HashiCorp Certified: Vault Operations Professional (Vault Enterprise) (Vault Enterprise) (Vault Enterprise) — Questions 1–75

An exclude filter removes matching paths from replication, so those secrets are never synchronised to the secondary cluster. The path remains local to the primary, satisfying the requirement to keep specified data off the secondary.

The trim function removes leading and trailing whitespace from a string. Applying it to the secret value ensures the rendered file contains only the password characters, with no stray spaces or newlines. This is the correct choice when the goal is to strip whitespace from the beginning and end of the value while preserving the core content.

When a configured audit device fails, Vault blocks all client requests rather than continuing without logging, preventing unlogged operations. This satisfies the scenario's constraint by halting request processing instead of silently dropping audit records to the full device.

Seal Wrap only protects keys generated or rotated after enabling it; existing transit keys remain unwrapped until rotated. This satisfies the stem's restart scenario because Vault does not retroactively wrap stored keys, so previously created data keys stay in their original, non-HSM-protected form until rotation occurs.

The file audit device writes entries directly to the local filesystem path specified during enablement, satisfying the requirement for on-disk storage. Vault appends JSON-formatted audit records to that file, so logs reside on the host running the Vault server rather than in memory or a remote backend.

The HSM may expose multiple slots or partitions. Vault must know which slot to use for its keys and login. The seal stanza accepts either a slot number or a slot label. Specifying the wrong slot will cause Vault to use an unintended partition or fail to find the key material.

Vault's audit system does not buffer logs. If an audit device becomes unavailable, Vault will block all requests that require auditing to prevent unlogged operations. This is a security feature to ensure no request goes unrecorded. Therefore, there is no parameter to enable buffering. The operator must ensure high availability of the syslog server or configure multiple audit devices to avoid blocking. This option correctly states the behavior.

The num_uses parameter caps how many times a SecretID can be used for login. Setting it to 1 enforces single-use semantics, so the SecretID is consumed on first authentication and rejected thereafter, matching the stem's requirement.

When use_auto_auth_token is true, the agent uses its auto-auth token only if the incoming request does not already carry a token. If the client supplies an X-Vault-Token header, the agent proxies the request with that token instead. This allows clients to use their own credentials for paths the auto-auth token cannot access, while still benefiting from the agent's caching and connection management.

This is correct. In a three-node Raft cluster, quorum is two nodes. As long as two nodes are running and can communicate, the cluster can elect a leader and commit writes. The third node can be down without affecting write availability. This is the fundamental principle of Raft consensus: a majority is required for progress.

A token_ttl of 87600h (ten years) means issued tokens effectively never expire, so a leaked credential remains valid indefinitely. This defeats AppRole's short-lived credential model and removes the automatic revocation window that limits blast radius after compromise.

The injector operates as a Kubernetes Mutating Admission Webhook, intercepting pod creation requests and mutating the pod spec to add an init container and sidecar. This satisfies the scenario's requirement for automatic secret injection without application code changes, since the webhook applies annotations to pods at admission time.

Performance Replication streams write operations from the primary to the secondary. High network latency and a high volume of writes can cause the replication stream to fall behind, resulting in lag. This is the most likely cause of the observed lag and stale reads.

/sys/health returns HTTP status codes reflecting seal, standby and replication states, letting an external monitor poll cluster health without authentication. It satisfies the requirement for a dedicated, unauthenticated endpoint, unlike /sys/seal-status, which reports seal state only, or /v1/sys/leader, which exposes leader details rather than overall health.

The 'ui' parameter is a top-level configuration option that enables the Vault UI. Setting it to true makes the UI accessible at the /ui path. The 'listener' stanza's 'address' parameter specifies the bind address; using '0.0.0.0:8200' makes Vault listen on all network interfaces on port 8200. This combination correctly enables the UI and allows API requests from any interface.

Performance Replication secondaries maintain a local replica of the data and can serve read requests even if the primary is down. However, writes cannot be processed because the secondary does not have the authority to accept writes unless it is promoted to primary. This behavior ensures read availability during a primary outage.

The vault operator command group covers cluster lifecycle operations, including rekey, which generates new unseal and master keys. Rekeying the master key is therefore permitted, satisfying the stem's question about actions available within this command group.

Setting tls_disable = false forces the listener to serve TLS, encrypting all client-to-Vault traffic and preventing cleartext communication. This satisfies the stem's hardening requirement, since the default listener configuration permits plaintext HTTP unless TLS is explicitly enabled with certificates.

A Control Group Policy is the Vault object that wraps specified paths, requiring authoriser approval before the requesting user's token can read the secret. Creating it defines the approval workflow, satisfying the requirement that a manager authorise each secrets request.

vault.expire.num_leases is the correct metric. It represents the total number of leases currently tracked by the expiration manager. Monitoring this metric helps operators detect lease accumulation, which can lead to increased memory usage. In Vault Enterprise, this metric is critical for capacity planning and identifying issues with lease revocation or renewal.

The top-level vault block includes a namespace parameter that sets the Vault Enterprise namespace for all agent operations. Setting it there ensures that auto-auth, templating, and caching all use the specified namespace consistently, which is required for proper isolation and access control.

Namespaces partition a single Vault cluster into isolated tenants, each with its own auth methods, secrets engines and policies. This multi-tenancy isolation is Enterprise-only, satisfying the question's requirement for access-control features specific to Vault Enterprise.

The vault status command queries the sys/seal-status endpoint and reports the seal type, such as pkcs11, along with whether the cluster is sealed or unsealed. It does not require unseal keys and is the standard way to confirm the active seal mechanism and its health.

The load balancer fronts the cluster, directing client traffic to the active node and health-checking standby nodes. It satisfies the HA requirement by removing the single address dependency, so failover is transparent to clients without reconfiguration.

Seal Wrap is applied at write time for supported backends. Data written before Seal Wrap was enabled was stored without HSM wrapping, and Vault does not retroactively rewrite it. To protect existing secrets, they must be re-written, which can be done by reading and writing them again or by using a supported migration path for that secrets engine.

token_ttl sets the initial lease duration assigned when the token is issued, after which it expires unless renewed. This satisfies the stem's requirement to control the token's starting lifetime, distinct from token_max_ttl, which caps total renewal.

The most common cause of a PKCS#11 library load failure is an incorrect path or insufficient permissions. The `lib` parameter must point to the vendor's shared library, and the Vault process user must have read and execute permissions on it. Checking the path and permissions is the quickest first step before investigating deeper HSM connectivity or configuration issues.

Vault evaluates deny as an absolute override: any matching deny capability wins regardless of allow elsewhere. A single policy denying the path therefore blocks access, even where another policy grants it, satisfying the stem's conflicting-policy scenario.

Setting secret_id_num_uses to 1 restricts each SecretID to a single use, preventing replay. Configuring secret_id_bound_cidrs to the application's subnet ensures the SecretID is only valid from that network range, binding the authentication material to the application's location. This directly satisfies both requirements without affecting other roles.

A sink writes the auto-auth token to a file or Unix socket, letting other processes on the host reuse it without re-authenticating. This satisfies the scenario's requirement by persisting the token to disk for other processes.

When a node is removed from the Raft configuration due to prolonged absence, it must be manually rejoined. Running `vault operator raft join` on vault-3 with the leader's API address will add it back as a follower. This is the correct and documented procedure for re-adding a node that was previously part of the cluster but was removed.

Auto-unseal with a cloud KMS seal stanza delegates protection of the master key to the KMS. On startup, Vault calls the KMS to decrypt the stored wrapped master key and unseals without operator intervention. This satisfies the requirement for automatic recovery after a full restart while keeping the master key protected by an external root of trust.

Batch tokens are non-renewable by design, so any renewal attempt fails immediately. This satisfies the stem's constraint directly: the token type itself prohibits the renew operation, unlike service tokens which support renewal via `auth/token/renew`. The failure is inherent to the batch token's encrypted, stateless structure, not a policy restriction.

SIGHUP causes the target process to reload its configuration without terminating, letting the service pick up regenerated template files while remaining running. Other signals such as SIGTERM or SIGINT stop the process, defeating the goal of reloading without downtime.

Deploying one node per availability zone ensures that if one zone fails, the remaining two nodes are in different zones and can still form a quorum (2 out of 3). This provides fault tolerance for a single zone failure. This distribution is a common best practice for high availability in cloud environments, as it minimizes the impact of a zone outage.

Running 'vault operator raft join' instructs the new node to contact the existing cluster's leader and join the Raft peer set, which is the required step before the node can participate in Integrated Storage replication.

Promotion leaves the secondary's nodes serving reads only until clients are redirected; the DR secondary's advertise addresses and any load balancer targets still reference the lost primary. Repointing the load balancer restores write traffic to the promoted cluster, satisfying the stem's requirement to regain full functionality immediately after promotion.

When a client sends a write to a performance standby, the standby forwards the request to the active node. The active node commits the change to the Raft log, and the change is then replicated back to the standbys. This preserves consistency while allowing reads to be served locally. The statement accurately describes the write forwarding behavior of performance standbys.

A storage backend connection failure directly triggers unhealthiness because Vault's core cannot persist or retrieve encrypted data, causing the node to fail its health checks. Without storage access, the node cannot serve requests or maintain cluster state, satisfying the stem's condition for becoming unhealthy.

Policies are scoped strictly to the namespace where they are written; a root-namespace policy does not cascade into child namespaces. Tokens issued within the child namespace therefore cannot reference it, satisfying the impact that the policy is inaccessible there.

Batch tokens are not written to Vault's storage backend; they exist only as self-contained encrypted blobs, so there is no accessor record to revoke. This statelessness is precisely what delivers their performance benefit, and it is the reason individual revocation is impossible.

In a five-node Raft cluster, quorum is achieved when a majority of nodes are active and healthy. The formula floor(n/2)+1 gives floor(5/2)+1 = 3. Therefore, at least three nodes must be operational to maintain quorum, elect a leader, and allow write operations. This ensures fault tolerance of up to two node failures.

Integrated Raft storage achieves high availability by having multiple Vault nodes join one Raft cluster, electing an active node and maintaining replicated state through consensus, so standby nodes can take over if the active fails.

HSM Auto-Unseal delegates the master key decryption to a hardware security module, so Vault retrieves the unseal key automatically at start-up or restart. This removes the manual Shamir key-entry requirement, directly satisfying the stem's constraint: eliminating operator intervention to unseal nodes after reboots or outages.

Short TTL and max TTL limit the window in which a stolen token can be used. Even if an attacker obtains the token, it will expire soon, and the max TTL prevents indefinite renewal. This directly reduces the blast radius by forcing frequent re-authentication, which is a standard least-privilege and least-duration practice for external partners.

The seal stanza's lib field holds the filesystem path to the PKCS#11 shared library, for example the HSM vendor's .so file. Vault loads that path from the host OS, so an incorrect location prevents the seal from initialising.

Setting secret_id_num_uses to 1 ensures the secret ID can be used only once, and secret_id_ttl to 24h makes it expire after 24 hours. These parameters directly control the usage limit and lifetime of secret IDs, meeting the requirement for one-time use and expiration. This is the correct configuration for the scenario.

Network latency and bandwidth between the primary and Performance Secondary directly govern replication throughput, since the secondary must receive and apply updates from the primary. Slow links delay write propagation and increase staleness, making link speed a genuine performance constraint for the secondary cluster.

Setting `performance_standby = true` in the configuration file on standby nodes enables Performance Standby mode. These nodes can then serve read requests from the active node's data, scaling read performance while maintaining high availability. This is the correct way to enable performance standbys in Vault Enterprise.

This command instructs the Vault node to join the Raft cluster by contacting the specified leader or any existing peer. It is the correct method to rejoin a node after it has been offline or removed. The command does not disrupt the existing cluster and will add the node as a follower, allowing it to catch up on the Raft log.

The Kubernetes auth method reads the pod's mounted service account token at the default path and submits its contents as the JWT. This satisfies the stem's requirement for the value automatically sent to the Vault server.

Configuring the Kubernetes API server's CA certificate lets Vault verify the API server's identity when the load balancer terminates TLS, since Vault can no longer rely on the client-supplied TLS chain. The `kubernetes_ca_cert` parameter satisfies the stem's requirement to validate `kubernetes_host` independently of the load balancer's terminated connection.

The secret_id_bound_cidrs field restricts which CIDR blocks may present a SecretID during AppRole login, so setting it enforces the stem's source-address constraint. Requests from outside the listed ranges are rejected even with a valid SecretID.

api_addr advertises the address that clients and other cluster peers should use to reach this node. Changing it alters that advertised endpoint, so redirects, request forwarding and peer communication target the new address rather than the storage backend itself.

Vault treats audit devices as blocking: if every enabled audit device fails to write, Vault halts request processing and returns errors, preventing unlogged operations. This fail-closed behaviour guarantees no request is served without an audit trail.

The `type` parameter selects the sink destination, such as `file` or `syslog`, and is mandatory when declaring a sink block. It satisfies the stem's requirement for a valid sink parameter, since Vault Agent cannot route audit entries without knowing which sink implementation to instantiate.

A Performance Replication secondary cluster is designed to be read-only for replicated data and will reject write requests to replicated paths unless it is promoted. It can still serve reads and handle local writes to non-replicated mounts if configured. Therefore, no action is needed to prevent writes to replicated data during the primary's downtime.

ACL policies in Vault define who can access specific paths, including auth method configuration endpoints. By creating and attaching appropriate policies to tokens or entities, the administrator can restrict who can modify the auth method configuration. This is the standard way to control access to Vault's API endpoints.

The 'node_id' parameter provides a unique identifier for the node within the Raft cluster. It is required for Integrated Storage because Raft uses node IDs to distinguish cluster members. If omitted, Vault will generate one based on the hostname, but for clarity and stability, it is best practice to set it explicitly. A stable node ID helps with cluster management and recovery.

Setting `tls_min_version` to `tls12` forces the listener to reject TLS 1.0 and 1.1 handshakes, eliminating deprecated protocol versions with known weaknesses. This directly satisfies the hardening requirement by ensuring only TLS 1.2 or higher negotiates with clients, while remaining compatible with Vault's supported cipher suites and typical production clients.

Performance standby nodes cannot service writes, since only the active node holds the write-ahead log and storage backend. The standby therefore forwards the write request over the cluster port to the active node, which processes it and replicates the result back.

Replication path filters let you exclude specific mount paths from being replicated to a Performance Secondary, directly reducing its storage footprint. This satisfies the fine-grained control requirement by allowing selective synchronisation rather than replicating all data.

High `core.fetch_token` latency points to Vault's token store operations, which persist tokens through the configured storage backend. When that backend cannot sustain the read/write throughput demanded by frequent token creation and lookup, each fetch blocks, inflating this metric. The constraint is storage backend performance under high-frequency token operations.

Configuring `kubernetes_host` and `kubernetes_ca_cert` lets Vault reach the Kubernetes API server and trust its TLS certificate, enabling the TokenReview call that validates the pod's service account token. Without these, Vault cannot contact the cluster, so token verification fails.

Without a sink, the token exists only in the agent's memory.

Using a secure management system to populate config values satisfies the stem's cloud constraint by keeping secrets out of the configuration file entirely. Vault's config supports environment variables and templated values, so credentials are injected at runtime rather than persisted on disk, avoiding exposure through instance images, snapshots or version control.

Destroying the specific SecretID invalidates only that credential, leaving the RoleID and all other active tokens untouched. Vault's AppRole auth method supports per-SecretID destruction via `auth/approle/role/:role_name/secret-id/destroy`, which satisfies the stem's constraint of immediate, targeted revocation without broader impact.

Vault Enterprise does not automatically prevent a performance secondary from serving reads based on lag. The recommended practice is to monitor replication status via the API endpoint `sys/replication/performance/status`, which shows the lag in WAL entries. If the lag is too high and stale reads are unacceptable, you should redirect clients to the primary until the secondary is sufficiently caught up. This ensures data consistency.

vault operator rekey -init starts a rekey operation and accepts new key configuration such as -key-shares and -key-threshold, allowing the number of shares to change. This satisfies the stem's requirement to alter key configuration during rekey.

Audit logs record each Kubernetes Auth login attempt and the precise validation error, such as an invalid service account token or JWT signature mismatch. This directly satisfies the stem's need to diagnose why pods fail authentication, since the failure is captured server-side rather than in pod logs.

For seal wrapping, Vault uses a specific key in the HSM, identified by the key_label. If the key_label is incorrect or missing, Vault cannot locate the seal wrap key, leading to the reported failure. The seal stanza must specify the correct key_label that matches the key created in the HSM.

Running `vault operator raft remove-peer` directly on a surviving node removes the dead server from the Raft configuration without requiring the failed node to be online. This satisfies the stem's constraint: the peer is unreachable, so removal must be performed from a healthy cluster member rather than the dead node itself.

An identity alias maps a name and mount accessor from an external auth method to an existing Vault entity, so multiple credentials resolve to one identity. This linkage is precisely what lets policies and metadata attach to a single entity across auth methods.

Granting 'create', 'read', 'update', 'delete', and 'list' on 'database/roles/*' allows the team to manage roles within the database secrets engine. It does not grant access to the secrets engine's configuration path (e.g., 'database/config') or other engines. This follows the principle of least privilege, providing exactly the permissions needed to manage roles without broader access.

Lease count rises and falls continuously, so it needs a value sampled at scrape time rather than a cumulative total. Gauges expose that instantaneous reading, letting operators watch active leases and spot abnormal growth or leaks.