VA-003 Explain Vault architecture — Timed 15 Questions

Question 1

An administrator notices that after a Vault unseal operation, the root token is no longer usable. The audit logs show no revocations. What is the most likely cause?

Accepted Answer

The root token's TTL expired during unseal. Root tokens can be generated with a configurable TTL. If the TTL is set to a short duration, it may expire during the unseal process, making the token unusable. The audit logs show no revocations because expiration is not a revocation event.

Answer

The root token was revoked during unseal

Answer

The root token's policy was removed

Answer

The root token was stored in memory only and lost on seal

Question 2

A Vault administrator creates a policy that grants 'read' and 'list' on 'secret/data/engineering/*' for a group. However, users in that group cannot read 'secret/data/engineering/project/db_password'. What is the most likely issue?

Accepted Answer

The policy path is incorrect; KV v2 requires 'secret/data/engineering/*' for read access. The policy grants 'read' and 'list' on 'secret/data/engineering/*', which is correct for accessing secret data in KV v2. However, to read a KV v2 secret, the Vault API also requires access to the corresponding metadata path ('secret/metadata/engineering/*') to resolve version information. Without the metadata path capability, the read operation fails. None of the provided options correctly identify this issue. Option A incorrectly states that the path 'secret/data/engineering/*' is incorrect for read access, which is not true. Option B suggests a different mount path without evidence. Option C incorrectly requires 'update' capability. Option D introduces an unrelated namespace issue.

Answer

The secret is stored in a different mount path

Answer

The policy is missing 'update' capability for the path

Answer

The users are in a different namespace that doesn't inherit the policy

Question 3

Which TWO of the following storage backends are capable of high availability without external dependencies? (Choose two.)

Accepted Answer

Integrated Storage (Raft). Integrated Storage (Raft) is the only storage backend that provides high availability without external dependencies. Raft manages Vault's data across a cluster via leader election and log replication, requiring no external system. The in-memory storage backend does not support replication or HA natively, and other backends like Consul or MySQL require separate external infrastructure.

Answer

File storage backend

Answer

In-memory storage backend with replication

Answer

Consul storage backend

Answer

MySQL storage backend

Question 4

A Vault cluster uses performance replication. A performance standby node is not responding to read requests. What is the most likely cause?

Accepted Answer

The performance standby node is sealed.. The performance standby node is sealed. In Vault, a sealed node cannot serve any requests, including read requests. Since the cluster uses performance replication, the standby node should be able to serve reads if it is unsealed. The fact that it is not responding indicates it is likely sealed. Other options are less likely: A is false because the cluster uses performance replication; B, a firewall blocking inbound traffic would cause no response but is less common; D, inability to connect for writes would affect write forwarding but reads should still work from local data.

Answer

Performance replication is not configured on this cluster.

Answer

The firewall is blocking inbound traffic to the standby node.

Answer

the performance standby node cannot connect to the primary for writes.

Question 5

A DevOps team is deploying Vault in a Kubernetes cluster. They want to ensure that when a pod starts, it can obtain a short-lived Vault token without human intervention. Which Vault architecture component should they use?

Accepted Answer

Vault Agent sidecar. The Vault Agent sidecar runs alongside the application container in the same pod, automatically authenticating to Vault and retrieving a short-lived token. This eliminates the need for human intervention by handling the authentication lifecycle (e.g., using Kubernetes auth method) and renewing or re-authenticating as needed, ensuring the application always has a valid token.

Answer

Audit Device

Answer

Storage Backend (Consul)

Answer

Vault CLI with token helper

Question 6

During a performance test, Vault becomes unresponsive for several seconds when the storage backend experiences high latency. Which architectural change would best improve Vault's resilience to storage latency?

Accepted Answer

Configure Performance Standby nodes. Performance Standby nodes are designed to handle read requests and can serve as hot standbys that take over active duty if the primary node becomes unresponsive due to storage backend latency. They maintain a local copy of the data via replication, allowing them to continue serving requests without waiting for the slow storage backend, thus improving resilience to high-latency storage conditions.

Answer

Add more storage backend nodes

Answer

Disable storage replication

Answer

Increase the number of Vault nodes without replication

Question 7

A security engineer wants to ensure that all requests to Vault are logged for compliance. Which component must be configured?

Accepted Answer

Audit Device. An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

Answer

Secrets Engine

Answer

Storage Backend

Answer

Auth Method

Question 8

A company is using Vault's Integrated Storage (Raft) for high availability. During a network partition, two Vault nodes become isolated from the third. What happens to the isolated nodes?

Accepted Answer

The two isolated nodes continue to serve requests, the third stops. In Vault Integrated Storage (Raft), a quorum of nodes (majority) is required to maintain cluster leadership and serve requests. During a network partition where two nodes are isolated from the third, the two nodes form a majority (2 out of 3) and can continue to serve requests, while the isolated third node loses quorum and stops serving requests to prevent split-brain. This behavior is enforced by the Raft consensus algorithm, which requires a majority for any write or read operations to ensure consistency.

Answer

All three nodes automatically rejoin after partition

Answer

All three nodes continue to serve requests

Answer

The two isolated nodes stop serving requests

Question 9

Which Vault component is responsible for encrypting data before storing it in the storage backend?

Accepted Answer

Barrier. The Barrier (also known as the Security Barrier) is the Vault component responsible for encrypting all data before it is written to the storage backend. It wraps every entry with encryption using the master key, ensuring that data at rest is never stored in plaintext. This is a core architectural layer that provides a cryptographic boundary between Vault's internal operations and the underlying storage.

Answer

Storage Backend

Answer

Audit Device

Answer

Secrets Engine

Question 10

A team wants to use Vault's AWS auth method to authenticate EC2 instances. Which architectural requirement must be met?

Accepted Answer

Vault must be able to reach the AWS metadata endpoint. The AWS auth method in Vault authenticates EC2 instances by verifying the instance's identity via the AWS metadata endpoint (http://169.254.169.254/latest/meta-data/). Vault must be able to reach this endpoint to retrieve the instance's PKCS7 signature, instance ID, and account ID, which are used to validate the instance's IAM role and ensure it matches the configured auth role. Without network access to the metadata endpoint, Vault cannot perform the cryptographic verification required for authentication.

Answer

Each EC2 instance must have an IAM role attached

Answer

Vault must have AWS API credentials configured

Answer

Vault must be deployed on an EC2 instance in the same region

Question 11

A Vault cluster uses Integrated Storage. During a planned upgrade, the administrator wants to minimize downtime. Which upgrade strategy should be used?

Accepted Answer

Perform a rolling upgrade one node at a time. Integrated Storage (Raft-based) requires a quorum of nodes to maintain cluster availability. A rolling upgrade, where each node is upgraded one at a time, ensures that the cluster never loses quorum (more than half of the nodes remain online and functional), minimizing downtime while the upgrade proceeds.

Answer

Upgrade all nodes at once

Answer

Stop all nodes, upgrade, then start

Answer

Add new upgraded nodes then remove old ones

Question 12

What is the purpose of the Seal/Unseal process in Vault architecture?

Accepted Answer

To enable Vault to process requests. The Seal/Unseal process in Vault is a security mechanism that protects the encryption key used to encrypt data at rest. When Vault starts, it is in a sealed state and cannot process any requests until it is unsealed by providing a threshold number of unseal keys (shards). Unsealing decrypts the master key in memory, allowing Vault to access the storage backend and serve API requests. Option D is correct because the primary purpose is to enable Vault to process requests after a secure startup.

Answer

To delete old secrets

Answer

To rotate the encryption key

Answer

To back up the storage backend

Question 13

Which TWO components are required for Vault to process client requests after startup?

Accepted Answer

Unseal key shares. C is correct because Vault starts in a sealed state and requires a threshold of unseal key shares to reconstruct the master key and decrypt the storage backend. Without unsealing, Vault cannot access any data or process client requests. E is correct because an enabled auth method is necessary to authenticate clients; Vault rejects all unauthenticated requests by default.

Answer

Audit Device

Answer

A policy

Answer

A secrets engine

Question 14

Which THREE architectural considerations are important when designing a multi-datacenter Vault deployment?

Accepted Answer

Use separate storage backends per datacenter. Each datacenter must maintain its own independent storage backend to avoid a single point of failure and ensure data isolation. Option D is correct because Performance Replication enables local reads by replicating data from the primary cluster to secondary clusters, reducing read latency. Option E is correct because Disaster Recovery Replication provides failover capability, replicating data asynchronously to a standby cluster for disaster recovery. Together, these three considerations ensure high availability, low latency, and resilience in a multi-datacenter Vault deployment.

Answer

Use a single storage backend across datacenters

Answer

Deploy a single Vault cluster spanning datacenters

Question 15

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data