Vault Enterprise Monitoring Vault Environments Practice Test 3 — 15 Questions

Question 1

Where are audit logs physically stored if the 'file' audit device is configured?

Accepted Answer

In the local filesystem at the configured path.. When the file audit device is enabled, Vault writes JSON-formatted audit entries to the path specified in the device's options (for example, file_path=/var/log/vault_audit.log) on the local filesystem of the Vault node. Each node writes to its own local file, so in an HA cluster every node must have the device enabled and its own path configured.

Answer

In standard system syslog.

Answer

In the storage backend database.

Answer

In Vault's memory buffer.

Question 2

What does the 'vault_core_seal_setup_duration' metric represent?

Accepted Answer

The duration of the unseal process.. The 'vault_core_seal_setup_duration' metric measures the time taken to complete the unseal process — specifically, the duration of the seal setup operations that occur when Vault transitions from sealed to unsealed. It is a core telemetry metric used to monitor unseal performance.

Answer

The time taken to initialize the storage backend.

Answer

The time between audit log rotations.

Answer

The time spent waiting for a lease to expire.

Question 3

You want to prevent audit logs from being written to a specific device if the disk is full. What happens to Vault?

Accepted Answer

Vault enters a blocked state for all client requests.. If an audit device's disk is full and Vault cannot write audit logs, Vault enters a blocked state and rejects all client requests. This is the same fail-closed behavior as any audit_failure: Vault refuses to process operations it cannot audit. It does not silently drop logs or rotate them automatically.

Answer

Vault switches to a secondary file automatically.

Answer

Vault stops recording logs but continues operation.

Answer

Vault deletes the oldest logs to make room.

Question 4

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

Accepted Answer

The server logs.. Leader election events in a Vault HA cluster are logged by the Vault server itself, so the server logs are where you find messages about acquiring/losing leadership, stepping down, and transitioning between active and standby states. These logs include timestamps and the node identity, making them the authoritative source for election history. Telemetry and audit logs do not record election mechanics.

Answer

The telemetry metrics.

Answer

The storage backend logs.

Answer

The audit logs.

Question 5

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

Accepted Answer

debug. The debug log level captures the most granular diagnostic output from Vault, including internal subsystem activity, plugin initialization steps, and configuration parsing details that occur during startup. When troubleshooting startup failures, this verbosity is essential because errors often originate before the listener or storage backends fully initialize, and lower log levels suppress those early messages. Setting log_level = "debug" in the Vault configuration or passing -log-level=debug at startup surfaces the exact sequence of operations leading to the failure.

Answer

warn

Answer

error

Answer

info

Question 6

Which tool is commonly used to view Vault metrics in a graphical format?

Accepted Answer

Grafana. Grafana is a widely adopted open-source visualization and dashboarding tool that integrates with time-series databases like Prometheus, InfluxDB, and Graphite. Vault exposes metrics in these formats (e.g., Prometheus endpoint at /v1/sys/metrics), and Grafana can query and display them as graphs, gauges, and alerts. This makes Grafana the standard choice for graphically monitoring Vault's performance and health metrics.

Answer

Vault Audit Viewer

Answer

Vault UI

Answer

Logstash

Question 7

Which THREE types of metrics are collected by Vault's telemetry system?

Accepted Answer

Storage backend performance.. Vault's telemetry system collects storage backend performance metrics (option A), such as latency and operation counts for the configured storage backend (e.g., Consul, Raft, or file), which are essential for diagnosing backend bottlenecks. It also collects core operation counts (option B), tracking counters like the number of token creations, secret leases, and barrier operations performed by Vault's core. Additionally, Vault collects request latency metrics (option C), exposing histograms and summaries of request durations per path and operation to monitor API performance. Options D and E are not telemetry metrics: audit file size is an operational artifact of the audit device rather than a metric emitted by Vault's telemetry, and user password history is not tracked by Vault at all, as Vault does not store or manage password histories.

Answer

Audit file size.

Answer

User password history.

Question 8

Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?

Accepted Answer

Review logs for 'sys/policy' updates.. Option A is correct because 'sys/policy' updates in an audit log indicate changes to Vault policies, which are high-value security events that could signal privilege escalation or unauthorized access modifications. Option B is correct because 'create' operations on 'auth/token/create' represent new token issuance, and unusual or unexpected token creation can indicate credential abuse or persistence attempts. Option D is correct because filtering by '403 Forbidden' responses highlights denied access attempts, which are strong indicators of reconnaissance or attempted unauthorized access. Option C is not a security-specific action; sorting by timestamp is a general log-navigation technique that does not itself identify incidents. Option E is not appropriate because successful 'read' operations on all secrets are normal and expected, so reviewing them indiscriminately would generate excessive noise rather than pinpoint potential incidents.

Answer

Sort logs by timestamp.

Answer

Check for successful 'read' operations on all secrets.

Question 9

Which TWO factors contribute to the size and performance of Vault audit logs?

Accepted Answer

The size of the request/response payloads.. Option A is correct because Vault audit devices log the full request and response payloads (with sensitive values HMAC-hashed), so larger payloads directly increase the byte size of each audit entry and thus the overall log volume and I/O. Option D is correct because every request handled by Vault generates audit entries (one per audit device), so a higher request rate produces proportionally more log lines per second, increasing log size and the write throughput required to keep up. Option B is incorrect because active leases affect token/secret lifecycle bookkeeping, not the per-request audit record size or rate. Option C is incorrect because enabling more secrets engines adds mount points but does not itself change audit log size or performance. Option E is incorrect because the size of the Vault data store (the storage backend) is unrelated to the volume of audit log entries generated.

Answer

The number of active leases.

Answer

The number of enabled secrets engines.

Answer

The size of the Vault data store.

Question 10

Which THREE conditions might result in a Vault node becoming unhealthy?

Accepted Answer

Storage backend connection failure.. Option A is correct because Vault's health status depends on its storage backend; if Vault cannot reach or use its configured storage (e.g., Consul, Raft, file, or cloud storage), it cannot serve requests and reports unhealthy. Option B is correct because a sealed Vault node has no access to its master key or unseal keys, so it cannot decrypt the barrier or serve secrets, and its health endpoint returns a sealed, unhealthy status. Option D is correct because a non-leader node that cannot reach the active cluster leader cannot forward requests or participate properly in the cluster, causing it to report unhealthy. Option C is not correct because telemetry endpoints (such as Prometheus or StatsD sinks) are optional observability outputs; their failure does not affect Vault's core health status. Option E is not correct because audit log devices are configured sinks, and while audit failures can block requests, 'audit logs are full' is not a standard Vault health condition and does not by itself make the node unhealthy.

Answer

Telemetry endpoint is down.

Answer

Audit logs are full.

Question 11

A Vault Enterprise cluster with integrated storage (Raft) is experiencing intermittent performance degradation. The operator observes that the 'vault_raft_leader_lastContact' metric frequently spikes above 500 ms. Which underlying issue is most likely indicated by this metric behavior?

Accepted Answer

The leader is unable to communicate with followers due to network latency or packet loss.. The 'vault_raft_leader_lastContact' metric tracks the time elapsed since the leader last successfully contacted each follower. Spikes above 500 ms indicate communication delays, commonly due to network latency or packet loss. This metric is a key indicator of Raft cluster health, and persistent spikes can lead to leader elections or degraded performance. Investigating network reliability between nodes is the appropriate next step.

Answer

The Raft log is growing too large and needs compaction.

Answer

The leader node is overloaded with client requests, causing delays in follower heartbeats.

Answer

The followers are experiencing disk I/O bottlenecks, delaying their responses to the leader.

Question 12

A Vault Enterprise cluster is experiencing intermittent performance issues. The operations team has enabled telemetry and is collecting metrics via StatsD. They notice that the `vault.runtime.alloc_bytes` metric is steadily increasing over several days without a corresponding increase in active tokens or leases. What is the most likely explanation for this trend?

Accepted Answer

A memory leak in a plugin or Vault itself is causing allocations to accumulate without being released.. The `vault.runtime.alloc_bytes` metric is a gauge that shows the current memory allocated by Vault. A steady increase over days without increased load suggests a memory leak. This could stem from Vault's core or a plugin. Operators should investigate by checking recent changes, reviewing logs, and using profiling tools. While a restart can temporarily alleviate the issue, identifying and fixing the leak is essential. The other options either mischaracterize the metric or suggest normal behavior when the trend is abnormal.

Answer

The metric is cumulative and will always increase over time, so it should be monitored as a rate rather than a gauge.

Answer

The StatsD sink is aggregating the metric incorrectly, causing it to appear as a monotonically increasing value.

Answer

The increase is normal and reflects memory fragmentation, which Vault does not reclaim until a restart.

Question 13

An operator is configuring Vault Enterprise to send audit logs to a syslog server. The operator wants to ensure that audit logs are not lost if the syslog server becomes temporarily unavailable. Which configuration parameter should be adjusted to allow Vault to buffer audit logs in memory until the syslog server is reachable?

Accepted Answer

Vault does not support buffering audit logs; it will block requests if the audit device is unavailable.. Vault does not buffer audit logs. If an audit device is unreachable, Vault blocks requests to prevent unaudited actions. This design ensures that every request is logged, but it means that audit device availability is critical. To mitigate, operators should configure redundant audit devices or ensure the syslog server is highly available. The `log_raw` option, `facility`, and `tag` parameters do not affect buffering, and there is no `fallback` option. Thus, the correct understanding is that buffering is not supported.

Answer

The `fallback` option in the audit device configuration, which enables a secondary audit device for buffering.

Answer

The `log_raw` option in the audit device configuration.

Answer

The `syslog` audit device's `facility` and `tag` parameters.

Question 14

A junior operator notices that the standby nodes in a three-node Vault Enterprise cluster report a sealed status after a planned restart, while the active node is unsealed. They want to confirm cluster readiness before adding the nodes back to the load balancer. Which endpoint should they query on each node to determine seal status and standby state programmatically?

Accepted Answer

/v1/sys/seal-status. The seal-status endpoint is unauthenticated and returns sealed, initialized, standby, and cluster fields, which is precisely the information needed to confirm a node is unsealed and ready before returning it to service. The leader endpoint describes leadership only, mounts requires authentication and says nothing about sealing, and health is aimed at automated probes rather than direct seal verification.

Answer

/v1/sys/mounts

Answer

/v1/sys/health

Answer

/v1/sys/leader

Question 15

A Vault Enterprise operator is investigating a sudden increase in memory usage on a Vault node. They suspect that a large number of leases are accumulating. Which telemetry metric should they examine to track the total number of active leases in the cluster?

Accepted Answer

vault.expire.num_leases. The metric vault.expire.num_leases tracks the total number of leases in the expiration manager. It is the correct choice for monitoring active leases and diagnosing memory usage spikes. Other options are either non-existent or unrelated to lease counts. This metric is essential for understanding lease-related resource consumption in Vault Enterprise.

Answer

vault.lease.count

Answer

vault.lease.active

Answer

vault.token.count