VA-003 Explain Vault architecture Practice Test 4 — 15 Questions

Question 1

A Vault administrator is designing a disaster recovery strategy for a Vault cluster using integrated storage (Raft). The cluster runs in a single datacenter and must be able to recover from a complete loss of the datacenter. The administrator wants to use Vault's built-in disaster recovery replication. Which two statements about Vault disaster recovery replication are true? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disaster recovery replication continuously replicates all data, including secrets, policies, and tokens, to the secondary cluster.. Disaster recovery replication is designed for failover to a secondary cluster in case the primary is lost. It continuously replicates all data, including secrets and policies, to the secondary. The secondary remains in a standby state until a failover promotes it to primary, at which point it can serve requests and accept writes. This provides a robust disaster recovery solution for Vault.

Answer

Disaster recovery replication can be configured between clusters with different storage backends, such as Raft and Consul.

Answer

Disaster recovery replication requires a secondary cluster that is always active and can serve read requests.

Answer

The secondary cluster must be unsealed with the same unseal keys as the primary cluster to receive replicated data.

Question 2

A DevOps team is deploying Vault in a Kubernetes cluster. They want to ensure that when a pod starts, it can obtain a short-lived Vault token without human intervention. Which Vault architecture component should they use?

Accepted Answer

Vault Agent sidecar. The Vault Agent sidecar runs alongside the application container in the same pod, automatically authenticating to Vault and retrieving a short-lived token. This eliminates the need for human intervention by handling the authentication lifecycle (e.g., using Kubernetes auth method) and renewing or re-authenticating as needed, ensuring the application always has a valid token.

Answer

Audit Device

Answer

Storage Backend (Consul)

Answer

Vault CLI with token helper

Question 3

A security engineer wants to ensure that all requests to Vault are logged for compliance. Which component must be configured?

Accepted Answer

Audit Device. An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

Answer

Secrets Engine

Answer

Storage Backend

Answer

Auth Method

Question 4

Which Vault component is responsible for encrypting data before storing it in the storage backend?

Accepted Answer

Barrier. The Barrier (also known as the Security Barrier) is the Vault component responsible for encrypting all data before it is written to the storage backend. It wraps every entry with encryption using the master key, ensuring that data at rest is never stored in plaintext. This is a core architectural layer that provides a cryptographic boundary between Vault's internal operations and the underlying storage.

Answer

Storage Backend

Answer

Audit Device

Answer

Secrets Engine

Question 5

A Vault cluster uses Integrated Storage. During a planned upgrade, the administrator wants to minimize downtime. Which upgrade strategy should be used?

Accepted Answer

Perform a rolling upgrade one node at a time. Integrated Storage (Raft-based) requires a quorum of nodes to maintain cluster availability. A rolling upgrade, where each node is upgraded one at a time, ensures that the cluster never loses quorum (more than half of the nodes remain online and functional), minimizing downtime while the upgrade proceeds.

Answer

Upgrade all nodes at once

Answer

Stop all nodes, upgrade, then start

Answer

Add new upgraded nodes then remove old ones

Question 6

What is the purpose of the Seal/Unseal process in Vault architecture?

Accepted Answer

To enable Vault to process requests. The Seal/Unseal process in Vault is a security mechanism that protects the encryption key used to encrypt data at rest. When Vault starts, it is in a sealed state and cannot process any requests until it is unsealed by providing a threshold number of unseal keys (shards). Unsealing decrypts the master key in memory, allowing Vault to access the storage backend and serve API requests. Option D is correct because the primary purpose is to enable Vault to process requests after a secure startup.

Answer

To delete old secrets

Answer

To rotate the encryption key

Answer

To back up the storage backend

Question 7

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data

Question 8

A company deploys Vault in a production environment with three nodes using Integrated Storage (Raft). They have configured Performance Replication to a secondary datacenter. The primary datacenter experiences a complete outage. After restoring the primary, they promote the secondary to primary. However, they notice that some secrets written to the primary just before the outage are missing in the secondary. The replication status shows no errors. What is the most likely cause and correct action?

Accepted Answer

Accept the data loss and continue with the secondary as primary. Performance Replication in Vault is asynchronous, meaning there is no guarantee that all writes to the primary are replicated to the secondary before a failure. When the primary experiences a complete outage, any secrets written just before the outage that had not yet been acknowledged by the secondary are permanently lost. Since the replication status shows no errors, the system is consistent up to the last replicated point, and the only correct action is to accept the data loss and continue with the promoted secondary as the new primary.

Answer

Restore the primary from backup to recover missing secrets

Answer

Failback to the original primary after restoring it

Answer

Re-promote the original primary and use it as the new primary

Question 9

A company is deploying Vault in a high-availability configuration across three data centers. They need to ensure that if the active Vault node fails, another node can take over without manual intervention. Which Vault feature should they configure?

Accepted Answer

Configure Vault with a highly available storage backend such as Raft and enable automatic leader election.. Vault's integrated Raft storage backend supports automatic leader election via the Raft consensus protocol. When the active node fails, the remaining nodes automatically hold an election to select a new leader, ensuring high availability without manual intervention. This is the native HA mechanism for Vault when using Raft as the storage backend.

Answer

Enable performance standby nodes.

Answer

Use a load balancer with health checks to redirect traffic.

Answer

Set up Disaster Recovery (DR) replication between data centers.

Question 10

A Vault operator runs `vault status` and sees the output above. The Vault cluster is in production and currently unresponsive to API requests. What is the most likely cause of the unresponsiveness?

Accepted Answer

The Vault cluster is sealed.. The `vault status` output shows that the Vault cluster is sealed. When a Vault cluster is sealed, it cannot process any API requests because the encryption key required to decrypt the data is not available in memory. This is the most common cause of unresponsiveness in a production Vault cluster that has been properly initialized.

Answer

The cluster is not initialized.

Answer

The cluster does not have HA enabled.

Answer

The cluster has no active leader.

Question 11

Drag and drop the steps to configure Vault's PKI secrets engine to issue certificates into the correct order.

Accepted Answer

Enable PKI secrets engine, then generate a root certificate, then create a role, then issue a certificate. The correct sequence to configure Vault's PKI secrets engine for issuing certificates is: first enable the PKI secrets engine, then generate a root certificate (self-signed CA), then create a role that defines certificate parameters, and finally issue a certificate using that role. Enabling the engine mounts it at a path, generating the root CA establishes the trust anchor, the role configures certificate properties, and the issuance step produces the actual certificate. Common mistakes include attempting to generate the root or create a role before enabling the engine, or creating the role before generating the root CA, which leads to errors or missing configurations.

Answer

Generate a root certificate, then enable PKI secrets engine, then create a role, then issue a certificate

Answer

Create a role, then enable PKI secrets engine, then generate a root certificate, then issue a certificate

Answer

Enable PKI secrets engine, then create a role, then generate a root certificate, then issue a certificate

Question 12

Match each Vault audit device to its output destination.

Accepted Answer

File: Writes audit logs to a local file. The correct matches are: File writes to a local file, Syslog sends to syslog, Socket sends to a TCP/UDP endpoint. Common confusions mix the output destinations.

Answer

File: Sends audit logs to syslog

Answer

Syslog: Writes audit logs to a file

Answer

Socket: Writes audit logs to a file

Question 13

A small startup wants to run Vault in a development environment with minimal operational overhead. They need to store secrets in memory only, without any persistence. Which storage backend should they choose?

Accepted Answer

In-memory storage backend. The in-memory storage backend stores all data in RAM with no persistence to disk, making it ideal for development environments where secrets must be lost on restart and operational overhead must be minimized. It requires no configuration, no external dependencies, and no data management, perfectly matching the requirement for minimal overhead and memory-only storage.

Answer

Integrated Storage (Raft) backend

Answer

Consul storage backend

Answer

File storage backend

Question 14

A large enterprise runs Vault in a high-availability cluster with integrated storage (Raft). They notice that read requests are not being evenly distributed across nodes, causing some nodes to have high load. They want to offload read operations to standby nodes. What feature should they enable to achieve this?

Accepted Answer

Enable performance standby nodes. Performance standby nodes are a Vault Enterprise feature designed to handle read requests without participating in the Raft consensus write quorum. By enabling this, read operations are offloaded to standby nodes, distributing the load evenly and reducing the burden on the active cluster nodes. This directly addresses the uneven read distribution and high load on specific nodes.

Answer

Configure a load balancer with a round-robin algorithm

Answer

Enable read replicas on standby nodes

Answer

Increase the number of Raft nodes to distribute reads

Question 15

An organization has two Vault clusters in different geographic regions and wants to replicate secrets from the primary cluster to the secondary cluster for disaster recovery. Which Vault replication feature should they use?

Accepted Answer

Disaster Recovery (DR) replication. Disaster Recovery (DR) replication is the correct Vault feature for replicating secrets from a primary cluster to a secondary cluster in a different geographic region for disaster recovery. DR replication copies all data, including secrets, policies, and tokens, in a one-way direction from primary to secondary, ensuring the secondary cluster can be promoted if the primary fails. This is distinct from performance replication, which is designed for load distribution and allows writes on both sides.

Answer

Cluster replication

Answer

Active Directory replication

Answer

Performance replication