Vault Enterprise Scaling Vault For Performance — Timed 20 Questions

Question 1

A Performance Standby node is receiving traffic but is not performing read operations. What is the standard configuration requirement for Performance Standby nodes?

Accepted Answer

The performance_standby stanza must be enabled in the configuration file.. Performance standby nodes must be configured within the high availability stanza to enable their capability to serve read requests.

Answer

You must disable request forwarding in the listener configuration.

Answer

The node requires a separate license file for each standby.

Answer

The node must be joined to the cluster using vault operator raft join.

Question 2

You are configuring a Vault Performance Replication cluster to improve latency for read-heavy workloads. A client application reports that it is receiving 403 Forbidden errors when attempting to read secrets from a Performance Secondary cluster. What is the most likely cause?

Accepted Answer

ACL policies are not being replicated to the Performance Secondary.. In Vault Performance Replication, ACL policies are replicated to performance secondaries, but if they are not, clients will receive 403 Forbidden errors when trying to read secrets. This is because the secondary enforces the same policies as the primary, and missing policies mean the token lacks necessary permissions. The most likely cause is that ACL policies are not being replicated.

Answer

The Performance Secondary is in a sealed state due to a replication lag.

Answer

The Performance Secondary node has not been initialized with a separate encryption key.

Answer

The client is using a Batch token, which is not supported on performance secondaries.

Question 3

You are observing high latency for read requests on a Performance Secondary cluster. You verify that the replication lag is near zero. What is the most likely cause for the read latency?

Accepted Answer

The secondary node has too few resources allocated to handle the read request rate.. If there is no replication lag, the latency might be caused by the secondary node being overwhelmed, or issues with the request forwarding configuration.

Answer

The secondary node is not configured as a performance standby.

Answer

The primary node is unavailable.

Answer

The secondary node is missing the required policies.

Question 4

You are debugging a scenario where a Batch token issued on a Primary cluster is being rejected by a Performance Secondary cluster. What is the most common reason?

Accepted Answer

The secondary cluster has not been configured to accept Batch tokens.. Batch tokens must be created with a specific flag or configuration that allows them to be validated by the secondary cluster.

Answer

The token has already expired.

Answer

The secondary node has a different root CA.

Answer

The token was issued with a policy that does not exist on the secondary.

Question 5

Which Vault configuration parameter is used to limit the number of concurrent read requests on a Performance Standby node?

Accepted Answer

The listener stanza's max_connections attribute.. While Vault doesn't have a direct 'max_reads' parameter, performance is tuned via the listener settings and resource limits.

Answer

replication_max_reads

Answer

rate_limit

Answer

max_request_limit

Question 6

When promoting a Performance Secondary to a Primary, what happens to the existing Performance Secondaries?

Accepted Answer

They must be manually re-pointed to the new Primary.. When a Performance Secondary is promoted to Primary, the remaining Performance Secondaries do not automatically follow the new Primary. They must be manually re-pointed to the new Primary using the update-primary command with the new primary's cluster address and a reindex or replication token. Until re-pointed, they continue trying to reach the old Primary and replication stalls.

Answer

They become Disaster Recovery secondaries.

Answer

They automatically promote themselves to Primary.

Answer

They are automatically removed from the cluster.

Question 7

Which of the following describes the behavior of a Performance Secondary cluster during a primary cluster outage?

Accepted Answer

It continues to serve read requests based on the last known state.. A performance secondary cannot become a primary. It requires promotion, which is a manual process that changes its role.

Answer

It automatically promotes itself to primary.

Answer

It enters a sealed state.

Answer

It shuts down immediately.

Question 8

When scaling Vault using Performance Standby nodes, how does the load balancer choose which node to direct the read traffic to?

Accepted Answer

The Consul agent performs automatic load balancing.. Vault's architecture relies on the load balancer to perform health checks on the nodes, and Performance Standby nodes will report as 'healthy' to indicate their readiness to serve reads.

Answer

The Active node dictates the traffic flow.

Answer

Vault uses a proprietary load balancing protocol.

Answer

The client performs the load balancing based on a local config file.

Question 9

What occurs when a Batch token is created on the Primary but used on a Performance Secondary that has a different mount path for the auth method?

Accepted Answer

The request will be rejected.. Vault's replication ensures configuration consistency, but if paths differ, the token won't be able to map correctly.

Answer

The token is silently ignored.

Answer

The token is automatically updated to the new path.

Answer

The secondary redirects the request to the primary.

Question 10

Which TWO statements are true regarding the use of Batch tokens in Vault?

Accepted Answer

Batch tokens are not persisted to storage.. Option B is correct because Batch tokens are designed as lightweight, non-persisted tokens: they are not written to Vault's storage backend, which is what makes them scalable and cheap to create, and they are instead encrypted blobs that carry their own authorization data. Option E is correct because, once issued, a Batch token is a valid Vault token that can perform any operation permitted by its attached policies, just like a service token, subject to its limited lifetime and lack of renewal. The unmarked options do not belong: Batch tokens do not support periodic renewal (A), they cannot be revoked by their ID since they are not persisted and thus have no accessor-based revocation path (C), and they do not require an explicit TTL because they inherit a fixed TTL from the role or token creation parameters rather than being configured with one at use time (D).

Answer

Batch tokens support periodic renewal.

Answer

Batch tokens can be revoked by their ID.

Answer

Batch tokens must have an explicit TTL.

Question 11

Which THREE features are part of Vault Enterprise performance scaling?

Accepted Answer

Namespace support.. Namespace support (A) is a Vault Enterprise multi-tenancy feature that isolates teams and workloads into separate logical Vault environments, which reduces contention and enables scaling of management and policy boundaries across a single cluster. Performance standby nodes (B) are Enterprise-only nodes that serve read-only requests and forward writes to the active node, horizontally scaling read throughput without requiring a full HA failover. Performance replication (E) is an Enterprise feature that lets a secondary cluster serve reads and handle its own client traffic while asynchronously receiving data from the primary, scaling read capacity and providing geographic distribution. Dynamic secrets (C) is a core Vault capability available in all editions and concerns secret generation/leasing, not performance scaling. Integrated storage (Raft) (D) is Vault's built-in storage backend available in open-source Vault as well, so it is not an Enterprise performance-scaling feature.

Answer

Dynamic secrets.

Answer

Integrated storage (Raft).

Question 12

Which TWO of the following are valid ways to monitor replication health between clusters?

Accepted Answer

Using the vault read sys/replication/status command.. Option A is correct because Vault exposes replication state through the sys/replication/status endpoint, and running `vault read sys/replication/status` returns the current replication mode and status for both performance and disaster recovery replication, making it a valid way to monitor replication health between clusters. Option B is correct because Vault emits the `vault_replication_lag` telemetry metric, which measures the replication lag (in milliseconds) between the primary and secondary clusters, so checking it directly reflects replication health. Option C is not correct because Consul's health check API reports on Consul service and node health, not on Vault's replication status between clusters. Option D is not correct because the `sys/health` endpoint reports Vault's overall operational state (initialization, seal, standby/active), not replication health. Option E is not correct because Vault does not emit a standard 'replication successful' log message that serves as a reliable replication-health monitor.

Answer

Querying the consul health check API.

Answer

Using the vault sys/health endpoint.

Answer

Watching the system logs for 'replication successful' messages.

Question 13

Which THREE operations are constrained or modified when a path filter is active in a performance replication setup?

Accepted Answer

Replication of data to the secondary for that path.. In a performance replication setup, a path filter scopes which directory trees are replicated, so option B is correct because data under the filtered path is what actually gets transferred to the secondary. Option D is correct because reads to an excluded path on the secondary are constrained—the excluded data is not present there, so read operations cannot return replicated content from that path. Option E is correct because writes to the excluded path on the secondary are also affected, since that path is not part of the replicated dataset and is handled locally rather than through replication. Options A and C are not correct: audit log generation on the primary and authentication methods on the primary are independent of path filtering and are not modified by which paths are replicated.

Answer

Generation of audit logs on the primary.

Answer

Authentication methods on the primary.

Question 14

Which THREE actions are necessary when preparing to promote a Performance Secondary cluster?

Accepted Answer

Disable the existing replication link from the primary side.. Before promoting a Performance Secondary cluster, you must first disable the existing replication link from the primary side (option A), because the primary must stop sending replication traffic and release the secondary so it can be promoted without conflicting writes. You must also ensure the secondary is fully synced with the primary (option B), since promotion requires the secondary to have all replicated data up to date; otherwise the promoted cluster would lose recent writes. Finally, you execute the promotion command via the CLI (option C), typically using the vault operator or replication promotion command, which is the required mechanism to actually perform the promotion. Option D is not required because restarting the secondary cluster is not part of the promotion procedure and could disrupt the process. Option E is not required because promotion does not depend on upgrading the secondary's license to Enterprise; the license type does not gate the promotion operation itself.

Answer

Restart the secondary cluster.

Answer

Upgrade the secondary's license to Enterprise.

Question 15

Which TWO factors contribute to the 'cost' of using Batch tokens in a high-performance environment?

Accepted Answer

The inability to track tokens for audit compliance.. Option A is correct because Batch tokens are not persisted to Vault's storage backend and therefore cannot be listed, renewed, or tracked individually, which breaks audit compliance requirements that depend on token accessors and audit log correlation. Option D is correct because Batch tokens use symmetric encryption (AES-GCM) rather than the HMAC-based verification used by Service tokens; in high-performance environments, the per-request decryption and integrity check of the encrypted token blob consumes more CPU than a simple hash lookup. Option B is incorrect because Batch tokens are self-contained and portable, so they do not need to be replicated across regions. Option C is incorrect because Batch tokens are not stored in Vault's memory or storage, so they do not increase the memory footprint for token storage. Option E is incorrect because Batch tokens are not written to the storage backend, so they do not generate additional storage IOPS.

Answer

The need to replicate all tokens across regions.

Answer

Increased memory footprint for token storage.

Answer

Increased storage IOPS on the backend.

Question 16

You are designing a Vault Enterprise deployment that uses Performance Standby nodes to scale read-heavy workloads. Which two statements accurately describe the behavior or requirements of Performance Standby nodes? (Choose two.)

Accepted Answer

Performance Standby nodes require a load balancer that supports health checks to route traffic only to healthy standbys.. Performance Standby nodes are read-only replicas that handle read requests for replication-enabled secrets engines, thereby scaling read capacity. They require a load balancer with health checks to distribute traffic effectively. They cannot process writes and do not need their own storage backend, as they receive data via replication.

Answer

Performance Standby nodes can service read requests for all secrets engines, including those that are not replication-enabled.

Answer

Performance Standby nodes can process write requests if the active node is unavailable.

Answer

Performance Standby nodes must be configured with the same storage backend as the active node.

Question 17

You are monitoring a Vault Enterprise cluster that uses Performance Replication. The primary cluster is experiencing a high volume of write operations, and you notice that the replication lag to a Performance Secondary is increasing. Which factor is most likely contributing to the increasing replication lag?

Accepted Answer

The primary cluster is using integrated storage and has a slow disk subsystem.. Replication lag is primarily influenced by the primary's ability to process and transmit writes. A slow disk subsystem on the primary can delay write operations and the generation of replication data, leading to increased lag. Other options are unrelated to replication performance.

Answer

The secondary cluster is serving read requests for replication-enabled secrets engines.

Answer

The secondary cluster has a different seal configuration than the primary.

Answer

The load balancer is not configured to route traffic to the secondary cluster.

Question 18

A Vault Enterprise cluster is using Integrated Storage (Raft) with five nodes. The cluster is experiencing performance issues during peak hours, and you suspect that the Raft leader is overloaded with both write and read requests. You want to distribute read requests to other nodes while ensuring that writes are still handled by the leader. Which action should you take?

Accepted Answer

Configure the non-leader nodes as Performance Standby nodes by setting `performance_standby = true` in their configuration files.. Performance Standby nodes are designed to serve read requests in a Vault Enterprise cluster, reducing the load on the active node (or Raft leader). By setting `performance_standby = true` on non-leader nodes, you enable them to handle reads, which is the correct way to scale read performance in a Raft-based cluster.

Answer

Increase the `max_request_duration` parameter in the Vault configuration to allow more time for read requests to complete.

Answer

Add more nodes to the Raft cluster and configure them as non-voters to handle read requests.

Answer

Enable the `raft_autopilot` feature and set the `cleanup_dead_servers` parameter to true.

Question 19

You are sizing storage for a Vault Enterprise cluster that will use Integrated Storage (Raft). The cluster must sustain a heavy write workload of approximately 500 audit log entries per second, each around 2 KB, and you need to minimize the risk of write-ahead log (WAL) growth causing disk exhaustion. What is the most effective configuration change to achieve this?

Accepted Answer

Tune the Raft WAL to use a larger segment size and enable automatic log compaction with a lower snapshot threshold.. The scenario requires reducing WAL growth under high write load. Tuning the Raft WAL segment size and enabling more frequent snapshots (by lowering the snapshot threshold) causes the Raft log to be compacted and truncated more often, preventing unbounded growth. Other options either do not affect Raft log size or can worsen the situation.

Answer

Enable audit log file rotation with a short rotate_duration and set a maximum number of retained audit files.

Answer

Set performance_multiplier to a lower value to reduce the number of nodes required to acknowledge writes.

Answer

Increase the raft_snapshot_threshold and raft_snapshot_interval to reduce the frequency of snapshots.

Question 20

You are operating a Vault Enterprise cluster with Performance Replication. The primary cluster is in us-east-1, and a performance secondary is in eu-west-1. You notice that token creation operations on the secondary are taking significantly longer than on the primary, despite low replication lag. What is the most likely cause of this increased latency?

Accepted Answer

The secondary cluster is using a different seal mechanism, causing token creation to require additional cryptographic operations.. Token creation on a performance secondary is handled locally, but the seal mechanism can introduce latency. If the secondary uses a different seal (e.g., a remote KMS) that is slower or has network overhead, token creation will take longer. Other options incorrectly assume forwarding to primary or replication of audit logs, which are not part of Performance Replication behavior.

Answer

The secondary cluster is forwarding token creation requests to the primary for signing, causing cross-region latency.

Answer

The secondary cluster is performing a local token creation but must wait for the primary to acknowledge the write to the token store before returning.

Answer

The secondary cluster's integrated storage is experiencing high disk I/O due to replication of audit logs from the primary.