VA-003 Explain Vault architecture Practice Test 2 — 15 Questions

Question 1

A company deploys Vault in a production environment with three nodes using Integrated Storage (Raft). They have configured Performance Replication to a secondary datacenter. The primary datacenter experiences a complete outage. After restoring the primary, they promote the secondary to primary. However, they notice that some secrets written to the primary just before the outage are missing in the secondary. The replication status shows no errors. What is the most likely cause and correct action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Accept the data loss and continue with the secondary as primary. Performance Replication in Vault is asynchronous, meaning there is no guarantee that all writes to the primary are replicated to the secondary before a failure. When the primary experiences a complete outage, any secrets written just before the outage that had not yet been acknowledged by the secondary are permanently lost. Since the replication status shows no errors, the system is consistent up to the last replicated point, and the only correct action is to accept the data loss and continue with the promoted secondary as the new primary.

Answer

Restore the primary from backup to recover missing secrets

Answer

Failback to the original primary after restoring it

Answer

Re-promote the original primary and use it as the new primary

Question 2

An organization uses Vault with a Consul storage backend. They have three Vault servers and three Consul servers. During a routine maintenance, they restart all Consul servers simultaneously. After the restart, Vault becomes sealed and cannot be unsealed. The Vault logs show 'storage: error listing' and 'failed to check status'. The Consul cluster is healthy with a leader. What is the most likely cause and solution?

Accepted Answer

Restore Vault's storage backend from a recent backup. When all Consul servers are restarted simultaneously, the Vault storage backend (Consul) may lose critical metadata or consistency state that Vault relies on to maintain its seal/unseal status. Even though the Consul cluster appears healthy with a leader, the underlying data corruption or loss of key-value entries (such as the barrier key or storage index) prevents Vault from reading its storage, causing it to seal and fail to unseal. Restoring Vault's storage backend from a recent backup is the correct solution because it recovers the consistent state of the data, including the encrypted master key and configuration, without requiring re-initialization.

Answer

Re-initialize Vault and generate new unseal keys

Answer

Generate a new root token using unseal keys

Answer

Use the unseal keys to unseal Vault again

Question 3

A company is deploying Vault in a high-availability configuration across three data centers. They need to ensure that if the active Vault node fails, another node can take over without manual intervention. Which Vault feature should they configure?

Accepted Answer

Configure Vault with a highly available storage backend such as Raft and enable automatic leader election.. Vault's integrated Raft storage backend supports automatic leader election via the Raft consensus protocol. When the active node fails, the remaining nodes automatically hold an election to select a new leader, ensuring high availability without manual intervention. This is the native HA mechanism for Vault when using Raft as the storage backend.

Answer

Enable performance standby nodes.

Answer

Use a load balancer with health checks to redirect traffic.

Answer

Set up Disaster Recovery (DR) replication between data centers.

Question 4

Which of the following are valid ways to authenticate to Vault? (Select all that apply.)

Accepted Answer

SAML 2.0. All of SAML 2.0, GitHub personal access token, Kubernetes auth, and LDAP authentication are valid Vault authentication methods. The SAML auth method (via plugin) enables integration with identity providers; the GitHub auth method uses personal access tokens to authenticate based on team membership; Kubernetes auth allows authentication using a Kubernetes Service Account Token; and LDAP authentication provides integration with LDAP directories. AWS EC2 instance metadata is not a direct Vault authentication method, though Vault's AWS auth method can use EC2 metadata for authentication.

Answer

AWS EC2 instance metadata

Question 5

A company runs Vault in a single cluster with three nodes using the Raft storage backend. The nodes are behind a load balancer that distributes traffic to all nodes. The operations team notices that occasionally, write operations (e.g., writing a secret or creating a policy) fail with a '502 Bad Gateway' error, while read operations succeed. The Vault audit logs show no errors. The load balancer health checks are configured to check the /v1/sys/health endpoint with a 200 response expected. The Vault nodes are all unsealed and the cluster is healthy. Which of the following is the most likely cause of the intermittent write failures?

Accepted Answer

The load balancer is sending write requests to standby nodes, which cannot handle writes.. In a Vault cluster with Raft storage, only the elected leader node can handle write operations (e.g., writing secrets, creating policies). Standby nodes serve read requests and forward writes to the leader. If the load balancer distributes traffic to all nodes without considering leadership, write requests sent to a standby node will fail with a 502 Bad Gateway error because the standby cannot process the write locally and the load balancer may not properly handle the forwarded response or timeout.

Answer

The Raft storage backend does not support write operations.

Answer

The load balancer is not configured to use the /v1/sys/leader endpoint for routing.

Answer

One of the Vault nodes is sealed, causing write requests to fail.

Question 6

A company wants to use Vault's Key Management Secrets Engine (KMSE) to encrypt data stored in AWS S3. The security team requires that the encryption key used by Vault is never exposed to the application. Which Vault architecture component ensures that the encryption key remains within the Vault boundary and is not accessible to the application?

Accepted Answer

Vault's Transit Secrets Engine. Transit Secrets Engine performs encryption/decryption using keys stored entirely within Vault. The application sends data to Vault, which processes it with the key and returns the result, ensuring the key is never exposed. KMSE (B) delegates key storage to an external KMS, placing the key outside Vault's boundary, which contradicts the requirement that the key remains within Vault.

Answer

Vault's Cubbyhole Response Wrapping

Answer

Vault's Key Management Secrets Engine (KMSE)

Answer

Vault's PKI Secrets Engine

Question 7

Which TWO statements correctly describe Vault's storage backend and seal/unseal mechanism?

Accepted Answer

During unseal, the unseal key is used to decrypt the master key which then decrypts the storage backend.. Vault's unseal process uses a threshold of unseal keys to decrypt the master key stored in the keyring. The master key then decrypts the storage backend's encryption key, allowing Vault to access the encrypted data. This ensures that the storage backend remains encrypted at rest and is only readable after a successful unseal operation.

Answer

Shamir's secret sharing splits the master key into key shares.

Answer

The storage backend is responsible for sealing and unsealing Vault.

Answer

In a Vault cluster, when a new leader is elected, it automatically unseals itself.

Question 8

A Vault operator runs `vault status` and sees the output above. The Vault cluster is in production and currently unresponsive to API requests. What is the most likely cause of the unresponsiveness?

Accepted Answer

The Vault cluster is sealed.. The `vault status` output shows that the Vault cluster is sealed. When a Vault cluster is sealed, it cannot process any API requests because the encryption key required to decrypt the data is not available in memory. This is the most common cause of unresponsiveness in a production Vault cluster that has been properly initialized.

Answer

The cluster is not initialized.

Answer

The cluster does not have HA enabled.

Answer

The cluster has no active leader.

Question 9

Drag and drop the steps to configure Vault's PKI secrets engine to issue certificates into the correct order.

Accepted Answer

Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate. The correct sequence to configure Vault's PKI secrets engine for issuing certificates is: first enable the PKI secrets engine, then generate a root certificate (self-signed CA), then create a role that defines certificate parameters, and finally issue a certificate using that role. Enabling the engine mounts it at a path, generating the root CA establishes the trust anchor, the role configures certificate properties, and the issuance step produces the actual certificate. Common mistakes include attempting to generate the root or create a role before enabling the engine, or creating the role before generating the root CA, which leads to errors or missing configurations.

Answer

Generate a root certificate, then enable PKI secrets engine, then create a role, then issue a certificate

Answer

Create a role, then enable PKI secrets engine, then generate a root certificate, then issue a certificate

Answer

Enable PKI secrets engine, then create a role, then generate a root certificate, then issue a certificate

Question 10

Match each Vault audit device to its output destination.

Accepted Answer

File: Writes audit logs to a local file. The correct matches are: File writes to a local file, Syslog sends to syslog, Socket sends to a TCP/UDP endpoint. Common confusions mix the output destinations.

Answer

File: Sends audit logs to syslog

Answer

Syslog: Writes audit logs to a file

Answer

Socket: Writes audit logs to a file

Question 11

A small startup wants to run Vault in a development environment with minimal operational overhead. They need to store secrets in memory only, without any persistence. Which storage backend should they choose?

Accepted Answer

In-memory storage backend. The in-memory storage backend stores all data in RAM with no persistence to disk, making it ideal for development environments where secrets must be lost on restart and operational overhead must be minimized. It requires no configuration, no external dependencies, and no data management, perfectly matching the requirement for minimal overhead and memory-only storage.

Answer

Integrated Storage (Raft) backend

Answer

Consul storage backend

Answer

File storage backend

Question 12

A company requires that Vault's master key be split into multiple key shares and distributed to different administrators using Shamir's Secret Sharing. They also need to ensure that Vault can automatically unseal if a majority of shares are provided but cannot rely on manual intervention. Which unseal approach should they configure?

Accepted Answer

Configure Shamir seal with a threshold and use unseal keys via a key provider. Shamir seal (also known as the 'seal' wrapping mechanism) allows Vault to use Shamir's Secret Sharing to split the master key into shares, and then automatically unseal by providing those shares via a key provider (e.g., a cloud KMS or HSM) without manual intervention. This satisfies the requirement of splitting the key among administrators while enabling auto-unseal when a majority of shares are available.

Answer

Store the master key in the transit secrets engine and unseal automatically

Answer

Use AWS KMS as a seal for auto-unseal

Answer

Use a single unseal key stored in a password manager and manually unseal

Question 13

A large enterprise runs Vault in a high-availability cluster with integrated storage (Raft). They notice that read requests are not being evenly distributed across nodes, causing some nodes to have high load. They want to offload read operations to standby nodes. What feature should they enable to achieve this?

Accepted Answer

Enable performance standby nodes. Performance standby nodes are a Vault Enterprise feature designed to handle read requests without participating in the Raft consensus write quorum. By enabling this, read operations are offloaded to standby nodes, distributing the load evenly and reducing the burden on the active cluster nodes. This directly addresses the uneven read distribution and high load on specific nodes.

Answer

Configure a load balancer with a round-robin algorithm

Answer

Enable read replicas on standby nodes

Answer

Increase the number of Raft nodes to distribute reads

Question 14

An organization has two Vault clusters in different geographic regions and wants to replicate secrets from the primary cluster to the secondary cluster for disaster recovery. Which Vault replication feature should they use?

Accepted Answer

Disaster Recovery (DR) replication. Disaster Recovery (DR) replication is the correct Vault feature for replicating secrets from a primary cluster to a secondary cluster in a different geographic region for disaster recovery. DR replication copies all data, including secrets, policies, and tokens, in a one-way direction from primary to secondary, ensuring the secondary cluster can be promoted if the primary fails. This is distinct from performance replication, which is designed for load distribution and allows writes on both sides.

Answer

Cluster replication

Answer

Active Directory replication

Answer

Performance replication

Question 15

A security team needs to audit all interactions with Vault, including requests that are denied due to policy violations. They want to ensure that even if the audit device is full, Vault does not halt operations. Which audit device configuration should they recommend?

Accepted Answer

File audit device with blocking=false and fallback path configured. The file audit device with `blocking=false` ensures that Vault does not block requests when the audit log cannot be written, preventing denial of service. The fallback path provides a secondary location to continue logging if the primary path fails, maintaining audit coverage without halting operations.

Answer

Socket audit device with a remote log aggregator

Answer

File audit device with blocking=true and a separate backup file

Answer

Syslog audit device with local syslog server