184 questions total · 3pages · All types, answers revealed
Which telemetry type is most effective for monitoring the 'lease' count in Vault?
Gauges reflect current state values like lease counts.
Why this answer
Gauges are used to track values that can increase or decrease, such as the current number of active leases.
You are troubleshooting a sync issue in Performance Replication. The logs indicate 'replication lag'. Which parameter should you review to ensure optimal data synchronization between clusters?
Replication lag is usually due to network congestion or inadequate buffer capacity.
Why this answer
While there isn't a single 'lag' parameter, review the 'replication_buffer_size' or network throughput limits between clusters as part of diagnosing synchronization bottlenecks.
During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?
Without a load balancer, the configuration must point to the new HSM.
Why this answer
Vault is configured for a single HSM provider at a time; failover to a different HSM would typically require updating the seal configuration and restarting, or using a load balancer in front of a clustered HSM.
When configuring Sentinel policies for Vault, what is the 'EGP' policy type?
EGP policies govern access to specific endpoints.
Why this answer
Endpoint Governing Policies (EGP) are scoped to specific paths and evaluated on every request to those paths.
What is the primary function of a 'Performance Standby' node in Vault Enterprise?
Performance standbys are designed to handle read traffic locally.
Why this answer
Performance standby nodes allow local read-only requests to be served, reducing the load on the primary node.
When reviewing Vault server logs, you see 'request_path' entries that are redacted. Why is this occurring?
This setting dictates whether sensitive data is redacted.
Why this answer
By default, audit logs redact sensitive information if the audit device is not configured to include sensitive payloads, or if the request contains sensitive parameters.
How do you properly revoke a root token after it has been used to perform initialization tasks?
This command invalidates the token in the backend.
Why this answer
Once a root token has served its purpose, it should be revoked using 'vault token revoke -self' or by an administrator to adhere to the principle of least privilege.
Which THREE pieces of information are captured in standard Vault audit logs for every request?
The token or accessor is recorded to show who performed the action.
Why this answer
Audit logs record the time, the request path, and the identity (token/accessor) associated with the request.
Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?
Ensures best practices for token lifecycle.
You want the Vault Agent to run as a sidecar. Which configuration block allows you to specify the listener address for the Vault Agent's internal API?
The 'listener' block defines the address and port for the agent API.
Why this answer
The 'listener' block is used to configure how the Vault Agent exposes its local API for applications to communicate with.
Which TWO statements are true regarding the use of Batch tokens in Vault?
They are stateless by design.
Why this answer
Batch tokens are stateless and cannot be revoked.
Which THREE actions are recommended for maintaining a healthy DR replication setup?
Lag indicates potential data loss or sync issues.
Why this answer
Monitoring lag, ensuring network reliability, and testing recovery procedures are essential for DR maintenance.
Which configuration parameter in the Vault Agent 'cache' block allows you to disable caching for specific requests?
The agent cache is all-or-nothing for the configured paths.
Why this answer
The 'cache' block does not have a parameter to disable specific requests; all requests are cached unless disabled globally.
What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?
It controls the lifespan of the resulting token.
Why this answer
The 'token_ttl' sets the initial time-to-live for the tokens generated by that role, ensuring tokens are short-lived by default.
When configuring DR replication, what is the purpose of the 'primary_token' used on the secondary cluster?
The replication token is essential for the handshake between clusters.
Why this answer
The primary token is used by the secondary cluster to authenticate with the primary and establish the replication link.
Which TWO factors contribute to the size and performance of Vault audit logs?
Large payloads consume more log storage and bandwidth.
Why this answer
The request payload size and the frequency of incoming requests directly impact the audit log volume and performance.
How can an administrator ensure that a secret is only accessible if the requester has a specific identity group membership?
Sentinel can inspect the identity of the requester to enforce group requirements.
Why this answer
By using path-level ACLs that leverage the identity information or by integrating Sentinel policies to check group membership.
When initializing a Vault server, you choose to store the recovery keys. What is the main security advantage of using recovery keys alongside Auto-Unseal?
Recovery keys are used for critical administrative tasks like root token generation.
Why this answer
Recovery keys allow for performing sensitive operations like root token generation and unseal key migration if the Auto-Unseal mechanism becomes unavailable.
Which of the following describes the behavior of a Performance Secondary cluster during a primary cluster outage?
Performance secondaries serve the data they last replicated.
Why this answer
A performance secondary cannot become a primary. It requires promotion, which is a manual process that changes its role.
Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?
The storage backend manages the lock required for leadership.
Why this answer
The storage backend (e.g., Consul, Raft) provides a distributed locking mechanism that Vault uses to ensure only one leader exists.
Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?
Policy changes are high-risk security events.
Why this answer
Analyzing logs involves filtering for unauthorized access, checking for high-risk operations, and verifying administrative actions.
Which TWO of the following are true about AppRole 'SecretID' management?
A key security feature for SecretIDs.
Why this answer
SecretIDs can be generated via API and can have specific expiration or usage constraints, but they should never be hardcoded.
You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?
It protects the delivery of the token.
Why this answer
Vault's 'Response Wrapping' allows for a secure, one-time introduction of a token to a client, which is essential for dynamic infrastructure.
If you are using Vault Agent templates to render a file, and the secret contains a newline, how can you ensure the output is correctly formatted in your template?
The 'indent' function in Go templates helps maintain formatting for secrets with newlines.
Why this answer
Vault templates use Go templating; the 'indent' function or specific formatting is often needed for multi-line secrets.
Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?
Used to write/create secrets.
Why this answer
Create, Read, and Update are standard operations for secrets engines, while Delete and List are also common.
What is the primary difference between HA replication and DR replication in Vault?
HA provides high availability; DR provides recovery from total cluster loss.
Why this answer
HA is about local node availability, while DR is about replicating data across clusters for geographic or systemic failure recovery.
Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?
This tells other nodes how to reach this node.
Why this answer
Communication requires proper address bindings and TLS configurations to be secure and reachable.
Which TWO of these are valid audit device types in Vault?
The file audit device is a standard feature.
Why this answer
Vault supports 'file' and 'syslog' audit devices as standard options.
Which TWO of the following are benefits of using Seal Wrap in Vault Enterprise?
HSM-backed protection helps meet these compliance standards.
Why this answer
Seal Wrap adds an extra layer of security by ensuring keys never exist in plaintext memory and allows for easier compliance with regulations requiring HSM-backed key protection.
Which TWO of the following are requirements for a successful Vault HA deployment using Raft?
This is required for nodes to talk to each other.
Why this answer
Raft requires specific configuration for consensus and networking to function correctly in an HA environment.
You are managing a multi-region Vault deployment with Performance Replication. You notice that a specific secret engine mount is not being replicated to the secondary site. What should you check?
If a mount is created with -local=true, it is not replicated.
Why this answer
Check if the mount is marked as 'local'. Local mounts are never replicated.
What permission level is required for the user account used to authenticate with the HSM?
CU privileges allow for cryptographic operations required by Vault.
Why this answer
The HSM user account must have permissions to create, read, and use cryptographic keys. Usually, a 'Crypto User' (CU) role is sufficient.
When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?
The 'slot' parameter is the standard way to specify the HSM partition.
Why this answer
The 'slot' parameter in the seal stanza defines which slot within the PKCS#11 library Vault should target.
Which THREE factors influence the effective permissions of a user in Vault?
Sentinel policies can restrict allowed actions.
Why this answer
Effective permissions are the result of policies attached to the token, policies attached to the identity entity, and potentially Sentinel policies that filter the request.
How can you view the currently enabled audit devices in a Vault cluster?
This is the standard CLI command to list audit backends.
Why this answer
The 'vault audit list' command displays all currently enabled audit devices and their configuration paths.
Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?
Vault communicates with HSMs via the PKCS#11 standard.
Why this answer
Vault requires the HSM vendor's shared object library (.so or .dll) to support the PKCS#11 interface standard.
You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?
This ensures Vault points to the correct API server for token verification.
Why this answer
You must ensure that each Vault instance is configured with the correct 'kubernetes_host' and its own unique 'kubernetes_ca_cert' for the specific K8s cluster it is meant to trust.
Which THREE features are part of Vault Enterprise performance scaling?
Namespaces help manage large-scale multi-tenancy.
Why this answer
Performance replication, performance standby, and seal wrapping/HSM support are key enterprise scaling features.
In a Performance Replication setup, a secondary cluster is experiencing high latency for read requests. Which action should you take to verify if the requests are being routed correctly?
Metrics provide visibility into whether performance standbys are handling local reads effectively.
Why this answer
Checking the X-Vault-Index headers and looking at performance standby metrics helps determine if requests are hitting the local cluster or being forwarded to the primary.
Which TWO authentication methods are commonly configured in the 'auto_auth' block?
AppRole is a standard auto-auth method.
Why this answer
AppRole and Kubernetes are the most common methods used in Vault Agent auto-auth.
You are troubleshooting high CPU usage in Vault. Which telemetry metric category should you examine first?
Request routing metrics help identify which paths are causing load.
Why this answer
Request handling metrics allow you to see if specific paths or operations are causing high demand on the CPU.
You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?
Replication does not automatically unseal the secondary node.
Why this answer
If a DR secondary is sealed, it cannot participate in replication. It must be unsealed separately from the primary.
When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?
Limit the token's privileges.
Why this answer
Pod isolation, token scope (TTL), and secure communication (TLS/API trust) are the pillars of secure integration.
Which TWO fields are essential in an ACL policy defined in HCL?
Capabilities define the permissions.
Why this answer
The path to be restricted and the capabilities allowed for that path are the core components of an ACL policy.
An auditor notices that audit logs are missing entries for a specific mount point. What is the most likely cause?
Audit devices are global, but if the device itself is not enabled, no logs will appear.
Why this answer
Audit devices must be enabled separately, and if a path is not covered by an enabled audit device, activity will not be recorded.
Which command is used to check the health status of a Vault node?
This is the standard command for checking node status.
Why this answer
The 'vault status' command provides the current health, seal status, and active/standby role of the node.
Which TWO of the following are valid ways to assign policies to a token?
Tokens generated for an entity inherit its policies.
Why this answer
Policies can be assigned during token creation via the CLI or API, or they can be associated with an identity entity which then inherits them.
What is the consequence of setting 'cluster_name' in the Vault HCL configuration?
This provides clear identification for audit tracking.
Why this answer
The 'cluster_name' field is used to identify the cluster, which is particularly useful for performance replication and audit logs to distinguish between multiple clusters.
If you need to grant a group of developers access to all paths starting with 'secret/data/developers/', which HCL syntax is correct?
The /* wildcard covers all paths under the prefix.
Why this answer
The path should be defined with a trailing wildcard (/*) to cover sub-paths.
Which THREE factors influence the choice of a 'secret engine' configuration?
Determines the namespace/location.
Why this answer
Secret engine configuration depends on the type of data (KV, Dynamic), the required lease TTL, and the access control policies applied to the path.
If you are running Vault in a high availability cluster, where should you look for information regarding leader election?
Server logs output details regarding Raft status and leader elections.
Why this answer
The server logs will provide specific information about cluster synchronization and leader election status.
When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?
This is a core security control for tokens.
Why this answer
This restricts the resulting token to only be usable from the specified CIDR ranges, providing an additional layer of security after authentication.
Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?
Enterprise-only replication feature.
Why this answer
Performance replication and HSM support are key enterprise features that require specific configuration blocks in the Vault HCL file.
Which THREE configuration options are valid within the 'template' block?
Defines the rendered output path.
Why this answer
These are core parameters for controlling template rendering in Vault Agent.
Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?
Logs provide the specific reason for failure.
Why this answer
Troubleshooting involves checking the library path, verifying HSM connectivity (e.g., via HSM vendor tools), and checking that the credentials provided are correct.
Which component is responsible for receiving and responding to read requests in a Performance Standby configuration?
Performance standby nodes are designed to serve local read requests.
Why this answer
Performance standby nodes are specifically designed to serve read requests, reducing the load on the active node.
Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?
Required to identify the master key.
Why this answer
Auto-unseal requires a cloud-specific configuration block, appropriate IAM permissions for the Vault instance, and a valid key ID/ARN.
Which TWO of the following are valid ways to improve the security of the AppRole authentication process?
Adds IP-based validation.
Why this answer
Response wrapping provides secure introduction, and CIDR binding adds network-level restrictions.
Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?
It provides a temporary, single-use wrapper for the sensitive data.
Why this answer
Response wrapping ensures that the token is not visible in cleartext in logs or process lists during delivery.
When using 'template_config' to set the 'static_secret_render_interval', what is the minimum value you can set?
5s is the minimum allowed render interval.
Why this answer
Vault enforces a minimum rendering interval to prevent excessive resource consumption; it is 5s.
Which TWO of the following are valid sink types in Vault Agent?
File is a supported sink type.
Why this answer
Vault Agent supports 'file' sinks for local persistence.
You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?
This is the fail-closed security posture of Vault.
Why this answer
Vault is designed to fail-closed regarding audit logs. If the audit device fails, requests are blocked to prevent un-audited operations.
When configuring the Kubernetes Auth Method, which THREE of the following are required to ensure secure communication between Vault and the Kubernetes API server?
Points Vault to the correct API server.
Why this answer
The host address, the CA certificate, and the token for the reviewer account are mandatory for the TokenReview API communication.
What is the purpose of the 'cluster_addr' in the Vault server configuration?
It defines the address used for internal cluster traffic.
Why this answer
The 'cluster_addr' is used for communication between nodes in a Vault cluster (e.g., for Raft replication).
You are using Vault Agent templates to generate a configuration file. You need the template to include a secret from a KV v2 engine. What is the correct syntax within the template file?
The 'secret' function retrieves data from the specified path.
Why this answer
The 'secret' function is used in Vault templates to retrieve data from KV engines.
When using Namespace-based multi-tenancy, which statement is true regarding the root namespace?
The identity store is global at the root namespace level.
Why this answer
The root namespace acts as the parent and manages the configuration of auth methods and secrets engines that are globally applicable if desired, and it owns the identity store.
Which TWO of the following statements are true regarding Performance Standby nodes?
Writes cannot be processed locally on a standby.
Why this answer
Performance standbys handle reads and improve throughput but cannot perform writes.
You have a Performance Replication setup. A client sends a write request to a performance standby node. What happens to this request?
Performance standbys forward writes to the primary cluster to maintain consistency.
Why this answer
Performance standby nodes are read-only. Any write requests sent to them must be forwarded to the primary cluster.
You are configuring a production Vault cluster using Integrated Storage. What is the most critical configuration parameter that must be set in the 'storage' stanza to ensure the node can correctly identify and join the existing Raft cluster during a bootstrap operation?
The node_id provides a unique identifier for the node within the Raft configuration.
Why this answer
The 'node_id' is required for every node in a Raft cluster to uniquely identify itself to other peers in the integrated storage configuration.
Which TWO configurations are required to effectively monitor Vault in a production environment?
Metrics are essential for health monitoring.
Why this answer
Production environments require robust monitoring of metrics and thorough audit logging for compliance and troubleshooting.
An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?
The role configuration in the AppRole auth method allows setting 'bound_cidrs'.
Why this answer
Token restrictions like 'bound_cidrs' are configured on the 'role' within the AppRole auth method.
Which THREE types of metrics are collected by Vault's telemetry system?
Storage metrics track backend I/O.
Why this answer
Vault telemetry includes metrics for request performance, storage backend status, and internal core operations.
Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?
The 'vault status' command provides detailed information about the seal mechanism.
Why this answer
The 'vault status' command displays the seal type (e.g., 'shamir' or 'pkcs11') and the current seal status.
You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?
Both ports are required for replication and gossip/clustering.
Why this answer
Vault replication typically requires the API port (default 8200) and the cluster port (default 8201) to be reachable between nodes for cross-cluster communication.
In the context of the Vault Kubernetes Auth Method, what is the role of the 'reviewer_service_account'?
Vault needs a service account with permission to call the TokenReview API.
Why this answer
The 'reviewer_service_account' is the service account that Vault uses to perform the 'TokenReview' request against the Kubernetes API.
Practice Vault Enterprise by domain
Target a specific domain to shore up weak areas.