VA-003 Explain Vault architecture — 30 Questions

Question 1

A DevOps team is deploying Vault in a Kubernetes cluster. They want to ensure that when a pod starts, it can obtain a short-lived Vault token without human intervention. Which Vault architecture component should they use?

Accepted Answer

Vault Agent sidecar. Option C is correct because the Vault Agent sidecar runs alongside the application container in the same pod, automatically authenticating to Vault and retrieving a short-lived token. This eliminates the need for human intervention by handling the authentication lifecycle (e.g., using Kubernetes auth method) and renewing or re-authenticating as needed, ensuring the application always has a valid token.

Answer

Audit Device

Answer

Storage Backend (Consul)

Answer

Vault CLI with token helper

Question 2

During a performance test, Vault becomes unresponsive for several seconds when the storage backend experiences high latency. Which architectural change would best improve Vault's resilience to storage latency?

Accepted Answer

Configure Performance Standby nodes. Performance Standby nodes are designed to handle read requests and can serve as hot standbys that take over active duty if the primary node becomes unresponsive due to storage backend latency. They maintain a local copy of the data via replication, allowing them to continue serving requests without waiting for the slow storage backend, thus improving resilience to high-latency storage conditions.

Answer

Add more storage backend nodes

Answer

Disable storage replication

Answer

Increase the number of Vault nodes without replication

Question 3

A security engineer wants to ensure that all requests to Vault are logged for compliance. Which component must be configured?

Accepted Answer

Audit Device. An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

Answer

Secrets Engine

Answer

Storage Backend

Answer

Auth Method

Question 4

A company is using Vault's Integrated Storage (Raft) for high availability. During a network partition, two Vault nodes become isolated from the third. What happens to the isolated nodes?

Accepted Answer

The two isolated nodes continue to serve requests, the third stops. In Vault Integrated Storage (Raft), a quorum of nodes (majority) is required to maintain cluster leadership and serve requests. During a network partition where two nodes are isolated from the third, the two nodes form a majority (2 out of 3) and can continue to serve requests, while the isolated third node loses quorum and stops serving requests to prevent split-brain. This behavior is enforced by the Raft consensus algorithm, which requires a majority for any write or read operations to ensure consistency.

Answer

All three nodes automatically rejoin after partition

Answer

All three nodes continue to serve requests

Answer

The two isolated nodes stop serving requests

Question 5

An administrator notices that after a Vault unseal operation, the root token is no longer usable. The audit logs show no revocations. What is the most likely cause?

Accepted Answer

The root token was stored in memory only and lost on seal. When a Vault node is sealed, all in-memory data, including the root token, is wiped. The root token is not persisted to storage by default; it is only stored in memory after initialization or unseal. If the token was not explicitly persisted (e.g., via a recovery key or a generated token with a storage backend), it is lost upon seal, making it unusable after a subsequent unseal operation.

Answer

The root token's TTL expired during unseal

Answer

The root token was revoked during unseal

Answer

The root token's policy was removed

Question 6

Which Vault component is responsible for encrypting data before storing it in the storage backend?

Accepted Answer

Barrier. The Barrier (also known as the Security Barrier) is the Vault component responsible for encrypting all data before it is written to the storage backend. It wraps every entry with encryption using the master key, ensuring that data at rest is never stored in plaintext. This is a core architectural layer that provides a cryptographic boundary between Vault's internal operations and the underlying storage.

Answer

Storage Backend

Answer

Audit Device

Answer

Secrets Engine

Question 7

A team wants to use Vault's AWS auth method to authenticate EC2 instances. Which architectural requirement must be met?

Accepted Answer

Vault must be able to reach the AWS metadata endpoint. The AWS auth method in Vault authenticates EC2 instances by verifying the instance's identity via the AWS metadata endpoint (http://169.254.169.254/latest/meta-data/). Vault must be able to reach this endpoint to retrieve the instance's PKCS7 signature, instance ID, and account ID, which are used to validate the instance's IAM role and ensure it matches the configured auth role. Without network access to the metadata endpoint, Vault cannot perform the cryptographic verification required for authentication.

Answer

Each EC2 instance must have an IAM role attached

Answer

Vault must have AWS API credentials configured

Answer

Vault must be deployed on an EC2 instance in the same region

Question 8

A Vault cluster uses Integrated Storage. During a planned upgrade, the administrator wants to minimize downtime. Which upgrade strategy should be used?

Accepted Answer

Perform a rolling upgrade one node at a time. Integrated Storage (Raft-based) requires a quorum of nodes to maintain cluster availability. A rolling upgrade, where each node is upgraded one at a time, ensures that the cluster never loses quorum (more than half of the nodes remain online and functional), minimizing downtime while the upgrade proceeds.

Answer

Upgrade all nodes at once

Answer

Stop all nodes, upgrade, then start

Answer

Add new upgraded nodes then remove old ones

Question 9

What is the purpose of the Seal/Unseal process in Vault architecture?

Accepted Answer

To enable Vault to process requests. The Seal/Unseal process in Vault is a security mechanism that protects the encryption key used to encrypt data at rest. When Vault starts, it is in a sealed state and cannot process any requests until it is unsealed by providing a threshold number of unseal keys (shards). Unsealing decrypts the master key in memory, allowing Vault to access the storage backend and serve API requests. Option D is correct because the primary purpose is to enable Vault to process requests after a secure startup.

Answer

To delete old secrets

Answer

To rotate the encryption key

Answer

To back up the storage backend

Question 10

Which TWO components are required for Vault to process client requests after startup?

Accepted Answer

Unseal key shares. C is correct because Vault starts in a sealed state and requires a threshold of unseal key shares to reconstruct the master key and decrypt the storage backend. Without unsealing, Vault cannot access any data or process client requests. E is correct because an enabled auth method is necessary to authenticate clients; Vault rejects all unauthenticated requests by default.

Answer

Audit Device

Answer

A policy

Answer

A secrets engine

Question 11

Which THREE architectural considerations are important when designing a multi-datacenter Vault deployment?

Accepted Answer

Use separate storage backends per datacenter. Option C is correct because in a multi-datacenter Vault deployment, each datacenter must have its own independent storage backend to avoid a single point of failure and to ensure that a failure in one datacenter does not corrupt or disrupt the storage layer of another. Vault’s architecture requires that each cluster manages its own storage backend (e.g., Consul, Integrated Storage, or Raft) to maintain data isolation and consistency within that datacenter.

Answer

Use a single storage backend across datacenters

Answer

Deploy a single Vault cluster spanning datacenters

Question 12

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Option A is correct because Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data

Question 13

A company deploys Vault in a production environment with three nodes using Integrated Storage (Raft). They have configured Performance Replication to a secondary datacenter. The primary datacenter experiences a complete outage. After restoring the primary, they promote the secondary to primary. However, they notice that some secrets written to the primary just before the outage are missing in the secondary. The replication status shows no errors. What is the most likely cause and correct action?

Accepted Answer

Accept the data loss and continue with the secondary as primary. Performance Replication in Vault is asynchronous, meaning there is no guarantee that all writes to the primary are replicated to the secondary before a failure. When the primary experiences a complete outage, any secrets written just before the outage that had not yet been acknowledged by the secondary are permanently lost. Since the replication status shows no errors, the system is consistent up to the last replicated point, and the only correct action is to accept the data loss and continue with the promoted secondary as the new primary.

Answer

Restore the primary from backup to recover missing secrets

Answer

Failback to the original primary after restoring it

Answer

Re-promote the original primary and use it as the new primary

Question 14

An organization uses Vault with a Consul storage backend. They have three Vault servers and three Consul servers. During a routine maintenance, they restart all Consul servers simultaneously. After the restart, Vault becomes sealed and cannot be unsealed. The Vault logs show 'storage: error listing' and 'failed to check status'. The Consul cluster is healthy with a leader. What is the most likely cause and solution?

Accepted Answer

Restore Vault's storage backend from a recent backup. When all Consul servers are restarted simultaneously, the Vault storage backend (Consul) may lose critical metadata or consistency state that Vault relies on to maintain its seal/unseal status. Even though the Consul cluster appears healthy with a leader, the underlying data corruption or loss of key-value entries (such as the barrier key or storage index) prevents Vault from reading its storage, causing it to seal and fail to unseal. Restoring Vault's storage backend from a recent backup is the correct solution because it recovers the consistent state of the data, including the encrypted master key and configuration, without requiring re-initialization.

Answer

Re-initialize Vault and generate new unseal keys

Answer

Generate a new root token using unseal keys

Answer

Use the unseal keys to unseal Vault again

Question 15

A company is deploying Vault in a high-availability configuration across three data centers. They need to ensure that if the active Vault node fails, another node can take over without manual intervention. Which Vault feature should they configure?

Accepted Answer

Configure Vault with a highly available storage backend such as Raft and enable automatic leader election.. Option A is correct because Vault's integrated Raft storage backend supports automatic leader election via the Raft consensus protocol. When the active node fails, the remaining nodes automatically hold an election to select a new leader, ensuring high availability without manual intervention. This is the native HA mechanism for Vault when using Raft as the storage backend.

Answer

Enable performance standby nodes.

Answer

Use a load balancer with health checks to redirect traffic.

Answer

Set up Disaster Recovery (DR) replication between data centers.

Question 16

Which TWO of the following are valid ways to authenticate to Vault?

Accepted Answer

Kubernetes auth. Kubernetes auth is a valid Vault authentication method that allows Kubernetes service accounts to authenticate to Vault using a JSON Web Token (JWT) and a service account token. It is a first-class auth method in Vault, designed for dynamic, short-lived credentials in containerized environments.

Answer

SAML 2.0

Answer

GitHub personal access token

Answer

AWS EC2 instance metadata

Question 17

A company runs Vault in a single cluster with three nodes using the Raft storage backend. The nodes are behind a load balancer that distributes traffic to all nodes. The operations team notices that occasionally, write operations (e.g., writing a secret or creating a policy) fail with a '502 Bad Gateway' error, while read operations succeed. The Vault audit logs show no errors. The load balancer health checks are configured to check the /v1/sys/health endpoint with a 200 response expected. The Vault nodes are all unsealed and the cluster is healthy. Which of the following is the most likely cause of the intermittent write failures?

Accepted Answer

The load balancer is sending write requests to standby nodes, which cannot handle writes.. In a Vault cluster with Raft storage, only the elected leader node can handle write operations (e.g., writing secrets, creating policies). Standby nodes serve read requests and forward writes to the leader. If the load balancer distributes traffic to all nodes without considering leadership, write requests sent to a standby node will fail with a 502 Bad Gateway error because the standby cannot process the write locally and the load balancer may not properly handle the forwarded response or timeout.

Answer

The Raft storage backend does not support write operations.

Answer

The load balancer is not configured to use the /v1/sys/leader endpoint for routing.

Answer

One of the Vault nodes is sealed, causing write requests to fail.

Question 18

A company wants to use Vault's Key Management Secrets Engine (KMSE) to encrypt data stored in AWS S3. The security team requires that the encryption key used by Vault is never exposed to the application. Which Vault architecture component ensures that the encryption key remains within the Vault boundary and is not accessible to the application?

Accepted Answer

Vault's Key Management Secrets Engine (KMSE). Option B is correct because the Key Management Secrets Engine (KMSE) is specifically designed to allow Vault to act as a key management service (KMS) for external cloud providers like AWS. When configured, the actual encryption key is generated and stored within the AWS KMS service, and Vault only holds a key reference or a key ID. The application never receives the raw encryption key; instead, it requests encryption/decryption operations from Vault, which forwards them to AWS KMS, ensuring the key never leaves the Vault boundary.

Answer

Vault's Cubbyhole Response Wrapping

Answer

Vault's Transit Secrets Engine

Answer

Vault's PKI Secrets Engine

Question 19

Which TWO statements correctly describe Vault's storage backend and seal/unseal mechanism?

Accepted Answer

During unseal, the unseal key is used to decrypt the master key which then decrypts the storage backend.. Option A is correct because Vault's unseal process uses a threshold of unseal keys to decrypt the master key stored in the keyring. The master key then decrypts the storage backend's encryption key, allowing Vault to access the encrypted data. This ensures that the storage backend remains encrypted at rest and is only readable after a successful unseal operation.

Answer

Shamir's secret sharing splits the master key into key shares.

Answer

The storage backend is responsible for sealing and unsealing Vault.

Answer

In a Vault cluster, when a new leader is elected, it automatically unseals itself.

Question 20

A Vault operator runs `vault status` and sees the output above. The Vault cluster is in production and currently unresponsive to API requests. What is the most likely cause of the unresponsiveness?

Accepted Answer

The Vault cluster is sealed.. The `vault status` output shows that the Vault cluster is sealed. When a Vault cluster is sealed, it cannot process any API requests because the encryption key required to decrypt the data is not available in memory. This is the most common cause of unresponsiveness in a production Vault cluster that has been properly initialized.

Answer

The cluster is not initialized.

Answer

The cluster does not have HA enabled.

Answer

The cluster has no active leader.