VA-003 Explain Vault architecture Practice Test 6 — 15 Questions

Question 1

A Vault cluster uses Consul for HA. After a brief network partition, a standby node loses contact with the active node. What does the standby node do after a timeout?

Accepted Answer

It seals itself.. In a Vault cluster using Consul for high availability, only the active node serves requests. When a standby node loses contact with the active node due to a network partition, it cannot verify the active node's health or its own leadership status. After a configurable timeout (default 10 seconds), the standby node seals itself to prevent serving stale or inconsistent data, ensuring data integrity and security.

Answer

It becomes the active node.

Answer

It continues to serve requests.

Answer

It replicates data from the storage backend.

Question 2

In a Vault HA cluster, which node is responsible for handling all write requests?

Accepted Answer

The active node only. In a Vault HA cluster, only the active node can handle write requests. This is because the active node holds the storage backend lock and is the only node that can modify the underlying data store. Standby nodes forward write requests to the active node, ensuring data consistency and preventing split-brain scenarios.

Answer

All nodes

Answer

Standby nodes

Answer

The node that receives the request

Question 3

What is the purpose of the `storage` stanza in a Vault server configuration file?

Accepted Answer

Defines where Vault stores encrypted data.. The `storage` stanza in a Vault server configuration file defines the backend where Vault stores all encrypted data, including secrets, tokens, and metadata. This backend can be a file system, Consul, Raft, or other supported storage backends, and it is the persistent layer that holds the encrypted data after it has been processed by the seal mechanism. Without a properly configured `storage` stanza, Vault cannot persist any data and will fail to start.

Answer

Defines the encryption algorithm for secrets.

Answer

Defines the seal mechanism.

Answer

Defines the listener address.

Question 4

A Vault cluster with three nodes using Integrated Storage (Raft) is healthy with one active and two standby nodes. A network partition isolates the active node. What will happen?

Accepted Answer

The two standby nodes elect a new leader and continue writing.. In a Vault cluster with Integrated Storage (Raft), a majority of nodes (quorum) is required to maintain leadership and process write operations. When the active node is isolated, the two remaining standby nodes still constitute a majority (2 out of 3). They will hold a new leader election using the Raft consensus algorithm, elect a new active node, and continue accepting write requests. The isolated node, upon reconnection, will be treated as a follower and replicate data from the new leader.

Answer

The two standby nodes will seal themselves.

Answer

The two standby nodes remain in standby state.

Answer

The cluster becomes read-only until the active node rejoins.

Question 5

A company uses Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. Clients in eu-west-1 report that they receive stale data when reading from the local secondary cluster's active node. What is the most likely cause?

Accepted Answer

The replication filter is excluding certain paths.. In Vault Enterprise Performance Replication, replication filters can be configured to exclude specific paths (e.g., secret engines or policies) from being replicated to secondary clusters. If a filter excludes certain paths, the secondary cluster will not receive updates for those paths, causing clients reading from the local secondary to see stale or missing data. This matches the symptom of stale reads on the secondary's active node.

Answer

The secondary cluster has not enabled performance standby.

Answer

The cluster is in 'primary_failover' mode.

Answer

The secondary cluster is in primary state instead of secondary.

Question 6

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Accepted Answer

Barrier encryption key. Vault requires a storage backend (C) because all encrypted data — secrets, tokens, and configuration — must be persisted somewhere, and Vault itself never stores plaintext there. The barrier encryption key (B) is the root cryptographic material used by Vault's barrier to encrypt and decrypt everything written to that storage backend, so without it no data-at-rest encryption is possible. A seal mechanism (D) is also required because Vault starts in a sealed state and the seal/unseal process protects the barrier key (typically via Shamir secret sharing or an auto-unseal KMS), controlling access to the encryption key. An audit device (A) only logs requests and responses for compliance and is not needed to encrypt data at rest, and an authentication method (E) only verifies client identity to issue tokens, so neither is required for encryption at rest.

Answer

Audit device

Answer

Authentication method

Question 7

A Vault administrator wants to minimize the impact of a single node failure in a three-node Raft cluster. Which TWO actions will help? (Choose two.)

Accepted Answer

Configure monitoring to detect and replace failed nodes quickly.. Option C is correct because fast detection and replacement of a failed node shortens the window in which the three-node Raft cluster has reduced fault tolerance, restoring quorum redundancy quickly. Option D is correct because configuring `retry_join` with peer addresses lets a restarted or replaced node automatically rejoin the Raft cluster without manual intervention, which directly minimizes the impact of a node failure. Option A is wrong because setting `disable_clustering` to true disables Raft clustering entirely, which would eliminate the cluster's redundancy rather than protect it. Option B is wrong because a load balancer only distributes client traffic and does not address Raft node failure or quorum recovery. Option E is wrong because `performance_standby` nodes are non-voting replicas that do not participate in Raft quorum, so they do not mitigate the loss of a voting node's fault tolerance.

Answer

Set `disable_clustering` to true.

Answer

Use a load balancer to distribute client requests.

Answer

Enable `performance_standby` on all nodes.

Question 8

Refer to the exhibit. A Vault administrator configures a three-node cluster with the above configuration on all nodes (with appropriate node_id). After starting all nodes, the administrator unseals node2 and node3. Node1 remains sealed. What will be the cluster state?

Accepted Answer

Nodes 2 and 3 will form a quorum and elect a leader; Node1 will be a standby when unsealed.. In a Vault cluster, a quorum requires a majority of nodes to be unsealed and available. With three nodes, the quorum size is 2. Nodes 2 and 3, both unsealed, form a quorum and elect a leader among themselves. Node1, though sealed, is still a cluster member; once unsealed, it will join as a standby node, not as a leader, because the leader election has already occurred.

Answer

Nodes 2 and 3 will each try to become leader, causing a split-brain.

Answer

Node1 will automatically join the cluster once unsealed.

Answer

The cluster will be unavailable because Node1 is sealed.

Question 9

Refer to the exhibit. A Vault administrator starts a Vault server and receives this error. What is the most likely cause?

Accepted Answer

The storage stanza is missing from the configuration file.. The error indicates that Vault cannot find a configured storage backend. The storage stanza is mandatory in Vault's configuration file because it defines where Vault persists its data (e.g., Consul, Raft, file). Without it, the server fails to start because it has no backend to store secrets and state.

Answer

The Vault binary is corrupt.

Answer

The listener address is incorrect.

Answer

The seal stanza is misconfigured.

Question 10

A company is running Vault in production with a single active node and two standby nodes using Integrated Storage. The operations team notices that after a network partition, one of the standby nodes becomes unavailable for a few minutes. Upon recovery, the node rejoins the cluster. However, the active node's performance degrades temporarily. What is the most likely cause?

Accepted Answer

The standby node's recovery caused Raft snapshot installation, leading to temporary I/O load on the active node.. When a standby node reconnects after a network partition, the Raft consensus protocol may require the node to catch up on missed log entries. If the log gap is large, the active node initiates a snapshot installation, which involves reading and sending a compressed snapshot of the Raft state. This process causes significant I/O and CPU load on the active node, temporarily degrading its performance.

Answer

The standby node caused a leadership election upon reconnection.

Answer

The standby node was not using a seal wrapping key, causing re-encryption of all data.

Answer

The standby node forced a full data sync from the active node, consuming resources.

Question 11

An organization wants to use Vault's dynamic database credentials to manage MySQL access. They have multiple application servers that need to connect to different databases. What is the best practice for configuring database roles to minimize the number of Vault mounts?

Accepted Answer

Create a single database mount and define multiple roles within it, each with different credential generation parameters.. Vault allows a single database mount (e.g., `database/`) to manage multiple database connections, and within that mount, you can define multiple roles. Each role can specify different credential generation parameters (e.g., username template, default TTL, max TTL, and allowed roles) for distinct databases or application servers. This minimizes the number of mounts while still providing fine-grained access control and isolation of credentials.

Answer

Use the same database mount but create a separate role per application server.

Answer

Create a separate database mount for each database to isolate credential generation.

Answer

Use a single role that generates credentials for all databases by using a wildcard in the username.

Question 12

A company is deploying Vault in a Kubernetes environment. Which three components are essential for a production-ready Vault on Kubernetes? (Choose three.)

Accepted Answer

A persistent volume claim for each Vault pod for storage.. Option B is correct because Vault requires durable storage for its data (the integrated storage/Raft backend or a configured storage stanza), and in Kubernetes a PersistentVolumeClaim per Vault pod ensures data survives pod restarts and rescheduling. Option C is correct because Vault's Kubernetes auth method and auto-unseal/agent injector workflows need a ServiceAccount bound to RBAC roles so Vault can authenticate to and call the Kubernetes API (e.g., TokenReview, SubjectAccessReview). Option E is correct because Vault's Raft integrated storage requires stable pod identities and ordered startup, which a StatefulSet provides via stable network IDs (pod-0, pod-1) and persistent volume templates. Option A is not correct because unseal keys must never be stored in a ConfigMap; ConfigMaps are for non-sensitive configuration, and unseal keys are highly sensitive secrets handled via manual unseal, auto-unseal with a KMS, or secure secret stores. Option D is not correct because an Ingress controller is only needed to expose Vault externally and is not essential for a production-ready Vault cluster, which can be accessed via internal Services or port-forwarding.

Answer

A ConfigMap to store Vault configuration including unseal keys.

Answer

An Ingress controller to expose Vault externally.

Question 13

A company with strict security requirements uses Vault's Transit secrets engine to encrypt data in a microservices architecture. They have multiple applications that each require a unique encryption key. The security team wants to enforce key rotation every 30 days for all keys, and also require that keys be destroyed after they are no longer used. The application team is concerned that key rotation might cause downtime because applications need to re-encrypt data. The Vault architect needs to design a key management solution. What is the best approach?

Accepted Answer

Use the Transit engine's key rotation capability with versioning and configure applications to use the latest key version for encryption, while keeping old versions for decryption.. Vault's Transit secrets engine supports key rotation with versioning, where each rotation creates a new key version while retaining older versions for decryption. This allows applications to always encrypt using the latest version (via the `encrypt` endpoint) and decrypt using any previous version (via the `decrypt` endpoint), ensuring zero downtime during rotation. The security team's requirement for key destruction after disuse can be met by trimming or deleting old key versions once all data encrypted with them is re-encrypted.

Answer

Manually rotate keys every 30 days and update applications with new key IDs.

Answer

Set the key TTL to 30 days and configure Vault to automatically re-encrypt data when keys are rotated.

Answer

Use a single key for all applications and rotate it by creating a new key and deleting the old one.

Question 14

A DevOps team is setting up a Vault cluster for the first time. They plan to use AWS KMS for auto-unseal and Consul as the storage backend. As part of the architecture, which TWO components are essential for the Vault server to start and serve requests?

Accepted Answer

A storage backend. Option B (a storage backend) is essential because Vault persists all data — secrets, policies, tokens, and configuration — in its storage backend, and here that is Consul; without a working storage backend Vault cannot initialize or serve requests. Option C (a configured seal mechanism) is essential because Vault must be able to unseal its master key to decrypt the barrier and become active; in this scenario the seal mechanism is AWS KMS auto-unseal, which is required for the server to reach a serving state. Option A is not required because Vault can use an internal/self-signed certificate or none at all for basic operation; a public CA cert is only needed for trusted TLS clients. Option D is incorrect because Vault generates its own encryption keys internally (e.g., the master key and barrier key) rather than requiring an externally supplied 4096-bit key. Option E is not essential because a load balancer is only for distributing traffic across multiple Vault nodes, not for a single server to start and serve requests.

Answer

A public CA certificate

Answer

A 4096-bit encryption key

Answer

A load balancer

Question 15

A Vault operator deploys a single Vault server using Integrated Storage (Raft) as the storage backend. After initializing Vault, the operator notices that the server is marked as sealed and cannot serve requests. The operator has the unseal keys but wants to understand the architectural reason why Vault starts sealed after initialization. Which statement best explains why Vault is sealed immediately after initialization?

Accepted Answer

Vault's security barrier is active by default; initialization generates the master key and unseal keys, but the master key must be provided via unseal keys to decrypt the barrier and access storage.. Vault's security barrier encrypts all data before it reaches the storage backend. During initialization, Vault generates a master key and splits it into unseal keys. The barrier remains sealed until a threshold of unseal keys is provided to reconstruct the master key. This ensures that storage alone is insufficient to access secrets. The other options confuse Raft quorum, root token usage, or TLS with the unsealing mechanism.

Answer

Vault is sealed because the TLS certificate for the API listener has not been configured, and Vault refuses to serve requests without encryption in transit.

Answer

The Integrated Storage backend automatically seals Vault after initialization to prevent unauthorized access until the root token is used.

Answer

Vault requires a quorum of Raft peers to unseal automatically, and with only one node, quorum cannot be achieved.