Vault Enterprise Monitoring Vault Environments Practice Test 2 — 15 Questions

Question 1

A Vault Enterprise operator is configuring a Prometheus server to scrape metrics from a Vault cluster. The operator wants to ensure that the metrics endpoint is secured with TLS and requires authentication. Which configuration steps must be taken to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set 'unauthenticated_metrics_access' to false and configure Vault to listen on HTTPS with a valid certificate.. To secure the Prometheus metrics endpoint with TLS and authentication, the operator must disable unauthenticated access by setting 'unauthenticated_metrics_access' to false, which forces clients to present a valid Vault token. Additionally, Vault's listener must be configured with TLS certificates to encrypt traffic. These two measures together ensure that metrics are only accessible over HTTPS with proper authentication, aligning with security best practices.

Answer

Configure the 'telemetry' stanza with 'prometheus_retention_time' and enable 'unauthenticated_metrics_access'.

Answer

Use the 'vault operator diagnose' command to enable TLS and authentication for the metrics endpoint.

Answer

Enable the 'prometheus' telemetry stanza and set 'disable_hostname' to true.

Question 2

A Vault Enterprise administrator needs to monitor the number of active tokens and their lease durations to ensure compliance with internal policies. Which telemetry metric should the administrator use to track the total number of unexpired tokens?

Accepted Answer

vault.token.count. To monitor the total number of unexpired tokens, the correct metric is `vault.token.count`. This metric is specifically designed to report the count of active tokens, enabling administrators to track token usage and enforce policies. Other metrics like `vault.expire.num_leases` cover all leases, not just tokens, and `vault.identity.num_entities` counts entities rather than tokens. The metric `vault.core.active_tokens` does not exist. Thus, `vault.token.count` is the accurate choice for this scenario.

Answer

vault.core.active_tokens

Answer

vault.expire.num_leases

Answer

vault.identity.num_entities

Question 3

A platform team must prove to auditors that every Vault Enterprise request is durably recorded, and that a compromised operator cannot silently disable logging. They plan to enable audit devices across a three-node cluster. Which TWO configuration choices support tamper-resistant, cluster-wide audit coverage? (Choose two.)

Accepted Answer

Enable a syslog audit device on each node via the local configuration file so it is re-enabled automatically after restarts.. Tamper resistance comes from declaring audit devices in the server configuration file, because those devices are enabled at startup and cannot be removed via the sys/audit API. Pairing that with per-node enablement, or with a single durable device on the active node that receives forwarded requests, yields coverage that survives restarts and resists token-based tampering. Plaintext key settings and remote shipping address data exposure and delivery, not immutability.

Answer

Enable the audit device with the API using a root token, then delete the root token to make the device permanent.

Answer

Configure the audit device to write to a remote syslog target over TCP so entries are shipped off-host immediately.

Answer

Set audit_non_hmac_request_keys to include all parameters so request bodies can be replayed for forensic review.

Question 4

An operator investigating intermittent 503 responses notices that the active node's vault.core.handle_request service time spikes whenever a particular secrets engine is queried, yet CPU and memory remain flat. They want to isolate which mount is responsible using only Vault's built-in telemetry. Which approach best identifies the offending mount?

Accepted Answer

Inspect the vault.core.handle_request service time along with per-path request counters in the audit log, or use the /v1/sys/metrics endpoint filtered by the secrets engine's request counters.. Vault's core request metrics are aggregated, so isolating a slow mount requires correlating timing spikes with the request paths and timestamps captured in the audit log, or filtering engine-specific counters from the metrics endpoint. Both are supported built-in mechanisms. The health endpoint reports topology, and no per-mount telemetry toggle exists, so those paths cannot attribute latency to a specific secrets engine.

Answer

Enable the audit device's log_raw option and parse the request paths from the audit log to correlate latency.

Answer

Query the /v1/sys/health endpoint of each node and compare the returned performance_standby and replication_dr fields to identify the slow mount.

Answer

Enable per-mount metrics by configuring the mount with the appropriate telemetry option, then compare vault.secrets.kv or engine-specific latency series across mounts.

Question 5

A Vault Enterprise operator is reviewing telemetry metrics to identify potential performance bottlenecks. The operator observes high values for certain metrics related to storage and request handling. Which TWO metrics should the operator examine to diagnose storage backend latency and request processing time? (Choose two.)

Accepted Answer

vault.storage.get. To diagnose storage backend latency and request processing time, the operator should examine `vault.storage.get` and `vault.core.handle_request`. The former measures storage read latency, while the latter measures overall request handling time. These metrics provide direct insight into the performance of the storage backend and the core request path. Other metrics like `vault.barrier.get` are lower-level, `vault.raft.leader.lastContact` is Raft-specific, and `vault.rollback.attempt` counts events rather than measuring time.

Answer

vault.barrier.get

Answer

vault.raft.leader.lastContact

Answer

vault.rollback.attempt

Question 6

An operator manages a Vault Enterprise cluster integrated with a Prometheus monitoring stack. They need to ensure that Vault exposes a metric that counts the total number of requests handled by each audit device, as they suspect one device is lagging. After enabling telemetry, which metric should they query to observe the cumulative request count per audit device?

Accepted Answer

vault.audit.device.request. The metric vault.audit.device.request specifically counts requests handled by each audit device, labeled by device path. It is the correct choice for monitoring per-device audit request volume. Other options are either non-existent metrics or unrelated to audit device request counting. This metric helps identify performance issues such as a lagging audit device.

Answer

vault.audit.log_raw

Answer

vault.audit.response

Answer

vault.audit.log_request

Question 7

An operator needs to monitor the health of a Vault Enterprise cluster's integrated storage (Raft) backend. They want to track the number of committed entries in the Raft log to ensure the cluster is making progress. Which metric should they use?

Accepted Answer

vault.raft.commit_num. The metric vault.raft.commit_num tracks the number of committed entries in the Raft log. It is the correct choice for monitoring Raft progress and cluster health. Other options are either non-existent or misnamed. This metric is essential for ensuring the integrated storage backend is functioning properly in Vault Enterprise.

Answer

vault.raft.commit_index

Answer

vault.raft.last_index

Answer

vault.raft.applied_index

Question 8

A Vault Enterprise operator is configuring a Prometheus server to scrape metrics from a Vault cluster. The operator wants to ensure that the metrics endpoint is secured with TLS and requires authentication. Which configuration steps must be taken to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The client's IP address and port. The client's IP address and port, and the full request path and operation, are always included in Vault audit log entries. These fields are fundamental for tracing requests and understanding what actions were attempted. Other options either contain sensitive data that is hashed, are not always present, or are not standard fields. These two pieces are critical for security incident analysis.

Answer

The response time in milliseconds

Answer

The identity of the authenticated entity

Answer

The user's password or secret payload

Question 9

A Vault Enterprise operator is configuring a Prometheus server to scrape metrics from a Vault cluster. The operator wants to ensure that the metrics endpoint is secured with TLS and requires authentication. Which configuration steps must be taken to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vault.core.handle_request_failure and vault.core.handle_request. The metrics vault.core.handle_request_failure and vault.core.handle_request are both relevant for monitoring permission denied errors. handle_request_failure increments on any failed request, including authorization failures, while handle_request provides the total request count for calculating failure rates. Together they offer a high-level view, though audit logs are needed for precise identification of permission denied events.

Answer

vault.audit.log_response_failure

Answer

vault.core.handle_login_request

Answer

vault.core.handle_request

Question 10

A Vault Enterprise administrator needs to ensure that audit logs are not lost if the primary audit device becomes unavailable. They want Vault to continue operating and log to a secondary device. Which configuration should be applied?

Accepted Answer

Enable a second audit device with the 'fallback' option set to true.. The 'fallback' option on an audit device allows Vault to use that device if the primary audit device fails. This ensures continuous audit logging and prevents Vault from blocking operations due to a single device failure. It is the correct mechanism for achieving redundancy in audit logging without interrupting Vault's operation.

Answer

Enable two audit devices of the same type; Vault will automatically failover to the second if the first fails.

Answer

Use a syslog audit device instead of a file device, as syslog is more reliable.

Answer

Configure the audit device with 'log_raw' set to true to prevent data loss.

Question 11

How can you view the currently enabled audit devices in a Vault cluster?

Accepted Answer

vault audit list. The `vault audit list` command queries the `sys/audit` endpoint and returns the currently enabled audit devices along with their type and options. It is the standard CLI method for enumerating audit devices in a Vault cluster. The output shows device paths (e.g., `file/`, `syslog/`) and their configuration.

Answer

vault read sys/audit

Answer

vault list audit/devices

Answer

vault status -audit

Question 12

You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?

Accepted Answer

All incoming requests will be rejected until the audit device is restored.. When Vault cannot write to an audit device, it fails closed: all incoming client requests are rejected until the audit device is restored. This is a deliberate security design — Vault will not process requests it cannot audit, because unaudited operations would violate compliance and security guarantees. The 'audit_failure' log entry signals this blocked state.

Answer

Vault automatically switches to the secondary audit device.

Answer

Requests are permitted for read-only operations.

Answer

All requests are allowed but a warning is logged.

Question 13

To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?

Accepted Answer

/sys/health. The /sys/health endpoint is purpose-built for external monitoring tools: it returns HTTP status codes (200 active, 429 standby, 472 DR secondary, 473 performance standby, 501 not initialized, 503 sealed) that load balancers and monitoring systems can act on directly. It also exposes fields like initialized, sealed, standby, and replication state. This makes it the canonical endpoint for health checks.

Answer

/sys/leader

Answer

/sys/metrics

Answer

/sys/monitor

Question 14

Which telemetry type is most effective for monitoring the 'lease' count in Vault?

Accepted Answer

Gauges. Gauges are the most effective telemetry type for monitoring lease counts because gauges represent a value that can go up or down over time — exactly the behavior of active leases, which increase when leases are created and decrease when they expire or are revoked. Vault emits metrics like 'vault.expire.num_leases' as a gauge, making it the natural fit for tracking current lease volume.

Answer

Summaries

Answer

Histograms

Answer

Counters

Question 15

You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?

Accepted Answer

The storage backend is struggling with high frequency read/write operations.. The 'core.fetch_token' metric measures the time Vault spends retrieving a token from the storage backend during request processing. High latency here directly indicates the storage backend is slow to respond to token lookups, which are among the most frequent read operations Vault performs. This points to storage backend performance issues rather than audit, buffering, or HA configuration problems.

Answer

The audit file device is too slow.

Answer

The request buffer is full.

Answer

Vault is misconfigured for high availability.