VA-003 Explain Vault architecture Practice Test 5 — 15 Questions

Question 1

A company uses Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. Clients in eu-west-1 report that they receive stale data when reading from the local secondary cluster's active node. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The replication filter is excluding certain paths.. In Vault Enterprise Performance Replication, replication filters can be configured to exclude specific paths (e.g., secret engines or policies) from being replicated to secondary clusters. If a filter excludes certain paths, the secondary cluster will not receive updates for those paths, causing clients reading from the local secondary to see stale or missing data. This matches the symptom of stale reads on the secondary's active node.

Answer

The secondary cluster has not enabled performance standby.

Answer

The cluster is in 'primary_failover' mode.

Answer

The secondary cluster is in primary state instead of secondary.

Question 2

Which TWO components are required for Vault to start and function? (Choose two.)

Accepted Answer

Storage backend. The storage backend is required because Vault must persist all data, including encrypted secrets, configuration, and audit logs, to a durable backend (e.g., Consul, Integrated Storage, or filesystem). Without a configured storage backend, Vault cannot initialize or start. The seal mechanism is required because Vault uses it to encrypt and decrypt the master key; the seal wraps the master key and must be unsealed before Vault can serve requests.

Answer

Authentication method

Answer

Listener

Answer

Audit device

Question 3

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Accepted Answer

Barrier encryption key. The barrier encryption key is the master key used to encrypt and decrypt the Vault data encryption key (DEK), which in turn encrypts all data written to the storage backend. Without this key, Vault cannot protect data at rest because the DEK would be stored in plaintext. It is a fundamental component of Vault's security architecture, ensuring that even if the storage backend is compromised, the data remains encrypted.

Answer

Audit device

Answer

Authentication method

Question 4

A Vault administrator wants to minimize the impact of a single node failure in a three-node Raft cluster. Which TWO actions will help? (Choose two.)

Accepted Answer

Configure monitoring to detect and replace failed nodes quickly.. Monitoring and rapid node replacement directly reduce the window of vulnerability during a single node failure. In a three-node Raft cluster, a single node failure still allows the cluster to maintain quorum (2 out of 3 nodes), but if a second failure occurs before the first is replaced, the cluster becomes unavailable. Quick detection and replacement minimize this risk.

Answer

Set `disable_clustering` to true.

Answer

Use a load balancer to distribute client requests.

Answer

Enable `performance_standby` on all nodes.

Question 5

Refer to the exhibit. A Vault administrator configures a three-node cluster with the above configuration on all nodes (with appropriate node_id). After starting all nodes, the administrator unseals node2 and node3. Node1 remains sealed. What will be the cluster state?

Accepted Answer

Nodes 2 and 3 will form a quorum and elect a leader; Node1 will be a standby when unsealed.. In a Vault cluster, a quorum requires a majority of nodes to be unsealed and available. With three nodes, the quorum size is 2. Nodes 2 and 3, both unsealed, form a quorum and elect a leader among themselves. Node1, though sealed, is still a cluster member; once unsealed, it will join as a standby node, not as a leader, because the leader election has already occurred.

Answer

Nodes 2 and 3 will each try to become leader, causing a split-brain.

Answer

Node1 will automatically join the cluster once unsealed.

Answer

The cluster will be unavailable because Node1 is sealed.

Question 6

Refer to the exhibit. A Vault policy is defined as shown. A user presents a token with this policy. Which operation will be permitted?

Accepted Answer

Create secret/data/engineering/config. The policy grants `create` and `update` capabilities on `secret/data/engineering/*`, which allows creating secrets under that path. Option C is correct because the `create` capability permits writing a new secret at `secret/data/engineering/config`, as the path matches the glob pattern and the operation is a write (POST/PUT).

Answer

List secret/data/finance

Answer

Delete secret/data/finance/budget

Answer

Read secret/data/finance

Question 7

Refer to the exhibit. A Vault administrator starts a Vault server and receives this error. What is the most likely cause?

Accepted Answer

The storage stanza is missing from the configuration file.. The error indicates that Vault cannot find a configured storage backend. The storage stanza is mandatory in Vault's configuration file because it defines where Vault persists its data (e.g., Consul, Raft, file). Without it, the server fails to start because it has no backend to store secrets and state.

Answer

The Vault binary is corrupt.

Answer

The listener address is incorrect.

Answer

The seal stanza is misconfigured.

Question 8

A company is running Vault in production with a single active node and two standby nodes using Integrated Storage. The operations team notices that after a network partition, one of the standby nodes becomes unavailable for a few minutes. Upon recovery, the node rejoins the cluster. However, the active node's performance degrades temporarily. What is the most likely cause?

Accepted Answer

The standby node's recovery caused Raft snapshot installation, leading to temporary I/O load on the active node.. When a standby node reconnects after a network partition, the Raft consensus protocol may require the node to catch up on missed log entries. If the log gap is large, the active node initiates a snapshot installation, which involves reading and sending a compressed snapshot of the Raft state. This process causes significant I/O and CPU load on the active node, temporarily degrading its performance.

Answer

The standby node caused a leadership election upon reconnection.

Answer

The standby node was not using a seal wrapping key, causing re-encryption of all data.

Answer

The standby node forced a full data sync from the active node, consuming resources.

Question 9

A DevOps engineer is designing a Vault architecture for a multi-cloud environment spanning AWS, GCP, and on-premises data centers. The requirement is to have low-latency read access to secrets across all regions, and the ability to handle a full regional outage without manual intervention. Which architecture best meets these requirements?

Accepted Answer

Single Vault cluster spread across all regions using Integrated Storage with voter and non-voter nodes.. A single Vault cluster using Integrated Storage with voter and non-voter nodes can span multiple regions and clouds, providing low-latency reads via local non-voter nodes while maintaining a single Raft consensus group. This architecture handles a full regional outage without manual intervention because the Raft protocol automatically maintains quorum across voter nodes, and non-voter nodes can be promoted if needed, ensuring continuous read availability and automatic failover.

Answer

Single Vault cluster with performance standby nodes in each region.

Answer

Multiple Vault clusters with disaster recovery replication using Performance Replication.

Answer

Multiple Vault clusters with Disaster Recovery (DR) replication and an automated failover script that promotes a DR cluster to primary.

Question 10

A security team is configuring Vault's seal mechanism. They want to ensure that in the event of a data center outage, the Vault cluster can be unsealed without human intervention, but still require approval from multiple administrators to rekey the master key. Which seal type should they use?

Accepted Answer

Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication for any key usage.. Auto-unseal using AWS KMS with a key policy requiring multi-factor authentication (MFA) for any key usage meets the requirements: the Vault cluster can automatically unseal after a data center outage (since the unseal key is stored in KMS and accessible without human intervention), while rekeying the master key requires approval from multiple administrators (enforced by the MFA requirement on the KMS key policy). This decouples the unseal process from the rekey process, allowing automated recovery while maintaining administrative control over key rotation.

Answer

Shamir seals with auto-unseal using a cloud KMS.

Answer

HSM seal with a quorum of smart cards.

Answer

Transit seal with a key that requires manual approval from a quorum of operators.

Question 11

A Vault cluster uses Integrated Storage with 5 nodes. After a network split, the cluster loses quorum and becomes sealed. The network is restored, but the cluster does not automatically recover. What should the administrator do to recover the cluster?

Accepted Answer

Identify the node with the most recent data and use `vault operator raft recover` to create a new cluster from that node.. When a Vault cluster with Integrated Storage loses quorum due to a network split, the cluster seals itself to prevent split-brain. After the network is restored, the cluster does not automatically recover because the Raft consensus algorithm requires a majority of nodes to form a quorum. Option D is correct because `vault operator raft recover` allows an administrator to force a single node (typically the one with the most recent data) to form a new cluster, discarding the other nodes' data and re-establishing quorum.

Answer

Use `vault operator raft snapshot restore` on each node to restore from a backup.

Answer

Restart all nodes simultaneously to force a new leader election.

Answer

Manually unseal each node using the unseal keys.

Question 12

An organization wants to use Vault's dynamic database credentials to manage MySQL access. They have multiple application servers that need to connect to different databases. What is the best practice for configuring database roles to minimize the number of Vault mounts?

Accepted Answer

Create a single database mount and define multiple roles within it, each with different credential generation parameters.. Vault allows a single database mount (e.g., `database/`) to manage multiple database connections, and within that mount, you can define multiple roles. Each role can specify different credential generation parameters (e.g., username template, default TTL, max TTL, and allowed roles) for distinct databases or application servers. This minimizes the number of mounts while still providing fine-grained access control and isolation of credentials.

Answer

Use the same database mount but create a separate role per application server.

Answer

Create a separate database mount for each database to isolate credential generation.

Answer

Use a single role that generates credentials for all databases by using a wildcard in the username.

Question 13

Which three characteristics are true about Vault's storage backend and seal mechanisms? (Choose three.)

Accepted Answer

The Shamir seal requires multiple unseal keys to be entered before Vault can operate.. The Shamir seal splits the master key into multiple key shares, requiring a threshold number of these shares to be entered during the unseal process before Vault can decrypt its data encryption key and become operational. This ensures that no single individual can unseal Vault, providing a distributed trust model.

Answer

Auto-unseal using a cloud KMS eliminates the need for unseal keys entirely.

Answer

Consul as a storage backend requires Consul's own gossip protocol for leader election.

Question 14

A Vault administrator wants to ensure that all secrets are encrypted at rest and in transit. Which two configurations are necessary? (Choose two.)

Accepted Answer

Enable TLS on all Vault listener configurations.. Enabling TLS on all Vault listener configurations ensures that data is encrypted in transit between clients and the Vault server, protecting against eavesdropping and man-in-the-middle attacks. Option C is correct because using a seal that provides envelope encryption (e.g., Auto Unseal with a cloud KMS) encrypts the master key and storage backend data, ensuring secrets are encrypted at rest. Together, these two configurations satisfy the requirement for encryption both in transit (TLS) and at rest (seal envelope encryption).

Answer

Enable the `VAULT_ENCRYPT` environment variable on the Vault server.

Answer

Set the `encrypt` parameter on the audit device configuration.

Answer

Configure a storage backend that supports encryption at rest, such as Integrated Storage.

Question 15

A company is deploying Vault in a Kubernetes environment. Which three components are essential for a production-ready Vault on Kubernetes? (Choose three.)

Accepted Answer

A persistent volume claim for each Vault pod for storage.. Vault requires durable storage for its encrypted data (the storage backend). In Kubernetes, a PersistentVolumeClaim (PVC) provides this durable block or file storage that survives pod restarts. Without a PVC, Vault would lose its data when the pod is rescheduled, making it unsuitable for production.

Answer

A ConfigMap to store Vault configuration including unseal keys.

Answer

An Ingress controller to expose Vault externally.