Vault Enterprise Scaling Vault For Performance Practice Test 3 — 15 Questions

Question 1

An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?

Accepted Answer

Renewing the token.. Batch tokens in Vault are lightweight, non-renewable tokens designed for high-scale, short-lived workloads. Because they are not persisted in Vault's storage backend and have a fixed TTL, they cannot be renewed — attempting to renew a batch token will fail. They can still be used to authenticate, read secrets, and perform operations like Transit encryption, provided the token's policies allow it.

Answer

Performing a Transit engine encryption.

Answer

Authenticating with a configured auth method.

Answer

Reading a secret from the KV engine.

Question 2

When utilizing performance replication, your Vault cluster experiences high replication lag between the primary and secondary sites. Which action would most effectively reduce this lag?

Accepted Answer

Configure path filters to exclude high-churn paths from replication.. Performance replication lag is most directly reduced by filtering out high-churn paths (e.g., transit secrets engine, high-volume KV writes) that don't need to be replicated to the secondary. Path filters let you exclude specific mounts from replication, cutting the volume of data that must traverse the link and thus reducing lag. This is the targeted, effective action for a bandwidth-bound replication lag problem.

Answer

Convert the secondary cluster to a Disaster Recovery secondary.

Answer

Increase the number of Performance Standby nodes.

Answer

Enable Batch token replication.

Question 3

You are managing a multi-region Vault deployment with Performance Replication. You notice that a specific secret engine mount is not being replicated to the secondary site. What should you check?

Accepted Answer

The mount's 'local' flag.. In Performance Replication, a mount can be marked as 'local' so that it is not replicated to secondary clusters. If a secret engine mount is missing on the secondary, the most likely cause is that the mount was created with the 'local' flag (or the mount's 'local' attribute is true), which explicitly excludes it from replication. Checking the mount's 'local' flag is the correct diagnostic step.

Answer

The replication_filter configuration.

Answer

The namespace's 'replicated' flag.

Answer

The secondary cluster's license status.

Question 4

What is the benefit of using Performance Replication over standard DR Replication?

Accepted Answer

Performance replication allows the secondary to serve read requests.. Performance Replication is designed to let secondary clusters serve read requests locally, offloading read traffic from the primary and reducing latency for geographically distributed users. This is its defining benefit over DR Replication, which keeps secondaries in a warm standby state that cannot serve client reads.

Answer

Performance replication supports write operations.

Answer

Performance replication provides disaster recovery capabilities.

Answer

Performance replication is cheaper to license.

Question 5

Which THREE factors influence the performance of a Performance Secondary cluster?

Accepted Answer

The speed of the network between primary and secondary.. Option A is correct because a Performance Secondary receives replicated data from the Primary over the network, so the bandwidth and latency of the link between primary and secondary directly affect how quickly that replication is applied and how current the secondary's data is. Option B is correct because the secondary must persist and serve the replicated writes from its own storage backend, so disk IOPS, throughput, and latency on the secondary determine how fast it can apply and read that data. Option E is correct because the volume of write operations on the Primary drives the replication workload the secondary must process; a higher write rate increases the replication traffic and processing burden on the secondary. Option C is not correct because Performance Standby nodes are read-only replicas that scale read capacity on the Primary cluster and do not govern the performance of a Performance Secondary. Option D is not correct because root tokens are authentication credentials and have no bearing on cluster performance.

Answer

The number of Performance Standby nodes on the Primary cluster.

Answer

The number of root tokens in the system.

Question 6

When configuring path filters for performance replication, what is the effect of using an 'exclude' filter on a path?

Accepted Answer

The path is not synchronized to the secondary.. In Performance Replication, path filters determine which paths are replicated to secondary clusters. An 'exclude' filter on a path means that the specified path is not synchronized to the secondary; it remains local to the primary. This is useful for keeping sensitive or region-specific data from being replicated.

Answer

The path is hidden from the primary's API.

Answer

The path is deleted from the primary.

Answer

The secondary will proxy requests for that path to the primary.

Question 7

Which TWO statements are true about the relationship between Performance Standby nodes and Performance Replication?

Accepted Answer

Performance Standby allows read scaling within a single cluster.. Option C is correct because Performance Standby nodes in Vault are read-only replicas within the same cluster that serve read requests, thereby enabling read scaling within a single cluster. Option D is correct because Performance Replication and Performance Standby are complementary features that can coexist on the same cluster, allowing both cross-cluster replication and intra-cluster read scaling. Option A is incorrect because Performance Replication and Performance Standby are distinct features, not a subtype relationship. Option B is incorrect because Performance Replication does not require Performance Standby nodes; replication can function without them. Option E is incorrect because replication does not require performance standby nodes for all nodes.

Answer

Performance Replication is a type of Performance Standby.

Answer

Performance Standby nodes are required for Performance Replication.

Answer

Replication requires performance standby for all nodes.

Question 8

You are preparing to add a new Performance Secondary cluster to an existing Vault Enterprise Performance Replication setup. The primary cluster uses integrated storage. To ensure that the new secondary can successfully receive replication data and serve read requests, which step must you take before enabling replication on the secondary?

Accepted Answer

Generate a secondary activation token on the primary using the command `vault write -f sys/replication/performance/primary/secondary-token`.. To enable Performance Replication on a secondary, you must first generate an activation token on the primary. This token is then used on the secondary to authenticate and establish the replication connection. Without the token, the secondary cannot join the replication set and will not receive data from the primary.

Answer

Manually copy the primary's storage data to the secondary's storage backend.

Answer

Set up a load balancer to distribute traffic between the primary and secondary.

Answer

Configure the secondary with a new seal stanza that matches the primary's seal configuration.

Question 9

A Vault Enterprise cluster is running with three nodes. The active node is handling both reads and writes, and the two standby nodes are idle. You want to scale read performance by allowing the standby nodes to serve read requests while maintaining the same high availability and data consistency guarantees. Which configuration should you enable?

Accepted Answer

Set `performance_standby = true` in the Vault configuration file on the standby nodes and restart the Vault service.. Performance Standby nodes are a Vault Enterprise feature that allows standby nodes to serve read requests, offloading the active node and scaling read throughput. They are enabled by setting `performance_standby = true` in the configuration file on the standby nodes. This maintains high availability because one node remains active for writes, while standbys handle reads and can take over if the active node fails.

Answer

Enable the `read_replica` option on the active node and configure the standby nodes to forward read requests to the active node.

Answer

Enable Integrated Storage (Raft) with three voters and configure `performance_standby` on the standby nodes via the `vault operator raft` command.

Answer

Deploy a separate Performance Secondary cluster and configure Performance Replication to forward read requests to it.

Question 10

A Vault Enterprise cluster is configured with Performance Replication to a secondary cluster. The secondary cluster is in a different region and is used for disaster recovery and read scaling. You notice that the secondary cluster is experiencing high replication lag, and some read requests return stale data. Which factor is most likely causing the lag?

Accepted Answer

The network latency between the primary and secondary clusters is high, and the primary is generating a high volume of writes.. Performance Replication lag is primarily influenced by network conditions and the write throughput on the primary. High latency between clusters and a heavy write load can cause the secondary to fall behind, leading to stale reads. To mitigate, ensure adequate network bandwidth and consider reducing write volume or scaling the primary.

Answer

The secondary cluster has a large number of Performance Standby nodes that are overwhelmed with read requests.

Answer

The primary cluster is using Integrated Storage (Raft) while the secondary uses Consul as its storage backend.

Answer

The secondary cluster is configured with a different seal mechanism than the primary cluster.

Question 11

You are using Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. You need to ensure that the secondary cluster can continue to serve read requests even if the primary cluster becomes unavailable. Which statement describes the behavior of the secondary cluster in this scenario?

Accepted Answer

The secondary cluster will continue to serve read requests using its local replica of the data, but writes will fail until the primary is restored or the secondary is promoted.. Performance Replication secondaries are designed to serve read requests locally, providing read scalability and disaster recovery. If the primary becomes unavailable, the secondary can continue to serve reads from its local replica, but it cannot accept writes unless it is manually promoted to primary. This ensures that read operations remain available during a primary outage.

Answer

The secondary cluster will become read-only and reject all requests, including reads, until the primary is back online.

Answer

The secondary cluster will redirect all read requests to the primary cluster, causing failures if the primary is down.

Answer

The secondary cluster will automatically promote itself to primary and begin accepting writes.

Question 12

You are the Vault operator for a financial services company. Your Vault Enterprise cluster runs Integrated Storage and is approaching its maximum write throughput during peak trading hours. You need to increase write scalability without changing the client API or adding a separate Disaster Recovery cluster. Which action should you take?

Accepted Answer

Increase the number of nodes in the Integrated Storage cluster and ensure the active node has sufficient CPU and disk IOPS.. Scaling write throughput in Vault Enterprise with Integrated Storage is achieved by increasing the number of Raft nodes and ensuring the active node has sufficient resources. Performance Standby nodes only offload reads, and Performance Replication secondaries do not accept arbitrary writes. Adding independent clusters changes the client model and is not a supported scaling approach.

Answer

Enable Performance Replication and promote a secondary cluster to handle writes.

Answer

Add more Performance Standby nodes behind the active load balancer.

Answer

Deploy a second Vault cluster with its own Integrated Storage and configure the clients to write to both clusters.

Question 13

You manage a Vault Enterprise cluster with Performance Replication enabled. The primary cluster is in us-east-1 and a secondary cluster is in eu-west-1. Clients in eu-west-1 are experiencing high read latency even though replication lag is consistently low. You have already verified that the secondary is healthy and has Performance Standby nodes. What is the most likely cause?

Accepted Answer

The secondary cluster's Integrated Storage is undersized or has high disk latency, causing slow local reads.. Performance Secondary clusters serve reads locally from their own Integrated Storage. Even with low replication lag, slow reads can occur if the secondary's storage is undersized or has high disk latency. The primary's replication speed and WAN traversal are not factors when lag is low and reads are local.

Answer

The secondary cluster is in a different region, so all reads must traverse the WAN to the primary.

Answer

The primary cluster is not sending replication data to the secondary fast enough.

Answer

The secondary cluster's Performance Standby nodes are not configured to forward reads to the active node.

Question 14

You are scaling a Vault Enterprise cluster to handle a high volume of database credential generation. You configure the database secrets engine with a maximum open connections setting of 100 and a maximum idle connections setting of 20. After a few hours, you notice that the number of open connections to the database frequently reaches 100 and stays there, even when request rates are moderate. You want to reduce the connection churn and improve performance without changing the maximum open connections. What should you do?

Accepted Answer

Increase the maximum idle connections setting to a value closer to the maximum open connections.. The database secrets engine maintains a connection pool to the database. When max_idle_connections is set too low relative to max_open_connections, idle connections are closed and must be recreated when new requests arrive, causing churn and performance degradation. Raising max_idle_connections allows more connections to remain idle and be reused, reducing the overhead of establishing new connections while still respecting the maximum open connections limit.

Answer

Reduce the maximum open connections setting to force the pool to recycle connections more aggressively.

Answer

Enable the database secrets engine's connection pooling by setting a longer max_connection_lifetime.

Answer

Configure the database secrets engine to use a dynamic username template to reduce the number of distinct connections.

Question 15

You are configuring a Vault Enterprise cluster with integrated storage to scale for a high-read workload. You plan to add performance standby nodes. Which two statements accurately describe how performance standbys affect scaling and request handling? (Choose two.)

Accepted Answer

Performance standbys forward write requests to the active node, which then commits the change to the replicated data store.. Performance standbys scale read-heavy workloads by serving reads locally from the replicated data store, and they forward writes to the active node for commitment. They do not participate in Raft elections and cannot become active, which distinguishes them from standard standbys. These two characteristics make them ideal for read scaling without altering the write path or failover topology.

Answer

Performance standbys participate in the Raft quorum and can become the active node if the current active fails.

Answer

Performance standbys can accept write requests and commit them directly to the integrated storage backend.

Answer

Performance standbys require a separate integrated storage backend that is synchronized via performance replication.