VA-003 Explain Vault architecture Practice Test 4 — 15 Questions

Question 1

After a security incident, the Vault administrator needs to change the encryption key used to encrypt data at rest. They have already rekeyed the unseal keys. What additional step is required to ensure new secrets are encrypted with a new key?

Accepted Answer

Run 'vault operator rotate' to rotate the encryption key.. Option B is correct because the `vault operator rotate` command rotates the encryption key used by Vault's keyring to encrypt data at rest. After rekeying the unseal keys, the administrator must rotate the encryption key so that new secrets written to the storage backend are encrypted with a fresh key, while existing data remains decryptable with the old key until it is rewritten.

Answer

Reinitialize Vault with new unseal keys.

Answer

Migrate all secrets to a new mount and delete the old one.

Answer

Run 'vault operator rekey' again with different parameters.

Question 2

Which TWO are core components of Vault's architecture?

Accepted Answer

Seal. The Seal is a core component of Vault's architecture because it provides the mechanism to encrypt and decrypt the master key, which is used to protect all other keys and data within Vault. When Vault is sealed, the master key is encrypted and cannot be accessed, rendering the Vault unable to decrypt its data. Unsealing requires a threshold of unseal keys to reconstruct the master key, ensuring that no single individual can access the Vault's secrets.

Answer

Audit device

Answer

Auth method

Answer

Replication

Question 3

Which THREE are requirements for a Vault High Availability (HA) cluster?

Accepted Answer

A shared storage backend accessible by all nodes.. Option C is correct because Vault HA clusters require a shared storage backend (e.g., Consul, Integrated Storage, or Raft) that all nodes can access to maintain consistent state. Without shared storage, standby nodes cannot synchronize data or take over seamlessly if the active node fails.

Answer

Standby nodes must be able to serve read requests.

Answer

A load balancer in front of all nodes.

Question 4

Which TWO statements about Vault replication are correct?

Accepted Answer

DR replication replicates all data including tokens and leases.. Option B is correct because Vault DR replication is designed to replicate all data, including tokens, leases, and secrets, to a secondary cluster for disaster recovery purposes. This ensures that the secondary cluster can take over with a complete state if the primary fails, as it mirrors the entire Vault data store.

Answer

A DR secondary can be promoted to primary only if the primary is offline.

Answer

Performance replication replicates all secrets and auth methods.

Answer

Both performance and DR replication require a shared storage backend.

Question 5

Refer to the exhibit. What seal mechanism is configured for this Vault instance?

Accepted Answer

AWS KMS auto-unseal. The exhibit shows a Vault instance configured with `seal "awskms"` and a `region` and `kms_key_id` specified. This indicates that AWS KMS is used as the auto-unseal mechanism, where Vault delegates the unsealing process to AWS Key Management Service, eliminating the need for manual Shamir key shares.

Answer

HSM seal via PKCS#11

Answer

Shamir seal with default shares

Answer

No seal; Vault is in insecure mode

Question 6

Refer to the exhibit. Based on the output from 'vault status', which statement is true?

Accepted Answer

The unseal configuration uses 5 key shares with a threshold of 3.. The 'vault status' output shows 'Sealed: false', 'Key Shares: 5', and 'Key Threshold: 3'. This indicates that Vault is unsealed and uses a Shamir seal configuration with 5 key shares, requiring any 3 of them to unseal. Option B correctly states this unseal configuration.

Answer

The storage backend is a file backend.

Answer

Auto-unseal is enabled using Consul as the seal provider.

Answer

Vault is not configured for high availability.

Question 7

Refer to the exhibit. What operation was performed on the secret "mysecret"?

Accepted Answer

Read. The exhibit shows a Vault CLI command that retrieves the value of a secret at the path 'secret/mysecret'. The 'vault read' command is used to read data from Vault's key-value store, returning the stored value. Since the command 'vault read secret/mysecret' is executed, the operation performed is a Read, making option B correct.

Answer

Write

Answer

Delete

Answer

List

Question 8

A company requires that Vault data be continuously replicated from a primary data center to a secondary data center for disaster recovery. The secondary data center must be able to become writable in the event of a primary failure. Which Vault feature should they use?

Accepted Answer

Disaster Recovery Replication. Disaster Recovery (DR) Replication is the correct choice because it provides asynchronous replication of Vault data (including configuration, policies, and secrets) from a primary cluster to a secondary cluster. In the event of a primary failure, the secondary cluster can be promoted to become writable, ensuring business continuity. This feature is specifically designed for disaster recovery scenarios where the secondary site must be able to take over write operations.

Answer

Performance Replication

Answer

Consul as storage backend

Answer

Performance Standby

Question 9

A Vault cluster uses Consul for HA. After a brief network partition, a standby node loses contact with the active node. What does the standby node do after a timeout?

Accepted Answer

It seals itself.. In a Vault cluster using Consul for high availability, only the active node serves requests. When a standby node loses contact with the active node due to a network partition, it cannot verify the active node's health or its own leadership status. After a configurable timeout (default 10 seconds), the standby node seals itself to prevent serving stale or inconsistent data, ensuring data integrity and security.

Answer

It becomes the active node.

Answer

It continues to serve requests.

Answer

It replicates data from the storage backend.

Question 10

An organization requires that all Vault secrets be encrypted with a key derived from a hardware security module (HSM) and that the cluster can be unsealed automatically. Which seal type should they use?

Accepted Answer

PKCS11 seal. The PKCS11 seal type is correct because it enables Vault to derive the unseal key from a key stored in a hardware security module (HSM) via the PKCS#11 interface. This allows automatic unsealing of the cluster by leveraging the HSM's key, meeting both the encryption and auto-unseal requirements.

Answer

Transit seal

Answer

Shamir seal

Answer

Cloud KMS seal

Question 11

In a Vault HA cluster, which node is responsible for handling all write requests?

Accepted Answer

The active node only. In a Vault HA cluster, only the active node can handle write requests. This is because the active node holds the storage backend lock and is the only node that can modify the underlying data store. Standby nodes forward write requests to the active node, ensuring data consistency and preventing split-brain scenarios.

Answer

All nodes

Answer

Standby nodes

Answer

The node that receives the request

Question 12

A Vault administrator is configuring Consul as the storage backend. The Consul cluster will span three data centers with low latency links. Which Consul deployment is recommended for Vault to ensure data safety?

Accepted Answer

5 Consul servers in a single datacenter. Option D is correct because Vault requires a strong consistency guarantee for its storage backend, and Consul achieves this via the Raft consensus protocol, which requires a majority of servers to be available. A single datacenter with 5 Consul servers provides the necessary fault tolerance and quorum (3 out of 5) to survive failures while maintaining data safety. Spreading servers across datacenters with low latency links still introduces network partitions and higher latency, which can break Raft's stability and lead to split-brain scenarios or degraded performance.

Answer

3 Consul servers across 3 datacenters (1 per DC)

Answer

3 Consul servers in each datacenter (total 9)

Answer

3 Consul servers in one datacenter with agents in others

Question 13

After a failover event in a Vault HA cluster with Integrated Storage, the new active node reports a 'sealed' status incorrectly in monitoring metrics, but the cluster is still functioning correctly. What is the most likely cause?

Accepted Answer

Inconsistent seal configuration across nodes.. When a Vault HA cluster with Integrated Storage experiences a failover, the new active node must have a seal configuration that matches the cluster's unseal mechanism. If the seal configuration (e.g., Shamir threshold, auto-unseal KMS key, or transit engine path) is inconsistent across nodes, the new active node may report as 'sealed' in monitoring metrics even though the cluster is functional. This happens because the monitoring endpoint reads the node's local seal status, which can differ from the actual cluster state if the node cannot properly verify its own unseal state due to misconfiguration.

Answer

The new active node is actually a standby.

Answer

The Vault token used for monitoring has expired.

Answer

The storage backend is corrupted.

Question 14

What is the purpose of the `storage` stanza in a Vault server configuration file?

Accepted Answer

Defines where Vault stores encrypted data.. The `storage` stanza in a Vault server configuration file defines the backend where Vault stores all encrypted data, including secrets, tokens, and metadata. This backend can be a file system, Consul, Raft, or other supported storage backends, and it is the persistent layer that holds the encrypted data after it has been processed by the seal mechanism. Without a properly configured `storage` stanza, Vault cannot persist any data and will fail to start.

Answer

Defines the encryption algorithm for secrets.

Answer

Defines the seal mechanism.

Answer

Defines the listener address.

Question 15

A Vault cluster with three nodes using Integrated Storage (Raft) is healthy with one active and two standby nodes. A network partition isolates the active node. What will happen?

Accepted Answer

The two standby nodes elect a new leader and continue writing.. In a Vault cluster with Integrated Storage (Raft), a majority of nodes (quorum) is required to maintain leadership and process write operations. When the active node is isolated, the two remaining standby nodes still constitute a majority (2 out of 3). They will hold a new leader election using the Raft consensus algorithm, elect a new active node, and continue accepting write requests. The isolated node, upon reconnection, will be treated as a follower and replicate data from the new leader.

Answer

The two standby nodes will seal themselves.

Answer

The two standby nodes remain in standby state.

Answer

The cluster becomes read-only until the active node rejoins.