VA-003 Explain Vault architecture — Timed 20 Questions

Question 1

An administrator notices that after a Vault unseal operation, the root token is no longer usable. The audit logs show no revocations. What is the most likely cause?

Accepted Answer

The root token's TTL expired during unseal. Root tokens can be generated with a configurable TTL. If the TTL is set to a short duration, it may expire during the unseal process, making the token unusable. The audit logs show no revocations because expiration is not a revocation event.

Answer

The root token was revoked during unseal

Answer

The root token's policy was removed

Answer

The root token was stored in memory only and lost on seal

Question 2

A Vault administrator creates a policy that grants 'read' and 'list' on 'secret/data/engineering/*' for a group. However, users in that group cannot read 'secret/data/engineering/project/db_password'. What is the most likely issue?

Accepted Answer

The policy path is incorrect; KV v2 requires 'secret/data/engineering/*' for read access. The policy grants 'read' and 'list' on 'secret/data/engineering/*', which is correct for accessing secret data in KV v2. However, to read a KV v2 secret, the Vault API also requires access to the corresponding metadata path ('secret/metadata/engineering/*') to resolve version information. Without the metadata path capability, the read operation fails. None of the provided options correctly identify this issue. Option A incorrectly states that the path 'secret/data/engineering/*' is incorrect for read access, which is not true. Option B suggests a different mount path without evidence. Option C incorrectly requires 'update' capability. Option D introduces an unrelated namespace issue.

Answer

The secret is stored in a different mount path

Answer

The policy is missing 'update' capability for the path

Answer

The users are in a different namespace that doesn't inherit the policy

Question 3

Which TWO of the following storage backends are capable of high availability without external dependencies? (Choose two.)

Accepted Answer

Integrated Storage (Raft). Integrated Storage (Raft) is the only storage backend that provides high availability without external dependencies. Raft manages Vault's data across a cluster via leader election and log replication, requiring no external system. The in-memory storage backend does not support replication or HA natively, and other backends like Consul or MySQL require separate external infrastructure.

Answer

File storage backend

Answer

In-memory storage backend with replication

Answer

Consul storage backend

Answer

MySQL storage backend

Question 4

A Vault cluster uses performance replication. A performance standby node is not responding to read requests. What is the most likely cause?

Accepted Answer

The performance standby node is sealed.. The performance standby node is sealed. In Vault, a sealed node cannot serve any requests, including read requests. Since the cluster uses performance replication, the standby node should be able to serve reads if it is unsealed. The fact that it is not responding indicates it is likely sealed. Other options are less likely: A is false because the cluster uses performance replication; B, a firewall blocking inbound traffic would cause no response but is less common; D, inability to connect for writes would affect write forwarding but reads should still work from local data.

Answer

Performance replication is not configured on this cluster.

Answer

The firewall is blocking inbound traffic to the standby node.

Answer

the performance standby node cannot connect to the primary for writes.

Question 5

A DevOps team is deploying Vault in a Kubernetes cluster. They want to ensure that when a pod starts, it can obtain a short-lived Vault token without human intervention. Which Vault architecture component should they use?

Accepted Answer

Vault Agent sidecar. The Vault Agent sidecar runs alongside the application container in the same pod, automatically authenticating to Vault and retrieving a short-lived token. This eliminates the need for human intervention by handling the authentication lifecycle (e.g., using Kubernetes auth method) and renewing or re-authenticating as needed, ensuring the application always has a valid token.

Answer

Audit Device

Answer

Storage Backend (Consul)

Answer

Vault CLI with token helper

Question 6

During a performance test, Vault becomes unresponsive for several seconds when the storage backend experiences high latency. Which architectural change would best improve Vault's resilience to storage latency?

Accepted Answer

Configure Performance Standby nodes. Performance Standby nodes are designed to handle read requests and can serve as hot standbys that take over active duty if the primary node becomes unresponsive due to storage backend latency. They maintain a local copy of the data via replication, allowing them to continue serving requests without waiting for the slow storage backend, thus improving resilience to high-latency storage conditions.

Answer

Add more storage backend nodes

Answer

Disable storage replication

Answer

Increase the number of Vault nodes without replication

Question 7

A security engineer wants to ensure that all requests to Vault are logged for compliance. Which component must be configured?

Accepted Answer

Audit Device. An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

Answer

Secrets Engine

Answer

Storage Backend

Answer

Auth Method

Question 8

A company is using Vault's Integrated Storage (Raft) for high availability. During a network partition, two Vault nodes become isolated from the third. What happens to the isolated nodes?

Accepted Answer

The two isolated nodes continue to serve requests, the third stops. In Vault Integrated Storage (Raft), a quorum of nodes (majority) is required to maintain cluster leadership and serve requests. During a network partition where two nodes are isolated from the third, the two nodes form a majority (2 out of 3) and can continue to serve requests, while the isolated third node loses quorum and stops serving requests to prevent split-brain. This behavior is enforced by the Raft consensus algorithm, which requires a majority for any write or read operations to ensure consistency.

Answer

All three nodes automatically rejoin after partition

Answer

All three nodes continue to serve requests

Answer

The two isolated nodes stop serving requests

Question 9

Which Vault component is responsible for encrypting data before storing it in the storage backend?

Accepted Answer

Barrier. The Barrier (also known as the Security Barrier) is the Vault component responsible for encrypting all data before it is written to the storage backend. It wraps every entry with encryption using the master key, ensuring that data at rest is never stored in plaintext. This is a core architectural layer that provides a cryptographic boundary between Vault's internal operations and the underlying storage.

Answer

Storage Backend

Answer

Audit Device

Answer

Secrets Engine

Question 10

A team wants to use Vault's AWS auth method to authenticate EC2 instances. Which architectural requirement must be met?

Accepted Answer

Vault must be able to reach the AWS metadata endpoint. The AWS auth method in Vault authenticates EC2 instances by verifying the instance's identity via the AWS metadata endpoint (http://169.254.169.254/latest/meta-data/). Vault must be able to reach this endpoint to retrieve the instance's PKCS7 signature, instance ID, and account ID, which are used to validate the instance's IAM role and ensure it matches the configured auth role. Without network access to the metadata endpoint, Vault cannot perform the cryptographic verification required for authentication.

Answer

Each EC2 instance must have an IAM role attached

Answer

Vault must have AWS API credentials configured

Answer

Vault must be deployed on an EC2 instance in the same region

Question 11

A Vault cluster uses Integrated Storage. During a planned upgrade, the administrator wants to minimize downtime. Which upgrade strategy should be used?

Accepted Answer

Perform a rolling upgrade one node at a time. Integrated Storage (Raft-based) requires a quorum of nodes to maintain cluster availability. A rolling upgrade, where each node is upgraded one at a time, ensures that the cluster never loses quorum (more than half of the nodes remain online and functional), minimizing downtime while the upgrade proceeds.

Answer

Upgrade all nodes at once

Answer

Stop all nodes, upgrade, then start

Answer

Add new upgraded nodes then remove old ones

Question 12

What is the purpose of the Seal/Unseal process in Vault architecture?

Accepted Answer

To enable Vault to process requests. The Seal/Unseal process in Vault is a security mechanism that protects the encryption key used to encrypt data at rest. When Vault starts, it is in a sealed state and cannot process any requests until it is unsealed by providing a threshold number of unseal keys (shards). Unsealing decrypts the master key in memory, allowing Vault to access the storage backend and serve API requests. Option D is correct because the primary purpose is to enable Vault to process requests after a secure startup.

Answer

To delete old secrets

Answer

To rotate the encryption key

Answer

To back up the storage backend

Question 13

Which TWO components are required for Vault to process client requests after startup?

Accepted Answer

Unseal key shares. C is correct because Vault starts in a sealed state and requires a threshold of unseal key shares to reconstruct the master key and decrypt the storage backend. Without unsealing, Vault cannot access any data or process client requests. E is correct because an enabled auth method is necessary to authenticate clients; Vault rejects all unauthenticated requests by default.

Answer

Audit Device

Answer

A policy

Answer

A secrets engine

Question 14

Which THREE architectural considerations are important when designing a multi-datacenter Vault deployment?

Accepted Answer

Use separate storage backends per datacenter. Each datacenter must maintain its own independent storage backend to avoid a single point of failure and ensure data isolation. Option D is correct because Performance Replication enables local reads by replicating data from the primary cluster to secondary clusters, reducing read latency. Option E is correct because Disaster Recovery Replication provides failover capability, replicating data asynchronously to a standby cluster for disaster recovery. Together, these three considerations ensure high availability, low latency, and resilience in a multi-datacenter Vault deployment.

Answer

Use a single storage backend across datacenters

Answer

Deploy a single Vault cluster spanning datacenters

Question 15

Which TWO statements about Vault's Storage Backend are correct?

Accepted Answer

It stores encrypted data. Vault's Storage Backend is responsible for persisting encrypted data. Vault encrypts all data at the application layer before writing it to the storage backend, ensuring that the backend itself never sees plaintext secrets. This design means the storage backend is a 'sealed box' that only stores ciphertext, providing defense in depth even if the backend is compromised.

Answer

It logs all requests

Answer

It handles authentication of clients

Answer

It is responsible for encrypting data

Question 16

A company deploys Vault in a production environment with three nodes using Integrated Storage (Raft). They have configured Performance Replication to a secondary datacenter. The primary datacenter experiences a complete outage. After restoring the primary, they promote the secondary to primary. However, they notice that some secrets written to the primary just before the outage are missing in the secondary. The replication status shows no errors. What is the most likely cause and correct action?

Accepted Answer

Accept the data loss and continue with the secondary as primary. Performance Replication in Vault is asynchronous, meaning there is no guarantee that all writes to the primary are replicated to the secondary before a failure. When the primary experiences a complete outage, any secrets written just before the outage that had not yet been acknowledged by the secondary are permanently lost. Since the replication status shows no errors, the system is consistent up to the last replicated point, and the only correct action is to accept the data loss and continue with the promoted secondary as the new primary.

Answer

Restore the primary from backup to recover missing secrets

Answer

Failback to the original primary after restoring it

Answer

Re-promote the original primary and use it as the new primary

Question 17

An organization uses Vault with a Consul storage backend. They have three Vault servers and three Consul servers. During a routine maintenance, they restart all Consul servers simultaneously. After the restart, Vault becomes sealed and cannot be unsealed. The Vault logs show 'storage: error listing' and 'failed to check status'. The Consul cluster is healthy with a leader. What is the most likely cause and solution?

Accepted Answer

Restore Vault's storage backend from a recent backup. When all Consul servers are restarted simultaneously, the Vault storage backend (Consul) may lose critical metadata or consistency state that Vault relies on to maintain its seal/unseal status. Even though the Consul cluster appears healthy with a leader, the underlying data corruption or loss of key-value entries (such as the barrier key or storage index) prevents Vault from reading its storage, causing it to seal and fail to unseal. Restoring Vault's storage backend from a recent backup is the correct solution because it recovers the consistent state of the data, including the encrypted master key and configuration, without requiring re-initialization.

Answer

Re-initialize Vault and generate new unseal keys

Answer

Generate a new root token using unseal keys

Answer

Use the unseal keys to unseal Vault again

Question 18

A company is deploying Vault in a high-availability configuration across three data centers. They need to ensure that if the active Vault node fails, another node can take over without manual intervention. Which Vault feature should they configure?

Accepted Answer

Configure Vault with a highly available storage backend such as Raft and enable automatic leader election.. Vault's integrated Raft storage backend supports automatic leader election via the Raft consensus protocol. When the active node fails, the remaining nodes automatically hold an election to select a new leader, ensuring high availability without manual intervention. This is the native HA mechanism for Vault when using Raft as the storage backend.

Answer

Enable performance standby nodes.

Answer

Use a load balancer with health checks to redirect traffic.

Answer

Set up Disaster Recovery (DR) replication between data centers.

Question 19

Which of the following are valid ways to authenticate to Vault? (Select all that apply.)

Accepted Answer

SAML 2.0. All of SAML 2.0, GitHub personal access token, Kubernetes auth, and LDAP authentication are valid Vault authentication methods. The SAML auth method (via plugin) enables integration with identity providers; the GitHub auth method uses personal access tokens to authenticate based on team membership; Kubernetes auth allows authentication using a Kubernetes Service Account Token; and LDAP authentication provides integration with LDAP directories. AWS EC2 instance metadata is not a direct Vault authentication method, though Vault's AWS auth method can use EC2 metadata for authentication.

Answer

AWS EC2 instance metadata

Question 20

A company runs Vault in a single cluster with three nodes using the Raft storage backend. The nodes are behind a load balancer that distributes traffic to all nodes. The operations team notices that occasionally, write operations (e.g., writing a secret or creating a policy) fail with a '502 Bad Gateway' error, while read operations succeed. The Vault audit logs show no errors. The load balancer health checks are configured to check the /v1/sys/health endpoint with a 200 response expected. The Vault nodes are all unsealed and the cluster is healthy. Which of the following is the most likely cause of the intermittent write failures?

Accepted Answer

The load balancer is sending write requests to standby nodes, which cannot handle writes.. In a Vault cluster with Raft storage, only the elected leader node can handle write operations (e.g., writing secrets, creating policies). Standby nodes serve read requests and forward writes to the leader. If the load balancer distributes traffic to all nodes without considering leadership, write requests sent to a standby node will fail with a 502 Bad Gateway error because the standby cannot process the write locally and the load balancer may not properly handle the forwarded response or timeout.

Answer

The Raft storage backend does not support write operations.

Answer

The load balancer is not configured to use the /v1/sys/leader endpoint for routing.

Answer

One of the Vault nodes is sealed, causing write requests to fail.