VA-003 Explain Vault architecture Practice Test 3 — 15 Questions

Question 1

A security team is configuring Vault's seal mechanism. They want to ensure that in the event of a data center outage, the Vault cluster can be unsealed without human intervention, but still require approval from multiple administrators to rekey the master key. Which seal type should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication for any key usage.. Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication (MFA) for any key usage meets the requirements: the Vault cluster can automatically unseal after a data center outage (since the unseal key is stored in KMS and accessible without human intervention), while rekeying the master key requires approval from multiple administrators (enforced by the MFA requirement on the KMS key policy). This decouples the unseal process from the rekey process, allowing automated recovery while maintaining administrative control over key rotation.

Answer

Shamir seals with auto-unseal using a cloud KMS.

Answer

HSM seal with a quorum of smart cards.

Answer

Transit seal with a key that requires manual approval from a quorum of operators.

Question 2

A Vault cluster uses Integrated Storage with 5 nodes. After a network split, the cluster loses quorum and becomes sealed. The network is restored, but the cluster does not automatically recover. What should the administrator do to recover the cluster?

Accepted Answer

Identify the node with the most recent data and use `vault operator raft recover` to create a new cluster from that node.. When a Vault cluster with Integrated Storage loses quorum due to a network split, the cluster seals itself to prevent split-brain. After the network is restored, the cluster does not automatically recover because the Raft consensus algorithm requires a majority of nodes to form a quorum. Option D is correct because `vault operator raft recover` allows an administrator to force a single node (typically the one with the most recent data) to form a new cluster, discarding the other nodes' data and re-establishing quorum.

Answer

Use `vault operator raft snapshot restore` on each node to restore from a backup.

Answer

Restart all nodes simultaneously to force a new leader election.

Answer

Manually unseal each node using the unseal keys.

Question 3

Which three characteristics are true about Vault's storage backend and seal mechanisms? (Choose three.)

Accepted Answer

The Shamir seal requires multiple unseal keys to be entered before Vault can operate.. Option C is correct because Vault's default Shamir seal splits the master key into a configurable number of key shares (default 5) with a threshold (default 3), and Vault remains sealed until enough unseal keys are entered to reconstruct the master key. Option D is correct because HSM seals let Vault auto-unseal by delegating master key encryption/decryption to a PKCS#11-compatible HSM, which also serves as a hardware root of trust protecting the key material. Option E is correct because Integrated Storage (Raft) is Vault's built-in storage backend that uses the Raft consensus protocol and is fully supported in production for both high availability and disaster recovery configurations. Option A is not correct because auto-unseal via a cloud KMS (e.g., AWS KMS, Azure Key Vault, GCP CKMS) still requires recovery keys for operations like rekeying or recovering a failed auto-unseal, so unseal keys are not eliminated entirely. Option B is not correct because Consul's leader election for its own cluster uses the Raft consensus protocol, not the gossip protocol, which is used for membership and failure detection (Serf).

Answer

Auto-unseal using a cloud KMS eliminates the need for unseal keys entirely.

Answer

Consul as a storage backend requires Consul's own gossip protocol for leader election.

Question 4

A Vault administrator wants to ensure that all secrets are encrypted at rest and in transit. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable TLS on all Vault listener configurations.. Option B is correct because enabling TLS on every Vault listener configuration (via tls_cert_file and tls_key_file in the listener stanza) secures all client-to-Vault and intra-cluster traffic, satisfying the in-transit encryption requirement. Option C is correct because Vault always encrypts data before writing it to the storage backend using barrier encryption, and a seal providing envelope encryption (such as Auto Unseal with a KMS or HSM) protects the root key that wraps the data encryption key, ensuring secrets remain encrypted at rest. Option A is incorrect because there is no VAULT_ENCRYPT environment variable; encryption at rest is inherent to Vault's barrier and is not toggled by an env var. Option D is incorrect because the audit device 'encrypt' parameter does not exist; audit devices log requests and are configured with options like file path or syslog facility, not encryption toggles. Option E is incorrect because while Integrated Storage encrypts its data, Vault already encrypts secrets at rest before they reach any backend, so a specific backend is not a necessary configuration to guarantee encryption at rest.

Answer

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Answer

Set the `encrypt` parameter on the audit device configuration.

Answer

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Question 5

A company deploys Vault in a single data center with 3 nodes using Integrated Storage. The application team reports that secret reads are slow, with median latency of 200ms. The Vault cluster is under moderate load of 100 requests per second. The administrator checks the server metrics and sees that the Raft commit latency is low, but the HTTP request handling time is high. The Vault nodes are running on virtual machines with 4 vCPUs and 8GB RAM each. The administrator suspects that the bottleneck is due to resource contention. What should the administrator do to reduce read latency without compromising availability?

Accepted Answer

Add performance standby nodes to the cluster to handle read requests.. Adding performance standby nodes is the correct solution because they are specifically designed to handle read requests without participating in the Raft consensus protocol. Since the bottleneck is high HTTP request handling time (not Raft commit latency), performance standbys offload read traffic from the active cluster nodes, reducing latency without affecting write availability or requiring changes to the existing cluster topology.

Answer

Increase the CPU and memory of the existing Vault nodes.

Answer

Switch to a Consul storage backend with more Consul servers.

Answer

Add more Vault nodes to the cluster to distribute read load.

Question 6

An organization uses Vault to manage SSH access via the SSH secrets engine. They have a large number of servers, each with a unique host key. The admin configures the SSH secrets engine with a one-time password (OTP) type. Users report that sometimes they cannot authenticate to some servers because the OTP is not accepted. The admin reviews the logs and finds that the server's SSH daemon is not contacting Vault to verify the OTP. The SSH daemon is configured with the Vault SSH helper. What is the most likely cause?

Accepted Answer

The SSH helper's client certificate is expired or not properly configured.. The SSH helper is a client-side component that must authenticate to Vault using a client certificate (mTLS) before it can verify OTPs. If this certificate is expired or misconfigured, the SSH daemon cannot establish a trusted connection to Vault, causing OTP verification to fail silently. This directly explains why the server is not contacting Vault despite the helper being installed.

Answer

The SSH secrets engine's default TTL is too short.

Answer

The Vault server is under high load and dropping requests from SSH helpers.

Answer

The Vault server's IP address has changed and the SSH helper is using the old address.

Question 7

A startup is deploying Vault for the first time. They want to use Integrated Storage for simplicity. They plan to run Vault on three small instances. During initial setup, they start the first node and initialize Vault, obtaining the unseal keys and root token. Then they start the second node and run `vault operator raft join http://<first_node>:8200`. The second node joins successfully. They then start the third node and attempt to join, but the join command fails with an error saying 'no leader'. What is the most likely cause?

Accepted Answer

The first node was not unsealed before attempting to join the third node.. In a Vault Integrated Storage (Raft) cluster, a newly joined node must be able to contact an unsealed leader to complete the join process. If the first node (the initial leader) is still sealed after initialization, it cannot participate in Raft consensus or respond to join requests. The third node's join fails with 'no leader' because the sealed first node cannot act as a leader, and the second node, while joined, has not been unsealed and thus cannot become leader either. Unsealing the first node would restore its leadership and allow the third node to join.

Answer

The third node is trying to join using the wrong IP address.

Answer

The Raft cluster requires a quorum of 2 nodes to elect a leader, but the first node may have been sealed.

Answer

The second node was not unsealed.

Question 8

A Vault administrator is troubleshooting an issue where after a network outage, the Vault cluster is sealed and cannot be unsealed. The cluster has 5 nodes using Integrated Storage. The administrator runs `vault status` on each node and receives 'sealed' response. The administrator suspects that the cluster lost quorum during the outage. The administrator checks the Raft configuration and finds that there are 3 voter nodes and 2 non-voter nodes. Which action should the administrator take to recover the cluster?

Accepted Answer

Use `vault operator raft recover` on a voter node to create a new cluster.. When a Vault cluster with Integrated Storage loses quorum (more than half of voter nodes are unavailable), the cluster cannot unseal because Raft requires a quorum of voters to elect a leader and process operations. Since all 5 nodes are sealed and the cluster has 3 voters, the outage likely caused the loss of at least 2 voters, breaking quorum. The correct recovery procedure is to use `vault operator raft recover` on a voter node, which creates a new single-node cluster with the existing data, allowing the administrator to then unseal and rejoin other nodes.

Answer

Manually unseal all nodes simultaneously.

Answer

Use `vault operator raft remove-peer` to remove the non-voter nodes.

Answer

Use `vault operator raft recover` on one of the non-voter nodes.

Question 9

A company uses Vault Enterprise with Performance Replication across two data centers. The primary data center is in us-east-1 and the secondary is in eu-west-1. They have an application that writes secrets to the primary cluster, and those secrets are replicated to the secondary cluster for read access. Recently, they noticed that some secrets written to the primary are not appearing on the secondary even after several minutes. The latency between data centers is typically 50ms. The administrator checks the replication status and sees a 'merkle sync' in progress. What is the most likely reason for the delay?

Accepted Answer

The secondary cluster is experiencing write load that is causing replication to fall behind.. Performance Replication in Vault Enterprise uses asynchronous streaming of write-ahead log (WAL) entries to replicate data to secondary clusters. When a 'merkle sync' is in progress, it indicates that the secondary cluster has fallen behind and is performing a full tree comparison to reconcile differences. The most likely cause is that the secondary cluster is under write load, which can cause it to process replication WAL streams more slowly, leading to a backlog and triggering a merkle sync to catch up.

Answer

The replication token has expired.

Answer

The primary cluster is using a different seal type than the secondary.

Answer

Performance Replication only replicates data once per hour by default.

Question 10

Refer to the exhibit. A developer issues a Vault CLI command to write a secret to path 'secret/data/team/billing'. What will be the outcome?

Accepted Answer

The write is denied because the second rule only allows read capability on the exact path, overriding the wildcard rule.. Vault policies are evaluated using a most-specific-path-wins model. The second rule explicitly allows 'read' on 'secret/data/team/billing', which is more specific than the wildcard rule 'secret/data/team/*'. Since the write operation requires 'create' or 'update' capabilities, and the specific rule only grants 'read', the write is denied even though the wildcard rule would have allowed it.

Answer

The write is denied because the policy does not include a 'write' capability.

Answer

The write is denied unless the developer is authenticated with a token that has sudo privileges.

Answer

The write is allowed if the developer uses the 'vault kv put' command with the -force flag.

Answer

The write is allowed because the first rule grants create and update to all paths under team/.

Question 11

A large e-commerce company uses Vault to manage database credentials for microservices. They have a Vault cluster of 5 nodes using Integrated Storage (Raft). To increase capacity, they add a sixth node to the cluster. Shortly after, they notice intermittent 'no leader' errors in the Vault logs, and some clients experience failures when reading secrets. The cluster was functioning correctly before the addition. What is the most likely cause and the recommended action?

Accepted Answer

The cluster now has an even number of nodes, which can cause split-brain scenarios and leader election issues. Recommended action: remove the new node to revert to 5 nodes, or add a seventh node to make it odd.. The Vault cluster uses Integrated Storage (Raft), which relies on a consensus protocol that requires an odd number of nodes to maintain a quorum. Adding a sixth node creates an even number, increasing the risk of a split-brain scenario where no single group can achieve a majority, leading to 'no leader' errors and client failures. The recommended action is to either remove the new node to revert to 5 nodes or add a seventh node to restore an odd count.

Answer

The cluster's Raft protocol requires all nodes to be voters, but the new node is a non-voter. Recommended action: promote the new node to voter.

Answer

The new node has a different storage performance, causing it to lag behind and not participate in consensus. Recommended action: replace the new node with a faster instance.

Answer

The new node was not properly joined to the cluster and is running as a standalone server. Recommended action: re-run the join command and ensure the node is part of the cluster.

Question 12

A Vault operator runs a three-node cluster with Integrated Storage (Raft). After a routine restart of the active node, clients report that write requests fail with "Vault is sealed" errors, but reads against static secrets still succeed. Which Vault architecture component explains why writes are rejected while reads continue?

Accepted Answer

The active node is unsealed and serving reads, but the write path requires a quorum of Raft peers to commit the log entry, and one peer is still catching up.. Raft requires a quorum for writes because the leader must replicate the log entry to a majority of peers before committing. Reads can be served by the active node without quorum in many configurations, which explains why static secret reads succeed while writes fail. The barrier must be unsealed for any request, so the issue is quorum, not seal state.

Answer

The active node is sealed, so the standby nodes cannot forward write requests to it, but they continue to serve read requests from their local state.

Answer

The new active node has not yet unsealed the barrier, so it can serve reads using the recovery key, but writes require the master key to be re-derived.

Answer

The barrier is still sealed, so Vault cannot decrypt the encryption key needed to write new data, but read-only paths are served from an unauthenticated cache.

Question 13

A Vault administrator is designing a disaster recovery strategy for a Vault cluster using Integrated Storage (Raft). The administrator needs to ensure that Vault can be restored to a functional state in a different data center if the primary data center is lost. Which two actions are required to enable disaster recovery for Vault? (Choose two.)

Accepted Answer

Configure a disaster recovery replication cluster in the secondary data center using the vault write -f sys/replication/dr/primary/enable command on the primary.. Disaster recovery for Vault involves both replication and backups. Enabling DR replication on the primary cluster allows data to be replicated to a secondary cluster, which can be promoted if the primary fails. Regular Raft snapshots stored offsite provide an additional recovery method. Together, these ensure that Vault can be restored in a different data center. Other options like load balancers or the migrate command do not provide the necessary replication or backup capabilities.

Answer

Use the vault operator migrate command to copy data from the primary cluster to a secondary cluster in real-time.

Answer

Enable a performance standby cluster in the secondary data center and configure it to replicate data from the primary cluster.

Answer

Set up a load balancer to distribute traffic between the primary and secondary clusters for automatic failover.

Question 14

A Vault administrator is designing a disaster recovery strategy for a Vault cluster using Integrated Storage (Raft). The administrator needs to ensure that the cluster can be restored in the event of a complete outage. Which two actions are necessary to enable a successful restore? (Choose two.)

Accepted Answer

Store the unseal keys and root token in a secure location separate from the snapshots.. To restore a Vault cluster from a snapshot, you need a recent snapshot of the data and the unseal keys to unseal the restored cluster. The root token may also be needed for initial configuration. Replication, audit logs, and exporting the master key are not required and can introduce security risks.

Answer

Export the master key and store it in a configuration management database for easy retrieval during restore.

Answer

Configure a second Vault cluster in a different region and set up replication using the vault replicate enable command.

Answer

Enable the audit log to record all restore operations for compliance purposes.

Question 15

A Vault operator is deploying a new production cluster using integrated storage (Raft). The security team requires that the cluster survive the loss of a single node without data loss. The operator provisions three nodes and configures one as active and two as standby. After the cluster is running, the operator runs `vault operator raft autopilot state` and notices that autopilot is enabled with default settings. What is the primary effect of autopilot on this cluster?

Accepted Answer

It monitors the health of Raft nodes and automatically removes failed nodes from the cluster after a configured stabilization period.. Autopilot in Vault's integrated storage continuously monitors the health of Raft nodes. When a node is deemed unhealthy, autopilot waits for a stabilization period and then removes it from the Raft configuration. This maintains a healthy quorum and prevents a failed node from causing cluster unavailability. It also can promote non-voters to voters if the number of healthy voters drops below the desired count.

Answer

It automatically promotes a standby to active if the active node fails, without requiring manual intervention.

Answer

It creates and manages snapshots of the Raft data on a schedule, storing them in the configured storage backend.

Answer

It encrypts all Raft traffic between nodes using TLS and rotates the certificates automatically.