Vault Enterprise Vault Server Configuration Practice Test 2 — 15 Questions

Question 1

You are deploying a Vault Enterprise cluster with Integrated Storage. The security team requires that all cluster communication between nodes, including Raft replication traffic, be encrypted with TLS. You have already configured the `api_addr` and `cluster_addr` with HTTPS URLs. Which additional configuration is mandatory to ensure that cluster traffic uses TLS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure the listener stanza includes `tls_cert_file` and `tls_key_file` and that `cluster_addr` uses `https://`.. For Vault Enterprise with Integrated Storage, cluster traffic (including Raft) is encrypted when the `cluster_addr` uses HTTPS and the listener is configured with TLS certificate and key files. The listener's TLS settings apply to both API and cluster communication unless overridden. This ensures that all inter-node communication is secure.

Answer

Configure a `tls_cluster` stanza with the cluster certificate and key.

Answer

Enable `seal` stanza with `tls_skip_verify = false` to enforce TLS on cluster ports.

Answer

Set `disable_clustering = false` in the listener stanza.

Question 2

A Vault Enterprise administrator is configuring a new server with Integrated Storage. The server will join an existing cluster. Which two parameters must be set in the `storage` stanza to enable the new node to join the cluster? (Choose two.)

Accepted Answer

`path`. The `path` and `node_id` parameters are required in the Integrated Storage stanza. `path` defines where data is stored, and `node_id` uniquely identifies the node in the cluster. While `node_id` can be auto-generated, explicitly setting it is best practice when joining a cluster to avoid conflicts. `retry_join` is optional if joining manually, and `cluster_addr` is set at the top level, not in the storage stanza.

Answer

`max_entry_size`

Answer

`cluster_addr`

Answer

`retry_join`

Question 3

What is the purpose of the 'cluster_addr' in the Vault server configuration?

Accepted Answer

To allow communication between Vault cluster nodes.. The 'cluster_addr' directive in the Vault server configuration specifies the address that Vault uses for communication between nodes in a Vault cluster, including request forwarding and replication traffic. It is distinct from 'api_addr', which is used for client-facing API requests. This setting is essential for multi-node Vault deployments to ensure internal cluster traffic is routed correctly.

Answer

To mount storage backends.

Answer

To handle client API requests.

Answer

To communicate with external secret engines.

Question 4

A Vault performance standby node receives a request. What happens if the request is a write operation?

Accepted Answer

The request is forwarded to the active node.. Performance standby nodes in Vault Enterprise serve read-only requests locally (when the read can be satisfied from replicated state) but forward write operations to the active node over the cluster port. This preserves the single-writer guarantee of the Raft or integrated storage backend while scaling read throughput horizontally. The forwarding is transparent to the client, which receives the response as if the active node had handled it directly.

Answer

The request is rejected with a 403 error.

Answer

The node processes it locally.

Answer

The node triggers an election.

Question 5

You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?

Accepted Answer

tls_disable = false. Setting tls_disable = false in the listener stanza ensures Vault serves its API over TLS, preventing cleartext transmission of tokens, secrets, and requests. In hardened production deployments, TLS is mandatory and should be paired with a valid certificate and strong cipher suites.

Answer

tls_disable = true

Answer

proxy_protocol = true

Answer

tls_prefer_server_cipher_suites = false

Question 6

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

Accepted Answer

vault operator rekey -init. 'vault operator rekey -init' starts a rekey operation and, when combined with flags like '-key-shares' and '-key-threshold', allows you to change the unseal key configuration while generating a new master key. This is the only command that both rotates the master key and lets you alter the share/threshold parameters in a single operation.

Answer

vault operator unseal

Answer

vault secrets tune

Answer

vault operator rotate

Question 7

A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?

Accepted Answer

No action is required, assuming IAM permissions are correctly maintained.. When AWS KMS auto-unseal is configured, Vault stores the encrypted master key and calls KMS Decrypt to unwrap it. AWS KMS key rotation creates a new backing key version under the same key ID, and KMS transparently uses the correct version for decrypt operations. As long as the IAM principal Vault uses retains kms:Decrypt on that key, no Vault configuration change or restart is required.

Answer

Update the 'kms_key_id' in the configuration file.

Answer

Restart the Vault process to reload the KMS configuration.

Answer

Run vault operator rekey to update the master key.

Question 8

What is the primary function of the 'ui = true' configuration setting?

Accepted Answer

Enable the web-based graphical interface.. The 'ui = true' setting in the Vault server configuration enables the web-based graphical user interface, allowing operators to log in and manage secrets, policies, and auth methods through a browser. It does not affect CLI availability, auto-unseal, or API throughput. When enabled, the UI is served on the same listener port as the API (e.g., 8200) at the /ui path.

Answer

Enable command-line interface tools.

Answer

Enable auto-unseal.

Answer

Increase API throughput.

Question 9

When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?

Accepted Answer

Use a secure management system to populate config values.. The best practice for storing Vault configuration files in the cloud is to use a secure management system (e.g., AWS Secrets Manager, HashiCorp Consul, or encrypted S3 with restricted access) to populate configuration values dynamically. This avoids embedding sensitive data like tokens or keys in plaintext and supports rotation and auditability. Hardcoding secrets or storing plaintext files exposes credentials and violates security best practices.

Answer

Store it as a plaintext file in the root directory.

Answer

Hardcode the root token in the config file.

Answer

Use the 'vault write' command to update the config file.

Question 10

You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?

Accepted Answer

Run 'vault operator raft join'.. Before a new Vault node can participate in an Integrated Storage (Raft) cluster, it must be joined to the existing cluster using 'vault operator raft join' with the leader's API address. This command registers the node with the Raft cluster so it can receive the encrypted snapshot and begin replicating. Without this step, the node starts as a standalone Vault instance and never joins the quorum.

Answer

Disable TLS.

Answer

Delete the old configuration file.

Answer

Format the filesystem.

Question 11

What is the consequence of setting 'cluster_name' in the Vault HCL configuration?

Accepted Answer

It identifies the cluster in audit logs and replication.. The 'cluster_name' parameter in Vault's HCL configuration assigns a human-readable identifier to the Vault cluster. This name is used in audit logs to indicate which cluster generated the log entry, and in replication (both performance and disaster recovery) to identify the source and destination clusters. It does not trigger elections, encrypt traffic, or set licensing.

Answer

It forces a cluster election.

Answer

It encrypts the communication between nodes.

Answer

It sets the license key.

Question 12

How do you properly revoke a root token after it has been used to perform initialization tasks?

Accepted Answer

Use the 'vault token revoke' command.. The correct way to revoke a root token is to use the `vault token revoke` command, which sends a revocation request to Vault's token store. This immediately invalidates the token, ensuring it cannot be used for any further operations. Since root tokens are highly privileged, proper revocation is critical for security. The command works whether the token is provided via argument or through the `VAULT_TOKEN` environment variable.

Answer

Restart the server.

Answer

Overwrite it with a new token.

Answer

Delete the token file.

Question 13

When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?

Accepted Answer

Vault stops processing requests.. By default, if Vault cannot write to the audit device, it will stop processing requests to ensure no un-audited operations occur.

Answer

Vault alerts the admin via email.

Answer

Vault ignores the error and continues.

Answer

Vault switches to a backup audit device.

Question 14

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

Accepted Answer

The KMS Key ID or ARN.. To enable Auto-Unseal with a cloud KMS, Vault must know which key to use, so option B (the KMS Key ID or ARN) is required to identify the specific KMS key that Vault will call for encryption/decryption operations. Option C (a cloud provider IAM role with decrypt permissions) is also required because Vault's identity must be authorized by the cloud provider to invoke the KMS Decrypt (and typically Encrypt) API; without those permissions the unseal call fails. Option E (a 'seal' stanza in the Vault configuration) is correct because Auto-Unseal is declared in the Vault config using a seal stanza (for example seal "awskms" or seal "azurekeyvault") that specifies the KMS provider and its parameters, which Vault reads at startup. Option A is not required, since Auto-Unseal works on a single Vault node and does not mandate a 5-node cluster (that relates to integrated storage quorum, not KMS unsealing). Option D is incorrect because a local unseal key file is the manual Shamir unseal mechanism, which Auto-Unseal is specifically designed to replace.

Answer

A cluster of at least 5 nodes.

Answer

A local unseal key file.

Question 15

Which TWO settings are considered best practices for hardening a Vault production listener?

Accepted Answer

Set tls_min_version to 'tls12'.. Option C is correct because setting tls_min_version to 'tls12' in the Vault listener stanza enforces TLS 1.2 as the minimum acceptable protocol version, preventing clients from negotiating deprecated and vulnerable protocols such as TLS 1.0 and TLS 1.1. Option D is correct because setting tls_disable to false ensures TLS encryption is enabled on the listener, which is essential for protecting Vault API traffic and client tokens in transit in a production environment. Option A is incorrect because using HTTP instead of HTTPS would transmit all Vault traffic, including tokens and secrets, in cleartext, which is the opposite of hardening. Option B is incorrect because disabling audit logs removes the ability to record and monitor requests to Vault, undermining security visibility and compliance. Option E is incorrect because setting cluster_addr to 0.0.0.0 would bind cluster communication to all interfaces, unnecessarily exposing the cluster port rather than restricting it to a specific, trusted address.

Answer

Use HTTP instead of HTTPS.

Answer

Disable audit logs.

Answer

Set cluster_addr to 0.0.0.0.