Vault Enterprise Vault Server Configuration — 15 Questions

Question 1

When configuring a Vault server to use a specific Auth Method, where should the configuration be applied to ensure it persists across a cluster restart?

Accepted Answer

Via the 'vault auth enable' command.. Auth methods must be enabled and configured via the API or CLI, which saves the configuration into the backend storage (Integrated Storage).

Answer

Using environment variables exclusively.

Answer

By editing the core binary settings.

Answer

In the HCL configuration file

Question 2

Which parameter in the Vault configuration file controls the frequency of server-side background tasks?

Accepted Answer

disable_mlock. The 'default_max_request_duration' and other operational parameters are managed, but 'disable_mlock' is a critical configuration for memory hardening.

Answer

ui

Answer

max_lease_ttl

Answer

plugin_directory

Question 3

Which TWO of the following steps are required to initialize a Vault server for the first time?

Accepted Answer

Generate the master key shares.. Initialization generates the master key and the initial root token, which are the two critical outputs required to interact with a new cluster.

Answer

Unseal the cluster.

Answer

Enable secret engines.

Answer

Configure the audit device.

Question 4

What is the purpose of the 'cluster_addr' in the Vault server configuration?

Accepted Answer

To allow communication between Vault cluster nodes.. The 'cluster_addr' is used for communication between nodes in a Vault cluster (e.g., for Raft replication).

Answer

To mount storage backends.

Answer

To handle client API requests.

Answer

To communicate with external secret engines.

Question 5

A Vault performance standby node receives a request. What happens if the request is a write operation?

Accepted Answer

The request is forwarded to the active node.. Performance standby nodes forward write operations to the active node because only the active node can write to the storage backend.

Answer

The request is rejected with a 403 error.

Answer

The node processes it locally.

Answer

The node triggers an election.

Question 6

When initializing a Vault server, you choose to store the recovery keys. What is the main security advantage of using recovery keys alongside Auto-Unseal?

Accepted Answer

They allow for root token regeneration in an emergency.. Recovery keys allow for performing sensitive operations like root token generation and unseal key migration if the Auto-Unseal mechanism becomes unavailable.

Answer

They provide a way to bypass authentication.

Answer

They increase the encryption strength of the data at rest.

Answer

They are required for every client login.

Question 7

You are configuring a production Vault cluster using Integrated Storage. What is the most critical configuration parameter that must be set in the 'storage' stanza to ensure the node can correctly identify and join the existing Raft cluster during a bootstrap operation?

Accepted Answer

node_id. The 'node_id' is required for every node in a Raft cluster to uniquely identify itself to other peers in the integrated storage configuration.

Answer

path

Answer

api_addr

Answer

retry_join

Question 8

You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?

Accepted Answer

tls_disable = false. The 'tls_disable' parameter must be set to 'false' to enforce encrypted communication, which is a production hardening requirement.

Answer

tls_disable = true

Answer

proxy_protocol = true

Answer

tls_prefer_server_cipher_suites = false

Question 9

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

Accepted Answer

vault operator rekey -init. The 'vault operator rekey -init' command is used to start the process of changing the master key configuration.

Answer

vault operator unseal

Answer

vault secrets tune

Answer

vault operator rotate

Question 10

A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?

Accepted Answer

No action is required, assuming IAM permissions are correctly maintained.. Vault's Auto-Unseal configuration automatically handles the KMS key rotation if the IAM policy allows the 'decrypt' action on the new key version.

Answer

Update the 'kms_key_id' in the configuration file.

Answer

Restart the Vault process to reload the KMS configuration.

Answer

Run vault operator rekey to update the master key.

Question 11

Which command is used to check the health status of a Vault node?

Accepted Answer

vault status. The 'vault status' command provides the current health, seal status, and active/standby role of the node.

Answer

vault monitor

Answer

vault health

Answer

vault inspect

Question 12

What is the primary function of the 'ui = true' configuration setting?

Accepted Answer

Enable the web-based graphical interface.. Setting 'ui = true' enables the Vault Web UI, allowing users to interact with Vault via a browser.

Answer

Enable command-line interface tools.

Answer

Enable auto-unseal.

Answer

Increase API throughput.

Question 13

When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?

Accepted Answer

Use a secure management system to populate config values.. Configuration files should not contain secrets. Using environment variables or a configuration management system to inject values at runtime is the preferred secure approach.

Answer

Store it as a plaintext file in the root directory.

Answer

Hardcode the root token in the config file.

Answer

Use the 'vault write' command to update the config file.

Question 14

You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?

Accepted Answer

Run 'vault operator raft join'.. You must ensure the storage stanza is correctly configured for 'raft' and the node has a unique 'node_id' to participate.

Answer

Disable TLS.

Answer

Delete the old configuration file.

Answer

Format the filesystem.

Question 15

When configuring an audit device, which configuration parameter is essential for high-availability auditing?

Accepted Answer

There is no specific parameter; use multiple devices.. For high-availability, you should configure multiple audit devices. If one fails, Vault stops processing requests if 'log_raw' is not configured correctly or if the audit device is not robust.

Answer

file_path

Answer

audit_non_blocking

Answer

tcp_addr