VA-003 Explain Vault architecture Practice Test 3 — 15 Questions

Question 1

An operator notices that after a network partition, a Vault cluster with integrated storage (Raft) has a node that is unreachable and does not automatically rejoin. The cluster has 5 nodes with a minimum quorum of 3. What is a likely cause for the node not rejoining?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cluster may have lost quorum due to other nodes also being down. In a Raft-based Vault cluster with 5 nodes and a quorum of 3, if a node becomes unreachable due to a network partition and does not automatically rejoin, the most likely cause is that additional nodes are also down or unreachable, causing the cluster to lose quorum. Without a majority of nodes (3 out of 5) able to communicate, the Raft consensus protocol cannot elect a leader or process log entries, so the isolated node cannot rejoin because the cluster itself is in a degraded state. The node not rejoining is a symptom of the broader quorum loss, not an isolated issue with that node.

Answer

The node's raft index is ahead of the leader's

Answer

The node's clock skew is causing Raft timeouts

Answer

The node must be manually removed from the raft configuration and re-added

Question 2

A developer wants to authenticate to Vault using a username and password without any external identity provider. Which authentication method should be enabled?

Accepted Answer

Userpass authentication. The userpass authentication method is designed for Vault to authenticate users directly with a username and password, without relying on any external identity provider. It stores the credentials within Vault's own backend, making it the correct choice for a standalone authentication scenario where no external system like LDAP or an OIDC provider is involved.

Answer

Token authentication

Answer

LDAP authentication

Answer

AppRole authentication

Question 3

During a security assessment, a penetration tester discovers that Vault's seal configuration uses a single master key stored in a file on the server. The attacker gains root access to the server and retrieves the unseal key. What is the best mitigation to prevent this scenario?

Accepted Answer

Use a cloud auto-unseal mechanism such as AWS KMS. Cloud auto-unseal mechanisms like AWS KMS decouple the unseal key from the Vault server itself. Instead of storing the master key on the local filesystem, Vault uses a cloud-based key management service (KMS) to wrap and unwrap the master key. Even if an attacker gains root access to the server, they cannot retrieve the unseal key because it is never stored locally; Vault must call the KMS API (with appropriate IAM credentials) to unseal, and those credentials can be further protected with instance profiles or roles.

Answer

Restrict network access to the Vault server with a firewall

Answer

Use Shamir's secret sharing to split the key across multiple files

Answer

Encrypt the unseal key file with a strong password

Question 4

Which TWO of the following are components of Vault's architecture? (Choose two.)

Accepted Answer

Barrier. The Barrier and Seal are fundamental components of Vault's architecture. The Barrier is an encryption layer that protects all data written to storage by encrypting it with a master key before it is persisted. The Seal is the mechanism that wraps the master key, requiring an unseal process (using Shamir's Secret Sharing or an external key service like AWS KMS) to decrypt the master key and make Vault operational.

Answer

Senlin

Answer

Consul Template

Answer

Vault Agent

Question 5

Which THREE of the following are true regarding Vault's high availability (HA) and replication? (Choose three.)

Accepted Answer

In an HA cluster with Integrated Storage, only the active node can serve write requests. In an HA cluster with Integrated Storage (Raft), only the active node can serve write requests because Raft ensures strong consistency by requiring all writes to go through the elected leader. The leader replicates the write to a quorum of follower nodes before acknowledging the client, preventing split-brain scenarios. This is a fundamental property of the Raft consensus protocol used by Vault Integrated Storage.

Answer

With Integrated Storage, all nodes can handle write requests

Answer

Disaster Recovery Replication replicates everything including policies and audit logs

Question 6

A Vault server is configured with the above snippet. After starting, the server remains in a sealed state. Which command should the operator run to complete the initial unseal?

Accepted Answer

vault operator init. The snippet shows a Vault configuration but no `seal` or `unseal` keys have been generated yet. The `vault operator init` command generates the initial root token and unseal keys, which are required before any unseal operation can be performed. Without initialization, the server has no keys to unseal with, so it remains in a sealed state.

Answer

vault operator unseal -auto

Answer

vault operator unseal <key>

Answer

vault operator generate-root

Question 7

Given the output from 'vault operator raft list-peers', which node(s) will become unavailable if node1 (leader) experiences a network partition away from all other nodes?

Accepted Answer

Only node1 becomes unavailable; the cluster remains operational with a new leader from node2 or node3. In a Raft-based Vault cluster, only the leader node becomes unavailable during a network partition that isolates it from the other nodes. The remaining nodes (node2 and node3) form a quorum (2 out of 3) and will elect a new leader, allowing the cluster to continue serving requests. Node1, being isolated, cannot participate in Raft consensus and will step down as leader, becoming unavailable for client operations.

Answer

All nodes become unavailable because node1 is the leader

Answer

No nodes become unavailable; node1 remains leader but cannot serve writes

Answer

Node1, node4, and node5 become unavailable

Question 8

A user has the above policy attached. What operation can the user perform on 'secret/data/production/db_password'?

Accepted Answer

Read the secret. The policy grants 'read' capability on 'secret/data/production/db_password'. In Vault's KV Secrets Engine v2, the 'read' capability allows retrieving the secret data and its metadata. Therefore, the user can read the secret, which includes both the data and metadata. Option B is correct because the policy explicitly allows the read operation on that path.

Answer

Update the metadata of the secret

Answer

Delete the secret

Answer

Write a new version of the secret

Question 9

A new Vault administrator unseals Vault using a single unseal key, but the Vault remains sealed. What is the most likely cause?

Accepted Answer

The administrator did not provide enough unseal keys to meet the threshold.. Vault uses a threshold-based unsealing mechanism where a minimum number of unseal keys (the threshold) must be provided to reconstruct the master key and decrypt the storage backend. Providing only a single key, even if it is valid, leaves the Vault sealed because the threshold has not been met. The administrator must continue providing distinct unseal keys until the threshold count is reached.

Answer

The storage backend is misconfigured, preventing key retrieval.

Answer

The administrator forgot to provide a valid token.

Answer

Vault needs to be re-initialized after the first unseal.

Question 10

A Vault cluster has two nodes configured for HA. The active node becomes unresponsive, and the standby node takes over. However, clients cannot connect to the new active node. The firewall rules allow traffic on port 8200. What is the most likely issue?

Accepted Answer

The TLS certificate on the standby node is not valid for the hostname clients are using.. When a standby node becomes active, clients connect using the same hostname as before. If the TLS certificate on the standby node does not include that hostname, TLS handshake fails, preventing client connections. Option A is incorrect because the standby node successfully took over, meaning it has access to the storage backend. Option C is incorrect because a tainted node indicates data corruption, not blocking client requests. Option D is incorrect because a sealed node cannot become active; if it were sealed, it would not have taken over.

Answer

The standby node cannot connect to the storage backend.

Answer

The original active node is tainted and blocking client requests.

Answer

The standby node is still sealed and cannot serve requests.

Question 11

A Vault cluster configured with auto-unseal using AWS KMS is deployed across two availability zones. After a network partition, the standby node remains sealed while the active node is unsealed and serving requests. What is the most likely reason the standby cannot unseal?

Accepted Answer

The standby node cannot communicate with AWS KMS due to the network partition.. In a Vault cluster with auto-unseal via AWS KMS, each node must independently communicate with AWS KMS to unseal itself. A network partition that isolates the standby node from AWS KMS prevents it from reaching the KMS endpoint, so it cannot decrypt its unseal key and remains sealed. The active node is unaffected because it is already unsealed and serving requests from the other side of the partition.

Answer

The standby node is using the wrong AWS region configuration.

Answer

The active node consumed all available KMS API quota for the region.

Answer

The cluster address on the standby is misconfigured.

Question 12

A company is migrating from a file storage backend to Consul. Which Vault command should be used to move the data?

Accepted Answer

vault operator migrate. The `vault operator migrate` command is specifically designed to move Vault data from one storage backend to another, such as from a file storage backend to Consul. It handles the safe transfer of all encrypted data, including secrets, policies, and tokens, while ensuring consistency and minimal downtime during the migration process.

Answer

vault operator rekey

Answer

vault operator unseal

Answer

vault operator init

Question 13

A Vault cluster uses DR replication. The primary cluster fails, and the DR secondary is promoted to primary. After promotion, some secret data written to the primary shortly before the failure is missing on the new primary. What is the most likely reason?

Accepted Answer

The data had not yet been replicated to the DR secondary before the primary failed.. In Vault DR replication, data is asynchronously replicated from the primary to the secondary cluster. If the primary fails before the replication stream has transmitted the most recent writes, those writes are lost. When the DR secondary is promoted to primary, it only contains data that was successfully replicated up to the point of failure. This is the most likely reason the secret data is missing.

Answer

The seal wrapping key was rotated on the primary after the last replication.

Answer

The secret engine was not enabled on the DR secondary.

Answer

The DR secondary was promoted with the 'force' option, which skips replication of the last writes.

Question 14

A company stores static secrets in Vault and requires that all data is encrypted at rest in the storage backend. Which Vault feature provides this encryption?

Accepted Answer

Vault's storage encryption via the barrier.. C is correct because Vault's storage encryption is handled by the security barrier, which automatically encrypts all data written to the storage backend using a 256-bit AES-GCM encryption key. This ensures that data is encrypted at rest regardless of the storage backend's own capabilities, meeting the requirement without relying on backend-specific features.

Answer

The storage backend must be configured to encrypt data.

Answer

The transit secrets engine for encrypting secrets.

Answer

The storage backend's built-in encryption (e.g., Consul's encryption).

Question 15

A Vault administrator notices that the audit log file on the Vault server is filling up the disk. What is the best course of action to prevent disk full issues?

Accepted Answer

Configure the file audit device with log rotation.. Configuring log rotation on the file audit device allows the Vault server to automatically archive or delete old audit logs based on size or time thresholds, preventing the disk from filling up while retaining necessary audit data. This is the recommended approach in Vault for managing disk space without disabling security auditing or relying on external infrastructure changes.

Answer

Disable audit logging to reduce disk usage.

Answer

Switch to a syslog audit device.

Answer

Increase the disk size of the Vault server.