Vault Enterprise Monitoring Vault Environments — 10 Questions

Question 1

Which command is used to rotate the audit log file on a Vault server to ensure logs are written to a new file?

Accepted Answer

vault audit rotate. vault audit rotate is the specific command to instruct Vault to close the current audit log file and open a new one.

Answer

vault server reload

Answer

vault operator seal

Answer

vault log rotate

Question 2

An auditor notices that audit logs are missing entries for a specific mount point. What is the most likely cause?

Accepted Answer

The audit device is not enabled for the specific path prefix.. Vault audit devices can be enabled with a specific path prefix, meaning they only log requests to that path. If an auditor notices missing entries for a specific mount point, the most likely cause is that the audit device was not enabled for that path prefix. Audit devices are enabled globally or with a prefix filter, and if the prefix does not match the mount, events are not logged.

Answer

The audit device is in a blocked state.

Answer

Vault is running in dev mode.

Answer

The audit log rotation policy is set to delete logs immediately.

Question 3

You are configuring Vault to export telemetry to Prometheus. Which stanza must be added to the Vault configuration file to enable the metrics endpoint for scraping?

Accepted Answer

telemetry { disable_hostname = true }. The telemetry stanza is required to enable the metrics endpoint, which allows Prometheus to scrape data from Vault.

Answer

telemetry { prometheus_retention_time = "30s" }

Answer

telemetry { prometheus_retention_time = "24h" }

Answer

telemetry { prometheus_retention_time = "10s" }

Question 4

When reviewing Vault server logs, you see 'request_path' entries that are redacted. Why is this occurring?

Accepted Answer

The audit device is configured with 'log_raw=false'.. When an audit device is configured with log_raw=false (the default), Vault hashes sensitive values in the audit log, including request paths that may contain secrets (e.g., KV paths with secret data). This redaction is a security feature to prevent plaintext secrets from being written to audit logs. The request_path field is redacted because the path itself can contain sensitive information, and log_raw=false enforces HMAC-SHA256 hashing of these values.

Answer

Vault is in recovery mode.

Answer

You are not logged in as a root user.

Answer

The log level is set to 'info'.

Question 5

You are troubleshooting high CPU usage in Vault. Which telemetry metric category should you examine first?

Accepted Answer

vault.route.request. The vault.route.request metric measures the rate and latency of requests handled by Vault's routing layer, which sits in front of all secrets engines and auth methods. High CPU usage in Vault is most often caused by a surge in request volume or expensive request paths, so examining route-level request metrics first reveals whether the load is request-driven. This category aggregates request counts and timing across all paths, making it the fastest way to confirm a traffic-related CPU spike.

Answer

vault.core.token.create

Answer

vault.audit.request

Answer

vault.storage.read

Question 6

What is the purpose of the 'prometheus_retention_time' setting in the Vault telemetry stanza?

Accepted Answer

This setting is invalid and will be ignored by Vault.. 'prometheus_retention_time' is not a valid Vault telemetry stanza setting — Vault will ignore it. Prometheus retention is configured on the Prometheus server side (via --storage.tsdb.retention.time), not in Vault. Vault's telemetry stanza supports options like disable_hostname, usage_gauge_period, and prefix_filter, but not prometheus_retention_time.

Answer

To control the frequency of metric exports.

Answer

To define how long Vault keeps metrics in memory.

Answer

To tell Prometheus how long to store Vault's data.

Question 7

Which TWO of the following are valid telemetry sinks supported by Vault?

Accepted Answer

Prometheus. Vault's telemetry stanza supports several sink types, and Prometheus (D) is valid because Vault exposes metrics at the /v1/sys/metrics endpoint in Prometheus exposition format, which a Prometheus server can scrape. StatsD (E) is also valid because Vault natively supports the statsd telemetry sink type, sending UDP metrics to a StatsD-compatible agent using the configured address and prefix. Splunk (A), Nagios (B), and ELK Stack (C) are not built-in telemetry sink types in Vault; while their agents could ingest Vault metrics indirectly, Vault does not provide native sink configurations for them.

Answer

Splunk

Answer

Nagios

Answer

ELK Stack

Question 8

Which TWO of these are valid audit device types in Vault?

Accepted Answer

file. Option A (file) is correct because Vault's file audit device writes audit log entries to a file on disk, enabled via `vault audit enable file file_path=/var/log/vault_audit.log`, making it one of the standard built-in audit device types. Option B (syslog) is correct because Vault supports a syslog audit device that sends audit entries to the local syslog facility, enabled with `vault audit enable syslog`, and it is a documented built-in audit type. Option C (database) is not an audit device type; database secrets engines in Vault dynamically generate database credentials, which is unrelated to audit logging. Option D (socket) is not a valid Vault audit device type, even though audit logs can be forwarded externally, Vault does not expose a 'socket' audit device. Option E (stdout) is not a valid audit device type; Vault does not provide a stdout audit device, and audit output must be directed to supported devices such as file or syslog.

Answer

database

Answer

socket

Answer

stdout

Question 9

Which TWO configurations are required to effectively monitor Vault in a production environment?

Accepted Answer

Enabled telemetry endpoint.. Option B is correct because Vault's telemetry stanza must be enabled so the server exposes metrics (e.g., via Prometheus, StatsD, or syslog sinks) that monitoring systems can scrape to track performance, resource usage, and operational health in production. Option C is correct because enabling at least one audit device causes Vault to log every request and response (to file, syslog, or socket), which is essential for security monitoring, compliance, and detecting unauthorized or anomalous access. Option A is not required, since Vault handles log rotation natively and external cron-based rotation is not a monitoring prerequisite. Option D is a security hardening measure, not a monitoring configuration, and restricting the UI to local IPs would actually hinder remote monitoring. Option E is wrong because debug mode is a troubleshooting setting that increases log verbosity and should not be enabled on all production nodes.

Answer

Manual log rotation cron job.

Answer

UI access restricted to local IP only.

Answer

Debug mode enabled on all nodes.

Question 10

Which THREE pieces of information are captured in standard Vault audit logs for every request?

Accepted Answer

Requester identity.. Vault audit logs record the requester identity (Option A), which includes the token accessor, token type, and any authenticated entity or alias metadata, so operators can attribute each request to a principal. They also capture the request path (Option C), i.e., the API endpoint such as secret/data/foo or sys/health, which is essential for knowing what was accessed. Every audit entry includes a timestamp (Option D) in RFC3339 format, enabling chronological reconstruction of activity. Option B is wrong because CPU load is a host performance metric, not part of Vault's audit event schema. Option E is wrong because the client's IP address is not captured by default in standard Vault audit logs; it is only available if the client address is explicitly forwarded via X-Forwarded-For and logged through custom headers or request metadata, so it is not a standard field.

Answer

The server's CPU load at the time of request.

Answer

The client's IP address.