VA-003 Explain Vault architecture Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are true regarding Vault's high availability (HA) and replication? (Choose three.)

Accepted Answer

In an HA cluster with Integrated Storage, only the active node can serve write requests. Option B is correct because in a Vault HA cluster backed by Integrated Storage (Raft), only the single active node accepts write requests; standby nodes forward client write requests to the active node. Option C is correct because performance standby nodes can service read requests locally from replicated data without forwarding them to the active node, improving read scalability. Option D is correct because Performance Replication replicates the data at the mount and auth-method level (secrets, configuration, and associated data) but does not replicate policies, tokens, leases, or audit logs. Option A is incorrect because with Integrated Storage not all nodes handle writes — only the active node does, while standbys forward writes. Option E is incorrect because Disaster Recovery Replication does not replicate everything; it replicates policies and some configuration but notably does not replicate audit logs or tokens/leases, so the claim that it includes audit logs is false.

Answer

With Integrated Storage, all nodes can handle write requests

Answer

Disaster Recovery Replication replicates everything including policies and audit logs

Question 2

Which TWO of the following storage backends are capable of high availability without external dependencies? (Choose two.)

Accepted Answer

Integrated Storage (Raft). Integrated Storage (Raft) is the only storage backend that provides high availability without external dependencies. Raft manages Vault's data across a cluster via leader election and log replication, requiring no external system. The in-memory storage backend does not support replication or HA natively, and other backends like Consul or MySQL require separate external infrastructure.

Answer

File storage backend

Answer

In-memory storage backend with replication

Answer

Consul storage backend

Answer

MySQL storage backend

Question 3

A Vault server is configured with the above snippet. After starting, the server remains in a sealed state. Which command should the operator run to complete the initial unseal?

Accepted Answer

vault operator init. The snippet shows a Vault configuration but no `seal` or `unseal` keys have been generated yet. The `vault operator init` command generates the initial root token and unseal keys, which are required before any unseal operation can be performed. Without initialization, the server has no keys to unseal with, so it remains in a sealed state.

Answer

vault operator unseal -auto

Answer

vault operator unseal <key>

Answer

vault operator generate-root

Question 4

Given the output from 'vault operator raft list-peers', which node(s) will become unavailable if node1 (leader) experiences a network partition away from all other nodes?

Accepted Answer

Only node1 becomes unavailable; the cluster remains operational with a new leader from node2 or node3. In a Raft-based Vault cluster, only the leader node becomes unavailable during a network partition that isolates it from the other nodes. The remaining nodes (node2 and node3) form a quorum (2 out of 3) and will elect a new leader, allowing the cluster to continue serving requests. Node1, being isolated, cannot participate in Raft consensus and will step down as leader, becoming unavailable for client operations.

Answer

All nodes become unavailable because node1 is the leader

Answer

No nodes become unavailable; node1 remains leader but cannot serve writes

Answer

Node1, node4, and node5 become unavailable

Question 5

A user has the above policy attached. What operation can the user perform on 'secret/data/production/db_password'?

Accepted Answer

Read the secret. The policy grants 'read' capability on 'secret/data/production/db_password'. In Vault's KV Secrets Engine v2, the 'read' capability allows retrieving the secret data and its metadata. Therefore, the user can read the secret, which includes both the data and metadata. Option B is correct because the policy explicitly allows the read operation on that path.

Answer

Update the metadata of the secret

Answer

Delete the secret

Answer

Write a new version of the secret

Question 6

A Vault cluster has two nodes configured for HA. The active node becomes unresponsive, and the standby node takes over. However, clients cannot connect to the new active node. The firewall rules allow traffic on port 8200. What is the most likely issue?

Accepted Answer

The TLS certificate on the standby node is not valid for the hostname clients are using.. The most likely issue is that the TLS certificate on the standby node is not valid for the hostname clients are using (B). When the standby takes over, clients connect to the same hostname (e.g., vault.example.com), but if the standby's certificate does not include that hostname in its Subject Alternative Name (SAN), TLS verification fails, preventing connection. Firewall rules allow port 8200, so network connectivity is not the issue.

Answer

The standby node cannot connect to the storage backend.

Answer

The original active node is tainted and blocking client requests.

Answer

The standby node is still sealed and cannot serve requests.

Question 7

A Vault administrator notices that the audit log file on the Vault server is filling up the disk. What is the best course of action to prevent disk full issues?

Accepted Answer

Configure the file audit device with log rotation.. Configuring log rotation on the file audit device allows the Vault server to automatically archive or delete old audit logs based on size or time thresholds, preventing the disk from filling up while retaining necessary audit data. This is the recommended approach in Vault for managing disk space without disabling security auditing or relying on external infrastructure changes.

Answer

Disable audit logging to reduce disk usage.

Answer

Switch to a syslog audit device.

Answer

Increase the disk size of the Vault server.

Question 8

Which THREE are requirements for a Vault High Availability (HA) cluster?

Accepted Answer

A shared storage backend accessible by all nodes.. In a Vault HA cluster, the storage backend must be shared and accessible by all nodes (C) because it holds the encrypted data and the HA lock that determines which node becomes active, allowing any standby to take over. The active node must be able to handle all requests (D) since only the active node services reads and writes in Vault's HA model, while standbys remain on hot standby. Standby nodes must forward requests to the active node (E) so that clients hitting a standby are redirected rather than served locally, preserving consistency. Option A is incorrect because standby nodes in Vault HA do not serve read requests; only the active node handles reads and writes. Option B is incorrect because a load balancer is a common deployment recommendation for distributing client traffic, not a hard requirement for the HA cluster itself.

Answer

Standby nodes must be able to serve read requests.

Answer

A load balancer in front of all nodes.

Question 9

Which TWO statements about Vault replication are correct?

Accepted Answer

DR replication replicates all data including tokens and leases.. Option B is correct because disaster recovery (DR) replication is designed to maintain a full copy of the primary cluster's data, including tokens and leases, so that a DR secondary can take over completely if the primary is lost. Option C is correct because performance replication is intended to offload read traffic: secondary clusters can serve read requests locally (for example, reads against replicated secrets engines and auth methods), reducing latency and load on the primary. Option A is not correct because a DR secondary can be promoted to primary through a promotion operation regardless of whether the original primary is offline; the primary being offline is not a strict requirement. Option D is not correct because performance replication does not replicate all secrets and auth methods in the same full-fidelity way as DR; it replicates a subset of data and excludes certain operational data such as tokens and leases. Option E is not correct because Vault replication does not require a shared storage backend; each cluster maintains its own storage, and replication is performed over the network between clusters.

Answer

A DR secondary can be promoted to primary only if the primary is offline.

Answer

Performance replication replicates all secrets and auth methods.

Answer

Both performance and DR replication require a shared storage backend.

Question 10

An organization requires that all Vault secrets be encrypted with a key derived from a hardware security module (HSM) and that the cluster can be unsealed automatically. Which seal type should they use?

Accepted Answer

PKCS11 seal. The PKCS11 seal type is correct because it enables Vault to derive the unseal key from a key stored in a hardware security module (HSM) via the PKCS#11 interface. This allows automatic unsealing of the cluster by leveraging the HSM's key, meeting both the encryption and auto-unseal requirements.

Answer

Transit seal

Answer

Shamir seal

Answer

Cloud KMS seal

Question 11

A Vault administrator is configuring Consul as the storage backend. The Consul cluster will span three data centers with low latency links. Which Consul deployment is recommended for Vault to ensure data safety?

Accepted Answer

5 Consul servers in a single datacenter. Vault requires a strong consistency guarantee for its storage backend, and Consul achieves this via the Raft consensus protocol, which requires a majority of servers to be available. A single datacenter with 5 Consul servers provides the necessary fault tolerance and quorum (3 out of 5) to survive failures while maintaining data safety. Spreading servers across datacenters with low latency links still introduces network partitions and higher latency, which can break Raft's stability and lead to split-brain scenarios or degraded performance.

Answer

3 Consul servers across 3 datacenters (1 per DC)

Answer

3 Consul servers in each datacenter (total 9)

Answer

3 Consul servers in one datacenter with agents in others

Question 12

After a failover event in a Vault HA cluster with Integrated Storage, the new active node reports a 'sealed' status incorrectly in monitoring metrics, but the cluster is still functioning correctly. What is the most likely cause?

Accepted Answer

Inconsistent seal configuration across nodes.. When a Vault HA cluster with Integrated Storage experiences a failover, the new active node must have a seal configuration that matches the cluster's unseal mechanism. If the seal configuration (e.g., Shamir threshold, auto-unseal KMS key, or transit engine path) is inconsistent across nodes, the new active node may report as 'sealed' in monitoring metrics even though the cluster is functional. This happens because the monitoring endpoint reads the node's local seal status, which can differ from the actual cluster state if the node cannot properly verify its own unseal state due to misconfiguration.

Answer

The new active node is actually a standby.

Answer

The Vault token used for monitoring has expired.

Answer

The storage backend is corrupted.

Question 13

Which TWO components are required for Vault to start and function? (Choose two.)

Accepted Answer

Storage backend. Option B (Storage backend) is correct because Vault requires a configured storage backend (e.g., Integrated Storage/Raft, Consul, or File) to persist data such as secrets, tokens, and configuration; without it, Vault cannot initialize or start. Option E (Seal mechanism) is correct because Vault always operates with a seal/unseal mechanism (Shamir or Auto-unseal via a KMS/HSM) that protects the master key and root data; the seal is intrinsic to Vault's startup and unseal process. Option A (Authentication method) is not required at startup since auth methods like userpass, LDAP, or AppRole are enabled after initialization and are optional for basic operation. Option C (Listener) is not strictly required to start Vault in dev mode, which uses an in-memory listener by default, so it is not one of the two mandatory components. Option D (Audit device) is not required to start Vault; audit devices are optional and can be enabled later for logging requests and responses.

Answer

Authentication method

Answer

Listener

Answer

Audit device

Question 14

Refer to the exhibit. A Vault policy is defined as shown. A user presents a token with this policy. Which operation will be permitted?

Accepted Answer

Create secret/data/engineering/config. The policy grants `create` and `update` capabilities on `secret/data/engineering/*`, which allows creating secrets under that path. Option C is correct because the `create` capability permits writing a new secret at `secret/data/engineering/config`, as the path matches the glob pattern and the operation is a write (POST/PUT).

Answer

List secret/data/finance

Answer

Delete secret/data/finance/budget

Answer

Read secret/data/finance

Question 15

A DevOps engineer is designing a Vault architecture for a multi-cloud environment spanning AWS, GCP, and on-premises data centers. The requirement is to have low-latency read access to secrets across all regions, and the ability to handle a full regional outage without manual intervention. Which architecture best meets these requirements?

Accepted Answer

Single Vault cluster spread across all regions using Integrated Storage with voter and non-voter nodes.. A single Vault cluster using Integrated Storage with voter and non-voter nodes can span multiple regions and clouds, providing low-latency reads via local non-voter nodes while maintaining a single Raft consensus group. This architecture handles a full regional outage without manual intervention because the Raft protocol automatically maintains quorum across voter nodes, and non-voter nodes can be promoted if needed, ensuring continuous read availability and automatic failover.

Answer

Single Vault cluster with performance standby nodes in each region.

Answer

Multiple Vault clusters with disaster recovery replication using Performance Replication.

Answer

Multiple Vault clusters with Disaster Recovery (DR) replication and an automated failover script that promotes a DR cluster to primary.