Vault Enterprise Monitoring Vault Environments — 20 Questions

Question 1

You are configuring Vault to export telemetry to Prometheus. Which stanza must be added to the Vault configuration file to enable the metrics endpoint for scraping?

Accepted Answer

telemetry { disable_hostname = true }. The telemetry stanza is required to enable the metrics endpoint, which allows Prometheus to scrape data from Vault.

Answer

telemetry { prometheus_retention_time = "30s" }

Answer

telemetry { prometheus_retention_time = "24h" }

Answer

telemetry { prometheus_retention_time = "10s" }

Question 2

How can you view the currently enabled audit devices in a Vault cluster?

Accepted Answer

vault audit list. The 'vault audit list' command displays all currently enabled audit devices and their configuration paths.

Answer

vault read sys/audit

Answer

vault list audit/devices

Answer

vault status -audit

Question 3

Which command is used to rotate the audit log file on a Vault server to ensure logs are written to a new file?

Accepted Answer

vault audit rotate. vault audit rotate is the specific command to instruct Vault to close the current audit log file and open a new one.

Answer

vault server reload

Answer

vault operator seal

Answer

vault log rotate

Question 4

An auditor notices that audit logs are missing entries for a specific mount point. What is the most likely cause?

Accepted Answer

The audit device is not enabled for the specific path prefix.. Audit devices must be enabled separately, and if a path is not covered by an enabled audit device, activity will not be recorded.

Answer

The audit device is in a blocked state.

Answer

Vault is running in dev mode.

Answer

The audit log rotation policy is set to delete logs immediately.

Question 5

You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?

Accepted Answer

All incoming requests will be rejected until the audit device is restored.. Vault is designed to fail-closed regarding audit logs. If the audit device fails, requests are blocked to prevent un-audited operations.

Answer

Vault automatically switches to the secondary audit device.

Answer

Requests are permitted for read-only operations.

Answer

All requests are allowed but a warning is logged.

Question 6

To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?

Accepted Answer

/sys/health. The /sys/health endpoint provides information about the initialization status, standby status, and overall health of the Vault node.

Answer

/sys/leader

Answer

/sys/metrics

Answer

/sys/monitor

Question 7

Which telemetry type is most effective for monitoring the 'lease' count in Vault?

Accepted Answer

Gauges. Gauges are used to track values that can increase or decrease, such as the current number of active leases.

Answer

Summaries

Answer

Histograms

Answer

Counters

Question 8

You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?

Accepted Answer

The storage backend is struggling with high frequency read/write operations.. High latency in fetch_token metrics usually indicates database or storage backend contention during token creation or lookup processes.

Answer

The audit file device is too slow.

Answer

The request buffer is full.

Answer

Vault is misconfigured for high availability.

Question 9

Where are audit logs physically stored if the 'file' audit device is configured?

Accepted Answer

In the local filesystem at the configured path.. The 'file' audit device writes entries to a specified file path provided in the configuration.

Answer

In standard system syslog.

Answer

In the storage backend database.

Answer

In Vault's memory buffer.

Question 10

What does the 'vault_core_seal_setup_duration' metric represent?

Accepted Answer

The duration of the unseal process.. This metric measures the time taken for Vault to perform the seal setup process during initialization or unsealing.

Answer

The time taken to initialize the storage backend.

Answer

The time between audit log rotations.

Answer

The time spent waiting for a lease to expire.

Question 11

When reviewing Vault server logs, you see 'request_path' entries that are redacted. Why is this occurring?

Accepted Answer

The audit device is configured with 'log_raw=false'.. By default, audit logs redact sensitive information if the audit device is not configured to include sensitive payloads, or if the request contains sensitive parameters.

Answer

Vault is in recovery mode.

Answer

You are not logged in as a root user.

Answer

The log level is set to 'info'.

Question 12

You are troubleshooting high CPU usage in Vault. Which telemetry metric category should you examine first?

Accepted Answer

vault.route.request. Request handling metrics allow you to see if specific paths or operations are causing high demand on the CPU.

Answer

vault.core.token.create

Answer

vault.audit.request

Answer

vault.storage.read

Question 13

What is the purpose of the 'prometheus_retention_time' setting in the Vault telemetry stanza?

Accepted Answer

This setting is invalid and will be ignored by Vault.. This setting does not exist in the telemetry stanza; it is a distractor. Monitoring retention is handled by the Prometheus server, not Vault itself.

Answer

To control the frequency of metric exports.

Answer

To define how long Vault keeps metrics in memory.

Answer

To tell Prometheus how long to store Vault's data.

Question 14

You want to prevent audit logs from being written to a specific device if the disk is full. What happens to Vault?

Accepted Answer

Vault enters a blocked state for all client requests.. If a configured audit device cannot write, Vault blocks requests until the device is removed or restored, adhering to the fail-closed design.

Answer

Vault switches to a secondary file automatically.

Answer

Vault stops recording logs but continues operation.

Answer

Vault deletes the oldest logs to make room.

Question 15

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

Accepted Answer

The server logs.. The server logs will provide specific information about cluster synchronization and leader election status.

Answer

The telemetry metrics.

Answer

The storage backend logs.

Answer

The audit logs.

Question 16

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

Accepted Answer

debug. The 'debug' log level provides the most verbosity, which is useful for diagnosing complex startup or configuration errors.

Answer

warn

Answer

error

Answer

info

Question 17

Which TWO of the following are valid telemetry sinks supported by Vault?

Accepted Answer

Prometheus. Vault supports multiple telemetry sinks including StatsD and Prometheus.

Answer

Splunk

Answer

Nagios

Answer

ELK Stack

Question 18

Which tool is commonly used to view Vault metrics in a graphical format?

Accepted Answer

Grafana. Grafana is the standard tool used to visualize Prometheus metrics, which Vault exports.

Answer

Vault Audit Viewer

Answer

Vault UI

Answer

Logstash

Question 19

Which THREE types of metrics are collected by Vault's telemetry system?

Accepted Answer

Storage backend performance.. Vault telemetry includes metrics for request performance, storage backend status, and internal core operations.

Answer

Audit file size.

Answer

User password history.

Question 20

Which TWO of these are valid audit device types in Vault?

Accepted Answer

file. Vault supports 'file' and 'syslog' audit devices as standard options.

Answer

database

Answer

socket

Answer

stdout