Vault Enterprise Monitoring Vault Environments — 15 Questions

Question 1

Which command is used to rotate the audit log file on a Vault server to ensure logs are written to a new file?

Accepted Answer

vault audit rotate. vault audit rotate is the specific command to instruct Vault to close the current audit log file and open a new one.

Answer

vault server reload

Answer

vault operator seal

Answer

vault log rotate

Question 2

An auditor notices that audit logs are missing entries for a specific mount point. What is the most likely cause?

Accepted Answer

The audit device is not enabled for the specific path prefix.. Vault audit devices can be enabled with a specific path prefix, meaning they only log requests to that path. If an auditor notices missing entries for a specific mount point, the most likely cause is that the audit device was not enabled for that path prefix. Audit devices are enabled globally or with a prefix filter, and if the prefix does not match the mount, events are not logged.

Answer

The audit device is in a blocked state.

Answer

Vault is running in dev mode.

Answer

The audit log rotation policy is set to delete logs immediately.

Question 3

You are configuring Vault to export telemetry to Prometheus. Which stanza must be added to the Vault configuration file to enable the metrics endpoint for scraping?

Accepted Answer

telemetry { disable_hostname = true }. The telemetry stanza is required to enable the metrics endpoint, which allows Prometheus to scrape data from Vault.

Answer

telemetry { prometheus_retention_time = "30s" }

Answer

telemetry { prometheus_retention_time = "24h" }

Answer

telemetry { prometheus_retention_time = "10s" }

Question 4

When reviewing Vault server logs, you see 'request_path' entries that are redacted. Why is this occurring?

Accepted Answer

The audit device is configured with 'log_raw=false'.. When an audit device is configured with log_raw=false (the default), Vault hashes sensitive values in the audit log, including request paths that may contain secrets (e.g., KV paths with secret data). This redaction is a security feature to prevent plaintext secrets from being written to audit logs. The request_path field is redacted because the path itself can contain sensitive information, and log_raw=false enforces HMAC-SHA256 hashing of these values.

Answer

Vault is in recovery mode.

Answer

You are not logged in as a root user.

Answer

The log level is set to 'info'.

Question 5

You are troubleshooting high CPU usage in Vault. Which telemetry metric category should you examine first?

Accepted Answer

vault.route.request. The vault.route.request metric measures the rate and latency of requests handled by Vault's routing layer, which sits in front of all secrets engines and auth methods. High CPU usage in Vault is most often caused by a surge in request volume or expensive request paths, so examining route-level request metrics first reveals whether the load is request-driven. This category aggregates request counts and timing across all paths, making it the fastest way to confirm a traffic-related CPU spike.

Answer

vault.core.token.create

Answer

vault.audit.request

Answer

vault.storage.read

Question 6

What is the purpose of the 'prometheus_retention_time' setting in the Vault telemetry stanza?

Accepted Answer

This setting is invalid and will be ignored by Vault.. 'prometheus_retention_time' is not a valid Vault telemetry stanza setting — Vault will ignore it. Prometheus retention is configured on the Prometheus server side (via --storage.tsdb.retention.time), not in Vault. Vault's telemetry stanza supports options like disable_hostname, usage_gauge_period, and prefix_filter, but not prometheus_retention_time.

Answer

To control the frequency of metric exports.

Answer

To define how long Vault keeps metrics in memory.

Answer

To tell Prometheus how long to store Vault's data.

Question 7

Which TWO of the following are valid telemetry sinks supported by Vault?

Accepted Answer

Prometheus. Vault's telemetry stanza supports several sink types, and Prometheus (D) is valid because Vault exposes metrics at the /v1/sys/metrics endpoint in Prometheus exposition format, which a Prometheus server can scrape. StatsD (E) is also valid because Vault natively supports the statsd telemetry sink type, sending UDP metrics to a StatsD-compatible agent using the configured address and prefix. Splunk (A), Nagios (B), and ELK Stack (C) are not built-in telemetry sink types in Vault; while their agents could ingest Vault metrics indirectly, Vault does not provide native sink configurations for them.

Answer

Splunk

Answer

Nagios

Answer

ELK Stack

Question 8

Which TWO of these are valid audit device types in Vault?

Accepted Answer

file. Option A (file) is correct because Vault's file audit device writes audit log entries to a file on disk, enabled via `vault audit enable file file_path=/var/log/vault_audit.log`, making it one of the standard built-in audit device types. Option B (syslog) is correct because Vault supports a syslog audit device that sends audit entries to the local syslog facility, enabled with `vault audit enable syslog`, and it is a documented built-in audit type. Option C (database) is not an audit device type; database secrets engines in Vault dynamically generate database credentials, which is unrelated to audit logging. Option D (socket) is not a valid Vault audit device type, even though audit logs can be forwarded externally, Vault does not expose a 'socket' audit device. Option E (stdout) is not a valid audit device type; Vault does not provide a stdout audit device, and audit output must be directed to supported devices such as file or syslog.

Answer

database

Answer

socket

Answer

stdout

Question 9

Which TWO configurations are required to effectively monitor Vault in a production environment?

Accepted Answer

Enabled telemetry endpoint.. Option B is correct because Vault's telemetry stanza must be enabled so the server exposes metrics (e.g., via Prometheus, StatsD, or syslog sinks) that monitoring systems can scrape to track performance, resource usage, and operational health in production. Option C is correct because enabling at least one audit device causes Vault to log every request and response (to file, syslog, or socket), which is essential for security monitoring, compliance, and detecting unauthorized or anomalous access. Option A is not required, since Vault handles log rotation natively and external cron-based rotation is not a monitoring prerequisite. Option D is a security hardening measure, not a monitoring configuration, and restricting the UI to local IPs would actually hinder remote monitoring. Option E is wrong because debug mode is a troubleshooting setting that increases log verbosity and should not be enabled on all production nodes.

Answer

Manual log rotation cron job.

Answer

UI access restricted to local IP only.

Answer

Debug mode enabled on all nodes.

Question 10

Which THREE pieces of information are captured in standard Vault audit logs for every request?

Accepted Answer

Requester identity.. Vault audit logs record the requester identity (Option A), which includes the token accessor, token type, and any authenticated entity or alias metadata, so operators can attribute each request to a principal. They also capture the request path (Option C), i.e., the API endpoint such as secret/data/foo or sys/health, which is essential for knowing what was accessed. Every audit entry includes a timestamp (Option D) in RFC3339 format, enabling chronological reconstruction of activity. Option B is wrong because CPU load is a host performance metric, not part of Vault's audit event schema. Option E is wrong because the client's IP address is not captured by default in standard Vault audit logs; it is only available if the client address is explicitly forwarded via X-Forwarded-For and logged through custom headers or request metadata, so it is not a standard field.

Answer

The server's CPU load at the time of request.

Answer

The client's IP address.

Question 11

A Vault Enterprise cluster is configured with three performance standby nodes and one active node. The operations team wants to monitor the total number of active client tokens across the entire cluster, including tokens issued by performance standbys. Which metric should they query from the active node's telemetry endpoint to obtain this cluster-wide count?

Accepted Answer

vault.token.count. The active node in a Vault Enterprise cluster aggregates token counts from all nodes, including performance standbys, and exposes the total through the vault.token.count metric. Performance standbys forward token creation and revocation events to the active node, ensuring the active node's count is authoritative. Querying this metric provides the cluster-wide total needed for capacity planning and client token monitoring.

Answer

vault.standby.token.count

Answer

vault.core.active_token_count

Answer

vault.identity.num_entities

Question 12

A Vault Enterprise operator needs to monitor the health of the integrated storage (Raft) backend. The cluster has five nodes, and the operator wants to detect when the Raft leader loses quorum or when a follower falls too far behind. Which TWO metrics should the operator alert on to detect these conditions? (Choose two.)

Accepted Answer

vault.raft.peers. To detect quorum loss or followers falling behind in a Raft cluster, the most direct metrics are vault.raft.peers, which shows the current number of peers and drops if a node leaves, and vault.raft.leader.lastContact, which increases when the leader cannot reach a follower. Together, these metrics provide early warning of quorum threats and replication lag, enabling operators to respond before the cluster becomes unavailable.

Answer

vault.raft.commitTime

Answer

vault.raft.storage.snapshot.size

Answer

vault.raft.storage.log.entries

Question 13

A Vault Enterprise operator notices that a particular mount's audit log entries are no longer being written to the configured file audit device. The audit device is enabled and healthy, and other mounts are logging normally. Which audit configuration feature should the operator verify to ensure that this specific mount's requests are being audited?

Accepted Answer

The 'audit' mount option set to 'false' on the specific secrets engine.. Vault supports per-mount audit configuration through the 'audit' option. When a secrets engine is enabled or tuned with 'audit=false', its requests bypass all enabled audit devices. This allows selective auditing. The operator should inspect the mount's tuning parameters to verify this setting, as it precisely explains why only that mount's entries are missing while others are logged.

Answer

The 'hmac_accessor' setting in the audit device stanza.

Answer

The 'audit_non_hmac_response_keys' parameter in the audit device configuration.

Answer

The 'log_raw' option in the audit device configuration.

Question 14

A Vault Enterprise administrator needs to monitor the number of active tokens in the cluster to ensure they do not exceed the licensed limit. Which telemetry metric should the administrator alert on to track this?

Accepted Answer

vault_token_create. Vault does not expose a direct gauge for active tokens, but the 'vault_token_create' counter tracks token creation events. By monitoring the rate of token creation and comparing it with token revocation rates, administrators can estimate active token counts. This approach helps in alerting when token usage approaches licensed limits. Other metrics like lease count include tokens but are not token-specific, making them less precise for this purpose.

Answer

vault_token_count

Answer

vault_core_unseal

Answer

vault_lease_count

Question 15

A Vault Enterprise operator monitors a three-node integrated storage (Raft) cluster. They need to receive an alert when any follower node falls more than 100 log entries behind the leader. Which configuration should be used to collect this information?

Accepted Answer

Use the /v1/sys/storage/raft/autopilot/state endpoint and alert on the last_index difference between the leader and each follower.. The Raft autopilot state endpoint is the authoritative source for per-node replication details, including the last log index. Comparing the leader's last_index against each follower's last_index yields the exact lag in entries, enabling a precise alert threshold. Other endpoints and metrics either measure unrelated timing, expose only seal status, or do not emit replication indexes.

Answer

Enable the Prometheus telemetry endpoint and create an alert on the raft_apply metric.

Answer

Enable the syslog audit device on each node and alert on entries containing 'raft' with a log level of WARN.

Answer

Query the /v1/sys/health endpoint and alert if any node reports sealed.