When initializing a Vault server, you choose to store the recovery keys. What is the main security advantage of using recovery keys alongside Auto-Unseal?
When configuring a Vault server to use a specific Auth Method, where should the configuration be applied to ensure it persists across a cluster restart?
You are configuring a production Vault cluster using Integrated Storage. What is the most critical configuration parameter that must be set in the 'storage' stanza to ensure the node can correctly identify and join the existing Raft cluster during a bootstrap operation?
An operator is configuring a Vault Enterprise server that must use Integrated Storage with automatic snapshot behavior driven by a maximum log size. The server also needs to serve a custom CA certificate chain for TLS on the API listener. Which two configuration blocks must the operator include in the HCL configuration to satisfy these requirements? (Choose two.)
A Vault Enterprise operator is configuring a performance standby cluster that must forward requests to the active node and also serve read-only requests locally. The environment uses Integrated Storage and requires that the performance standby maintain its own Raft log. Which configuration parameter must be set on the performance standby nodes to enable this behavior?
An administrator is configuring a Vault server to use a custom plugin directory for external secrets engines. The plugin binaries are stored in `/opt/vault/plugins`. Which configuration parameter must be set in the Vault HCL configuration to allow Vault to load plugins from this directory?
You are deploying a new Vault Enterprise cluster with Integrated Storage (Raft). The cluster spans three availability zones, and you want to ensure that the cluster can tolerate the loss of one availability zone without losing quorum. Each zone will host one Vault server. Which configuration parameter must you set in the Vault server configuration file to define the number of copies of each log entry that must be stored before a write is acknowledged?
A Vault Enterprise administrator is configuring a new server to use Auto-Unseal with a Hardware Security Module (HSM) that supports PKCS#11. The administrator has installed the HSM vendor's PKCS#11 library and wants Vault to use it for seal wrapping. Which configuration block must be added to the Vault server configuration file to enable this integration?
A Vault Enterprise administrator is configuring a new server to use Integrated Storage with a separate, dedicated disk for the data directory. The disk is mounted at /vault/data and has 1 TB of available space. The administrator sets the `path` in the storage stanza to `/vault/data`. After initializing the cluster, they notice that the raft database file is growing rapidly. Which configuration parameter should be adjusted to control the size of the raft database and prevent excessive disk usage?
You are deploying a Vault Enterprise cluster with Integrated Storage. The security team requires that all cluster communication between nodes, including Raft replication traffic, be encrypted with TLS. You have already configured the `api_addr` and `cluster_addr` with HTTPS URLs. Which additional configuration is mandatory to ensure that cluster traffic uses TLS?
A Vault Enterprise administrator is configuring a new server with Integrated Storage. The server will join an existing cluster. Which two parameters must be set in the `storage` stanza to enable the new node to join the cluster? (Choose two.)
You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?
A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?
An operations team is deploying a new Vault Enterprise cluster that will use Integrated Storage with Auto-Unseal via AWS KMS. The nodes will be provisioned in an Auto Scaling group behind a load balancer. They want to minimize manual steps during initial cluster formation and ensure that nodes can automatically join when scaled. Which configuration approach should they use?
An operations team is deploying Vault Enterprise with Integrated Storage across three nodes. They want to ensure that if one node fails, the cluster remains available for both reads and writes. They also want to minimize the risk of split-brain scenarios. Which of the following configurations should they use?
A Vault Enterprise cluster is configured with Performance Standby nodes to scale read operations. An administrator notices that some write requests are being forwarded to the active node, causing increased latency. They want to ensure that write requests are handled as efficiently as possible. Which statement correctly describes the behavior of Performance Standby nodes regarding write operations?
A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)
An administrator is configuring a new Vault Enterprise server that will use Integrated Storage. They need to specify the storage stanza in the configuration file. Which TWO parameters are required within the 'storage "raft"' stanza to ensure the node can participate in the cluster? (Choose two.)
You are setting up a Vault Enterprise server and want to enable the web UI for administrators. Which configuration setting must be added to the Vault configuration file?
A Vault administrator is preparing a server configuration file for a new Vault Enterprise installation. They want to ensure that the Vault UI is accessible and that the server listens on all network interfaces for API requests. Which configuration settings should they use?
A Vault Enterprise administrator is configuring a server to use a custom plugin directory for external secrets engines. The plugin binaries are stored in /opt/vault/plugins. The administrator wants Vault to load plugins from this directory and also wants to ensure that plugins are not automatically downloaded from the internet. Which configuration parameter must be set in the Vault server configuration file?
A Vault Enterprise cluster is configured with Auto-Unseal using AWS KMS. The security team rotates the KMS key used for Auto-Unseal. After rotation, Vault nodes are restarted. What is the expected behavior when the nodes attempt to unseal?
A Vault Enterprise cluster is deployed across three availability zones in AWS. The administrator wants to ensure that the cluster can tolerate the loss of an entire availability zone without losing quorum. The cluster uses Integrated Storage. How many Vault nodes should be deployed, and what is the minimum number of nodes required to maintain quorum after such a loss?