Vault Enterprise Scaling Vault For Performance Practice Test 2 — 15 Questions

Question 1

You are designing a Vault Enterprise deployment that uses Performance Standby nodes to scale read-heavy workloads. Which two statements accurately describe the behavior or requirements of Performance Standby nodes? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Performance Standby nodes require a load balancer that supports health checks to route traffic only to healthy standbys.. Performance Standby nodes are read-only replicas that handle read requests for replication-enabled secrets engines, thereby scaling read capacity. They require a load balancer with health checks to distribute traffic effectively. They cannot process writes and do not need their own storage backend, as they receive data via replication.

Answer

Performance Standby nodes can service read requests for all secrets engines, including those that are not replication-enabled.

Answer

Performance Standby nodes can process write requests if the active node is unavailable.

Answer

Performance Standby nodes must be configured with the same storage backend as the active node.

Question 2

You are monitoring a Vault Enterprise cluster that uses Performance Replication. The primary cluster is experiencing a high volume of write operations, and you notice that the replication lag to a Performance Secondary is increasing. Which factor is most likely contributing to the increasing replication lag?

Accepted Answer

The primary cluster is using integrated storage and has a slow disk subsystem.. Replication lag is primarily influenced by the primary's ability to process and transmit writes. A slow disk subsystem on the primary can delay write operations and the generation of replication data, leading to increased lag. Other options are unrelated to replication performance.

Answer

The secondary cluster is serving read requests for replication-enabled secrets engines.

Answer

The secondary cluster has a different seal configuration than the primary.

Answer

The load balancer is not configured to route traffic to the secondary cluster.

Question 3

A Vault Enterprise cluster is using Integrated Storage (Raft) with five nodes. The cluster is experiencing performance issues during peak hours, and you suspect that the Raft leader is overloaded with both write and read requests. You want to distribute read requests to other nodes while ensuring that writes are still handled by the leader. Which action should you take?

Accepted Answer

Configure the non-leader nodes as Performance Standby nodes by setting `performance_standby = true` in their configuration files.. Performance Standby nodes are designed to serve read requests in a Vault Enterprise cluster, reducing the load on the active node (or Raft leader). By setting `performance_standby = true` on non-leader nodes, you enable them to handle reads, which is the correct way to scale read performance in a Raft-based cluster.

Answer

Increase the `max_request_duration` parameter in the Vault configuration to allow more time for read requests to complete.

Answer

Add more nodes to the Raft cluster and configure them as non-voters to handle read requests.

Answer

Enable the `raft_autopilot` feature and set the `cleanup_dead_servers` parameter to true.

Question 4

You are sizing storage for a Vault Enterprise cluster that will use Integrated Storage (Raft). The cluster must sustain a heavy write workload of approximately 500 audit log entries per second, each around 2 KB, and you need to minimize the risk of write-ahead log (WAL) growth causing disk exhaustion. What is the most effective configuration change to achieve this?

Accepted Answer

Tune the Raft WAL to use a larger segment size and enable automatic log compaction with a lower snapshot threshold.. The scenario requires reducing WAL growth under high write load. Tuning the Raft WAL segment size and enabling more frequent snapshots (by lowering the snapshot threshold) causes the Raft log to be compacted and truncated more often, preventing unbounded growth. Other options either do not affect Raft log size or can worsen the situation.

Answer

Enable audit log file rotation with a short rotate_duration and set a maximum number of retained audit files.

Answer

Set performance_multiplier to a lower value to reduce the number of nodes required to acknowledge writes.

Answer

Increase the raft_snapshot_threshold and raft_snapshot_interval to reduce the frequency of snapshots.

Question 5

You are operating a Vault Enterprise cluster with Performance Replication. The primary cluster is in us-east-1, and a performance secondary is in eu-west-1. You notice that token creation operations on the secondary are taking significantly longer than on the primary, despite low replication lag. What is the most likely cause of this increased latency?

Accepted Answer

The secondary cluster is using a different seal mechanism, causing token creation to require additional cryptographic operations.. Token creation on a performance secondary is handled locally, but the seal mechanism can introduce latency. If the secondary uses a different seal (e.g., a remote KMS) that is slower or has network overhead, token creation will take longer. Other options incorrectly assume forwarding to primary or replication of audit logs, which are not part of Performance Replication behavior.

Answer

The secondary cluster is forwarding token creation requests to the primary for signing, causing cross-region latency.

Answer

The secondary cluster is performing a local token creation but must wait for the primary to acknowledge the write to the token store before returning.

Answer

The secondary cluster's integrated storage is experiencing high disk I/O due to replication of audit logs from the primary.

Question 6

You are designing a Vault Enterprise deployment that uses Performance Standby nodes to scale read-heavy workloads. Which two statements accurately describe the behavior or requirements of Performance Standby nodes? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

They can serve read requests locally without forwarding them to the active node.. Performance Standby nodes serve reads locally, reducing the active node's read load, and they can be promoted to active if the active node fails. They do not process writes, do not require a separate license, and can be deployed across data centers for read scaling.

Answer

They require a separate license from the active node.

Answer

They must be in the same physical data center as the active node.

Answer

They can process write requests and forward them to the active node for commit.

Question 7

You are designing a Vault Enterprise deployment that uses Performance Standby nodes to scale read-heavy workloads. Which two statements accurately describe the behavior or requirements of Performance Standby nodes? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the secondary cluster with a sufficient number of nodes to handle the full production workload independently.. To ensure a performance secondary can take over during a primary outage, it must be properly sized to handle the full workload and the promotion process must be tested and client redirection planned. Promotion is done via `vault operator promote`, not snapshot restore or flags. DR replication is not used for this purpose, as performance secondaries are read-only until promoted.

Answer

Promote the performance secondary to a primary cluster using the `vault operator raft snapshot restore` command.

Answer

Enable `dr_replication` on the performance secondary to allow it to accept writes during a primary outage.

Answer

Set the `replication_primary` flag on the secondary to force it to accept writes immediately.

Question 8

You are configuring a Vault Enterprise cluster to use Performance Standby nodes to scale read-heavy workloads. Which configuration parameter must be set on the standby nodes to enable them to serve reads?

Accepted Answer

Ensure the node is joined to the cluster as a performance standby and that the 'service_registration' stanza is properly configured.. Performance standby nodes are part of the same Vault cluster and must be joined as performance standbys, which requires proper cluster configuration and licensing. Once joined, they can serve read requests. The other options reference non-existent or incorrect parameters that do not enable performance standby functionality.

Answer

Set 'performance_standby' to true in the Vault configuration file.

Answer

Set 'read_only' to true in the storage stanza to allow the node to serve reads from the replicated data.

Answer

Set 'disable_performance_standby' to false in the Vault configuration file.

Question 9

You are deploying a Vault Enterprise cluster and want to ensure that the cluster can survive the loss of a single node without downtime. You have three nodes available. Which configuration should you use?

Accepted Answer

One active node and two standard standby nodes.. A three-node Vault cluster with one active and two standard standbys forms a Raft quorum that tolerates the failure of one node. Standard standbys can be promoted to active if the active node fails, ensuring continued write availability. Performance standbys and performance replication do not provide the same failover capability, and multiple active nodes are not supported.

Answer

Three active nodes behind a load balancer.

Answer

One active node and two nodes in a performance replication secondary cluster.

Answer

One active node and two performance standby nodes.

Question 10

You are using Vault Enterprise Performance Replication to replicate data from a primary cluster to multiple secondary clusters. You need to ensure that a specific secondary cluster does not receive certain sensitive secrets. Which two actions should you take? (Choose two.)

Accepted Answer

Configure a replication filter on the primary to exclude the specific mount paths containing the sensitive secrets from replication to that secondary.. To prevent specific secrets from replicating to a secondary, you must configure a replication filter on the primary cluster. This can be done either by setting a filter on the secondary activation token or by configuring a filter directly on the primary for that secondary. These actions ensure that only the desired data is replicated.

Answer

Disable replication for the entire secondary cluster and use a separate backup mechanism for other data.

Answer

Set the 'replication_deny' parameter on the secondary cluster for the mount paths of the sensitive secrets.

Answer

Manually delete the sensitive secrets from the secondary cluster after replication occurs.

Question 11

You are troubleshooting a Vault Enterprise cluster where clients connected to a Performance Secondary are intermittently receiving 500 errors during high read load. The secondary has three Performance Standby nodes and one active node. Replication lag is low. You notice that the active node on the secondary is using a significant amount of CPU. What is the most likely cause?

Accepted Answer

The active node on the secondary is handling replication writes from the primary, which is consuming CPU and causing errors under read load.. On a Performance Secondary, the active node applies replication updates from the primary, which can consume significant CPU. Under high read load, if the active node is saturated by replication, it may fail to process forwarded operations or health checks, leading to 500 errors. Performance Standby nodes serve reads locally, but the active node still handles replication and some forwarded requests.

Answer

The Performance Standby nodes are forwarding all read requests to the active node due to a misconfiguration.

Answer

The secondary cluster's license is invalid, causing it to throttle performance.

Answer

The Performance Standby nodes are not properly joined to the Raft cluster, causing the active node to handle all reads.

Question 12

You are using Vault Enterprise with Performance Replication. The primary cluster is in North America, and a performance secondary is in Europe. Users in Europe report that write operations are slow. You want to improve write performance for European users without compromising data consistency. What should you do?

Accepted Answer

Configure the European clients to send write requests directly to the primary cluster.. Performance Replication secondaries are read-only and forward write requests to the primary. The latency for writes from a secondary region includes the round-trip time to the primary. To minimize this, clients that perform writes should be configured to connect directly to the primary cluster, bypassing the secondary. This reduces the network hops and improves write performance while maintaining consistency.

Answer

Enable local write forwarding on the European performance secondary to allow it to accept writes locally.

Answer

Promote the European performance secondary to a primary cluster and set up replication from it to the North American cluster.

Answer

Increase the number of nodes in the European performance secondary cluster to handle the write load.

Question 13

Which component is responsible for receiving and responding to read requests in a Performance Standby configuration?

Accepted Answer

The Performance Standby node.. In a Vault Enterprise Performance Standby configuration, the Performance Standby node itself is responsible for receiving and responding to read requests. Performance standbys can service read-only operations locally (using their replicated state) while forwarding writes to the active node, which is the entire point of the feature — it scales read throughput horizontally.

Answer

The Active Vault node.

Answer

The Consul agent.

Answer

The Vault API Gateway.

Question 14

Your organization requires fine-grained control over what data is synchronized to a specific Performance Secondary cluster to reduce storage overhead. Which feature should you implement?

Accepted Answer

Replication path filters. Replication path filters allow you to specify which paths are replicated to a Performance Secondary, reducing storage and bandwidth overhead by excluding paths that the secondary does not need. You configure them on the Primary using the sys/replication/performance/primary/path-filters endpoint, listing allowed or denied paths. This gives fine-grained control over what data lands on each secondary.

Answer

Namespace isolation policies

Answer

Mount tuning with local=true

Answer

Performance Standby path filtering

Question 15

You are using Batch tokens in your environment to improve performance. A developer asks why their Batch token cannot be revoked individually. What is the primary reason?

Accepted Answer

Batch tokens are stateless and not persisted in the storage backend.. Batch tokens are stateless and not persisted in Vault's storage backend, so they cannot be revoked individually. Unlike service tokens, which are stored and tracked, batch tokens are self-contained and validated cryptographically. This design enables high performance and scalability but sacrifices individual revocation capability.

Answer

The performance standby nodes do not support Batch token revocation.

Answer

Batch tokens are only supported for transit engine operations.

Answer

Batch tokens have a hard-coded TTL that cannot be overridden.