Vault Enterprise Vault Server Configuration — Timed 10 Questions

Question 1

When configuring a Vault server to use a specific Auth Method, where should the configuration be applied to ensure it persists across a cluster restart?

Accepted Answer

Via the 'vault auth enable' command.. Auth methods must be enabled and configured via the API or CLI, which saves the configuration into the backend storage (Integrated Storage).

Answer

Using environment variables exclusively.

Answer

By editing the core binary settings.

Answer

In the HCL configuration file

Question 2

Which parameter in the Vault configuration file controls the frequency of server-side background tasks?

Accepted Answer

disable_mlock. The 'default_max_request_duration' and other operational parameters are managed, but 'disable_mlock' is a critical configuration for memory hardening.

Answer

ui

Answer

max_lease_ttl

Answer

plugin_directory

Question 3

Which TWO of the following steps are required to initialize a Vault server for the first time?

Accepted Answer

Generate the master key shares.. Initialization generates the master key and the initial root token, which are the two critical outputs required to interact with a new cluster.

Answer

Unseal the cluster.

Answer

Enable secret engines.

Answer

Configure the audit device.

Question 4

What is the purpose of the 'cluster_addr' in the Vault server configuration?

Accepted Answer

To allow communication between Vault cluster nodes.. The 'cluster_addr' is used for communication between nodes in a Vault cluster (e.g., for Raft replication).

Answer

To mount storage backends.

Answer

To handle client API requests.

Answer

To communicate with external secret engines.

Question 5

A Vault performance standby node receives a request. What happens if the request is a write operation?

Accepted Answer

The request is forwarded to the active node.. Performance standby nodes forward write operations to the active node because only the active node can write to the storage backend.

Answer

The request is rejected with a 403 error.

Answer

The node processes it locally.

Answer

The node triggers an election.

Question 6

When initializing a Vault server, you choose to store the recovery keys. What is the main security advantage of using recovery keys alongside Auto-Unseal?

Accepted Answer

They allow for root token regeneration in an emergency.. Recovery keys allow for performing sensitive operations like root token generation and unseal key migration if the Auto-Unseal mechanism becomes unavailable.

Answer

They provide a way to bypass authentication.

Answer

They increase the encryption strength of the data at rest.

Answer

They are required for every client login.

Question 7

You are configuring a production Vault cluster using Integrated Storage. What is the most critical configuration parameter that must be set in the 'storage' stanza to ensure the node can correctly identify and join the existing Raft cluster during a bootstrap operation?

Accepted Answer

node_id. The 'node_id' is required for every node in a Raft cluster to uniquely identify itself to other peers in the integrated storage configuration.

Answer

path

Answer

api_addr

Answer

retry_join

Question 8

You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?

Accepted Answer

tls_disable = false. The 'tls_disable' parameter must be set to 'false' to enforce encrypted communication, which is a production hardening requirement.

Answer

tls_disable = true

Answer

proxy_protocol = true

Answer

tls_prefer_server_cipher_suites = false

Question 9

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

Accepted Answer

vault operator rekey -init. The 'vault operator rekey -init' command is used to start the process of changing the master key configuration.

Answer

vault operator unseal

Answer

vault secrets tune

Answer

vault operator rotate

Question 10

A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?

Accepted Answer

No action is required, assuming IAM permissions are correctly maintained.. Vault's Auto-Unseal configuration automatically handles the KMS key rotation if the IAM policy allows the 'decrypt' action on the new key version.

Answer

Update the 'kms_key_id' in the configuration file.

Answer

Restart the Vault process to reload the KMS configuration.

Answer

Run vault operator rekey to update the master key.