoring a snapshot to a cluster with a different HSM partition requires access to the original wrapping key. The supported method is to unseal the restored cluster with the original HSM, then perform a seal migration to the new PKCS#11 configuration. This rewraps the barrier key and preserves data without reinitializing or exporting non-exportable HSM keys.

Answer

Reinitialize the new cluster with vault operator init and then import the snapshot using vault operator migrate.

Answer

Restore the snapshot directly to the new cluster; Vault will automatically rewrap the barrier key with the new HSM partition.

Answer

Copy the HSM wrapping key from the original partition to the new partition using the HSM vendor's key export utility.

Question 11

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

Accepted Answer

The library must be PKCS#11 compliant.. Vault's PKCS#11 auto-unseal mechanism relies on dynamically loading a vendor-supplied PKCS#11 shared library (e.g., libsofthsm2.so, libcloudhsm.so) at runtime via the seal "pkcs11" stanza. The only hard requirement is that the library implements the OASIS PKCS#11 (Cryptoki) API so Vault can call standard functions like C_Initialize, C_Login, C_Encrypt, and C_Decrypt against the HSM. Compliance with the PKCS#11 spec guarantees the expected function signatures and slot/token semantics are present, which is what Vault's seal code depends on.

Answer

The library must be statically linked into the Vault binary.

Answer

The library must be written in Go.

Answer

The library must support the KMIP protocol.

Question 12

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

Accepted Answer

Only keys created or rotated after the configuration change will be wrapped by the HSM.. When Seal Wrap is enabled with an HSM, Vault does not automatically re-wrap existing keys. Only keys created or rotated after the configuration change will be wrapped by the HSM. Existing keys remain wrapped with the previous mechanism until they are rotated or re-wrapped manually. This is the correct behavior for transit engine keys.

Answer

The transit engine is disabled until the 're-wrap' command is issued.

Answer

Vault automatically re-wraps all existing keys upon service startup.

Answer

Vault will return an error until all transit keys are manually deleted.

Question 13

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

Accepted Answer

It allows Vault to unseal without manual intervention.. HSM Auto-Unseal delegates the unseal operation to a hardware security module (or a cloud KMS acting as one) that holds the master key. When Vault starts, it sends the encrypted master key to the HSM for decryption, allowing the node to unseal automatically without an operator supplying unseal keys. This eliminates manual unseal ceremonies after restarts and enables fully automated cluster recovery.

Answer

It provides backup redundancy for the Vault data.

Answer

It replaces the need for TLS encryption.

Answer

It increases the throughput of the storage backend.

Question 14

When configuring the PKCS#11 library, how does Vault find the library on the host OS?

Accepted Answer

The path is provided in the 'lib' field of the seal configuration.. When configuring Vault's PKCS#11 auto-unseal, the seal stanza requires a lib field that contains the absolute path to the PKCS#11 shared library (for example, /usr/lib/libsofthsm2.so) on the host OS. Vault loads that library at startup via dlopen using the exact path supplied, so the path must be explicitly declared in the configuration rather than inferred from the environment. This makes the seal configuration the single source of truth for locating the HSM vendor's PKCS#11 module.

Answer

The path is defined in the Vault environment variables.

Answer

Vault expects the library to be located in '/usr/lib/vault'.

Answer

Vault looks in the LD_LIBRARY_PATH environment variable by default.

Question 15

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

Accepted Answer

Vault requires a manual update to the seal configuration and a restart.. Vault does not automatically failover to a secondary HSM; when the primary HSM becomes unavailable, Vault loses its seal and will not function until the seal is restored. To use a secondary HSM, an operator must manually update the seal configuration to point to the secondary HSM and then restart Vault. This manual intervention is required because the seal configuration is static and Vault does not support automatic HSM failover.

Answer

Vault waits until the primary HSM is back online.

Answer

Vault automatically detects the secondary HSM and switches over.

Answer

Vault fails over to Shamir's Secret Sharing mode.