VA-003 Explain Vault architecture Practice Test 5 — 15 Questions

Question 1

A developer wants to authenticate to Vault using a username and password without any external identity provider. Which authentication method should be enabled?

Accepted Answer

Userpass authentication. The userpass authentication method is designed for Vault to authenticate users directly with a username and password, without relying on any external identity provider. It stores the credentials within Vault's own backend, making it the correct choice for a standalone authentication scenario where no external system like LDAP or an OIDC provider is involved.

Answer

Token authentication

Answer

LDAP authentication

Answer

AppRole authentication

Question 2

During a security assessment, a penetration tester discovers that Vault's seal configuration uses a single master key stored in a file on the server. The attacker gains root access to the server and retrieves the unseal key. What is the best mitigation to prevent this scenario?

Accepted Answer

Use a cloud auto-unseal mechanism such as AWS KMS. Cloud auto-unseal mechanisms like AWS KMS decouple the unseal key from the Vault server itself. Instead of storing the master key on the local filesystem, Vault uses a cloud-based key management service (KMS) to wrap and unwrap the master key. Even if an attacker gains root access to the server, they cannot retrieve the unseal key because it is never stored locally; Vault must call the KMS API (with appropriate IAM credentials) to unseal, and those credentials can be further protected with instance profiles or roles.

Answer

Restrict network access to the Vault server with a firewall

Answer

Use Shamir's secret sharing to split the key across multiple files

Answer

Encrypt the unseal key file with a strong password

Question 3

Which TWO of the following are components of Vault's architecture? (Choose two.)

Accepted Answer

Barrier. The Barrier (D) is a core Vault architectural component: it is the cryptographic layer that ensures data written to the storage backend is encrypted, and all requests must pass through the barrier before reaching the storage backend. The Seal (E) is also a core Vault component: it is the mechanism that protects the barrier's encryption key, and Vault starts in a sealed state where it cannot decrypt data until it is unsealed with the required unseal keys or auto-unseal mechanism. Consul Template (B) is an external HashiCorp tool that can render templates from Vault data, but it is not part of Vault's internal architecture. Vault Agent (C) is an optional client-side helper for authentication and caching, not a core architectural component of the Vault server. Senlin (A) is an OpenStack clustering service and has no relation to Vault's architecture.

Answer

Senlin

Answer

Consul Template

Answer

Vault Agent

Question 4

A new Vault administrator unseals Vault using a single unseal key, but the Vault remains sealed. What is the most likely cause?

Accepted Answer

The administrator did not provide enough unseal keys to meet the threshold.. Vault uses a threshold-based unsealing mechanism where a minimum number of unseal keys (the threshold) must be provided to reconstruct the master key and decrypt the storage backend. Providing only a single key, even if it is valid, leaves the Vault sealed because the threshold has not been met. The administrator must continue providing distinct unseal keys until the threshold count is reached.

Answer

The storage backend is misconfigured, preventing key retrieval.

Answer

The administrator forgot to provide a valid token.

Answer

Vault needs to be re-initialized after the first unseal.

Question 5

A Vault cluster configured with auto-unseal using AWS KMS is deployed across two availability zones. After a network partition, the standby node remains sealed while the active node is unsealed and serving requests. What is the most likely reason the standby cannot unseal?

Accepted Answer

The standby node cannot communicate with AWS KMS due to the network partition.. In a Vault cluster with auto-unseal via AWS KMS, each node must independently communicate with AWS KMS to unseal itself. A network partition that isolates the standby node from AWS KMS prevents it from reaching the KMS endpoint, so it cannot decrypt its unseal key and remains sealed. The active node is unaffected because it is already unsealed and serving requests from the other side of the partition.

Answer

The standby node is using the wrong AWS region configuration.

Answer

The active node consumed all available KMS API quota for the region.

Answer

The cluster address on the standby is misconfigured.

Question 6

A company is migrating from a file storage backend to Consul. Which Vault command should be used to move the data?

Accepted Answer

vault operator migrate. The `vault operator migrate` command is specifically designed to move Vault data from one storage backend to another, such as from a file storage backend to Consul. It handles the safe transfer of all encrypted data, including secrets, policies, and tokens, while ensuring consistency and minimal downtime during the migration process.

Answer

vault operator rekey

Answer

vault operator unseal

Answer

vault operator init

Question 7

A Vault cluster uses performance replication. A performance standby node is not responding to read requests. What is the most likely cause?

Accepted Answer

The performance standby node is sealed.. The performance standby node is sealed. In Vault, a sealed node cannot serve any requests, including read requests. Since the cluster uses performance replication, the standby node should be able to serve reads if it is unsealed. The fact that it is not responding indicates it is likely sealed. Other options are less likely: A is false because the cluster uses performance replication; B, a firewall blocking inbound traffic would cause no response but is less common; D, inability to connect for writes would affect write forwarding but reads should still work from local data.

Answer

Performance replication is not configured on this cluster.

Answer

The firewall is blocking inbound traffic to the standby node.

Answer

the performance standby node cannot connect to the primary for writes.

Question 8

A Vault cluster uses DR replication. The primary cluster fails, and the DR secondary is promoted to primary. After promotion, some secret data written to the primary shortly before the failure is missing on the new primary. What is the most likely reason?

Accepted Answer

The data had not yet been replicated to the DR secondary before the primary failed.. In Vault DR replication, data is asynchronously replicated from the primary to the secondary cluster. If the primary fails before the replication stream has transmitted the most recent writes, those writes are lost. When the DR secondary is promoted to primary, it only contains data that was successfully replicated up to the point of failure. This is the most likely reason the secret data is missing.

Answer

The seal wrapping key was rotated on the primary after the last replication.

Answer

The secret engine was not enabled on the DR secondary.

Answer

The DR secondary was promoted with the 'force' option, which skips replication of the last writes.

Question 9

A company stores static secrets in Vault and requires that all data is encrypted at rest in the storage backend. Which Vault feature provides this encryption?

Accepted Answer

Vault's storage encryption via the barrier.. C is correct because Vault's storage encryption is handled by the security barrier, which automatically encrypts all data written to the storage backend using a 256-bit AES-GCM encryption key. This ensures that data is encrypted at rest regardless of the storage backend's own capabilities, meeting the requirement without relying on backend-specific features.

Answer

The storage backend must be configured to encrypt data.

Answer

The transit secrets engine for encrypting secrets.

Answer

The storage backend's built-in encryption (e.g., Consul's encryption).

Question 10

After a security incident, the Vault administrator needs to change the encryption key used to encrypt data at rest. They have already rekeyed the unseal keys. What additional step is required to ensure new secrets are encrypted with a new key?

Accepted Answer

Run 'vault operator rotate' to rotate the encryption key.. The `vault operator rotate` command rotates the encryption key used by Vault's keyring to encrypt data at rest. After rekeying the unseal keys, the administrator must rotate the encryption key so that new secrets written to the storage backend are encrypted with a fresh key, while existing data remains decryptable with the old key until it is rewritten.

Answer

Reinitialize Vault with new unseal keys.

Answer

Migrate all secrets to a new mount and delete the old one.

Answer

Run 'vault operator rekey' again with different parameters.

Question 11

Which TWO are core components of Vault's architecture?

Accepted Answer

Seal. Option A (Seal) is correct because the seal/unseal mechanism is a fundamental architectural component of Vault: Vault always starts in a sealed state, and the master key (protected by the unseal keys or auto-unseal KMS) must be used to decrypt the encryption key so Vault can read its data — this barrier is intrinsic to Vault's core design. Option B (Storage backend) is correct because Vault's architecture is built around a pluggable storage backend (e.g., Integrated Storage/Raft, Consul, File) that persists encrypted data; without a configured storage backend Vault cannot function, making it a core component. Option C (Audit device) is not a core architectural component but an optional, enable-able feature for logging requests and responses to destinations like file or syslog. Option D (Auth method) is a pluggable security feature (e.g., token, userpass, LDAP, AppRole) that authenticates clients but is not part of the base architecture. Option E (Replication) is an optional enterprise capability (performance/DR replication) for scaling and disaster recovery, not a core component.

Answer

Audit device

Answer

Auth method

Answer

Replication

Question 12

Refer to the exhibit. What seal mechanism is configured for this Vault instance?

Accepted Answer

AWS KMS auto-unseal. The exhibit shows a Vault instance configured with `seal "awskms"` and a `region` and `kms_key_id` specified. This indicates that AWS KMS is used as the auto-unseal mechanism, where Vault delegates the unsealing process to AWS Key Management Service, eliminating the need for manual Shamir key shares.

Answer

HSM seal via PKCS#11

Answer

Shamir seal with default shares

Answer

No seal; Vault is in insecure mode

Question 13

Refer to the exhibit. Based on the output from 'vault status', which statement is true?

Accepted Answer

The unseal configuration uses 5 key shares with a threshold of 3.. The 'vault status' output shows 'Sealed: false', 'Key Shares: 5', and 'Key Threshold: 3'. This indicates that Vault is unsealed and uses a Shamir seal configuration with 5 key shares, requiring any 3 of them to unseal. Option B correctly states this unseal configuration.

Answer

The storage backend is a file backend.

Answer

Auto-unseal is enabled using Consul as the seal provider.

Answer

Vault is not configured for high availability.

Question 14

Refer to the exhibit. What operation was performed on the secret "mysecret"?

Accepted Answer

Read. The exhibit shows a Vault CLI command that retrieves the value of a secret at the path 'secret/mysecret'. The 'vault read' command is used to read data from Vault's key-value store, returning the stored value. Since the command 'vault read secret/mysecret' is executed, the operation performed is a Read, making option B correct.

Answer

Write

Answer

Delete

Answer

List

Question 15

A company requires that Vault data be continuously replicated from a primary data center to a secondary data center for disaster recovery. The secondary data center must be able to become writable in the event of a primary failure. Which Vault feature should they use?

Accepted Answer

Disaster Recovery Replication. Disaster Recovery (DR) Replication is the correct choice because it provides asynchronous replication of Vault data (including configuration, policies, and secrets) from a primary cluster to a secondary cluster. In the event of a primary failure, the secondary cluster can be promoted to become writable, ensuring business continuity. This feature is specifically designed for disaster recovery scenarios where the secondary site must be able to take over write operations.

Answer

Performance Replication

Answer

Consul as storage backend

Answer

Performance Standby