184 questions total · 3pages · All types, answers revealed
Page 3 of 3
When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?
This ensures the token was intended for the Vault instance.
Why this answer
The 'audience' field specifies the expected audience of the JWT, which helps in preventing token reuse attacks across different services.
Which THREE of the following statements regarding PKCS#11 HSM integration in Vault are correct?
Vault requires the key to exist to perform the unseal operation.
Why this answer
Vault requires specific library versions, a pre-provisioned key, and proper configuration in the seal stanza for successful PKCS#11 integration.
An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?
Response wrapping protects the secret in transit and ensures it is single-use.
Why this answer
Using Response Wrapping with a short TTL provides a single-use token that ensures the SecretID is only accessible by the intended recipient.
What does the 'root' policy in Vault provide?
The root policy grants root permissions.
Why this answer
The 'root' policy provides full administrative access to all paths and operations.
What is the primary function of the 'ui = true' configuration setting?
This enables the built-in Vault UI.
Why this answer
Setting 'ui = true' enables the Vault Web UI, allowing users to interact with Vault via a browser.
Which component of Vault is responsible for communicating with the HSM?
The seal configuration manages HSM interaction.
Why this answer
The 'seal' component in the Vault configuration is specifically designed to interface with HSMs via the PKCS#11 standard.
When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?
Safety and isolation are the primary reasons.
Why this answer
Using a separate partition prevents accidental interference with production cryptographic material and provides an isolated environment for testing keys and PINs.
When scaling Vault using Performance Standby nodes, how does the load balancer choose which node to direct the read traffic to?
Consul's health checks ensure traffic is sent to nodes that are ready to respond.
Why this answer
Vault's architecture relies on the load balancer to perform health checks on the nodes, and Performance Standby nodes will report as 'healthy' to indicate their readiness to serve reads.
Which TWO statements are true about the relationship between Performance Standby nodes and Performance Replication?
That is the definition of performance standby.
Why this answer
Performance standby is for a single cluster's local read scaling, while replication is for multi-region/multi-cluster scaling.
Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?
Version mismatch often leads to PKCS#11 communication failures.
Why this answer
Common causes include incorrect PIN credentials, library incompatibility, or the HSM partition being inaccessible.
When configuring an audit device, which configuration parameter is essential for high-availability auditing?
Vault supports multiple audit devices to ensure logging reliability.
Why this answer
For high-availability, you should configure multiple audit devices. If one fails, Vault stops processing requests if 'log_raw' is not configured correctly or if the audit device is not robust.
When configuring Vault Agent caching, you notice that the cache is not effectively reducing requests. Which configuration parameter controls the lifespan of cached items?
max_ttl sets the ceiling for cached items.
Why this answer
The 'max_ttl' parameter in the 'cache' block defines the maximum time an item can remain in the cache.
When migrating from an external storage backend to Raft, which command is used to capture the current state of the cluster for migration?
This is the correct command to capture state for migration/backup.
Why this answer
The 'vault operator raft snapshot save' command is used to export the current data state to a file, which can then be restored into a new Raft-based cluster.
When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?
The 'role' parameter defines the Vault role to be used.
Why this answer
The 'role' parameter is mandatory to specify which Vault role the IAM identity should map to.
A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?
Vault uses the KMS key ID to request decryption; key rotation happens transparently if the policy permits.
Why this answer
Vault's Auto-Unseal configuration automatically handles the KMS key rotation if the IAM policy allows the 'decrypt' action on the new key version.
Which component of the Vault Agent is responsible for managing the lifecycle of the vault token retrieved via auto-auth?
Auto-auth handles token login, renewal, and maintenance.
Why this answer
The 'auto_auth' component manages the token lifecycle, including renewal and rotation.
Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?
These are the two main types of Sentinel policies.
Why this answer
Sentinel policies are applied at the request level, and they support both RGP (Request Governing Policy) and EGP (Endpoint Governing Policy).
Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?
Signal triggers a reload process.
Why this answer
The change_mode supports 'noop', 'signal', and 'restart' actions.
You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?
The 'request' object contains the attributes of the request being evaluated.
Why this answer
The 'request' object in Sentinel for Vault contains metadata about the API request, including 'path' and 'operation'.
A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?
The read capability is necessary to fetch the contents of a secret.
Why this answer
The 'read' capability is required for reading data from a path, while 'list' is for listing keys and 'create'/'update' for writing.
What does the 'vault_core_seal_setup_duration' metric represent?
This tracks the time spent during the seal/unseal phase.
Why this answer
This metric measures the time taken for Vault to perform the seal setup process during initialization or unsealing.
Which API endpoint should you use to check if a specific policy exists in the system?
This returns a list of all ACL policies.
Why this answer
The 'sys/policies/acl' endpoint allows for listing and reading ACL policies.
Which log level should be used when you need to capture detailed debugging information for Vault startup issues?
Debug provides the most granular logs for troubleshooting.
Why this answer
The 'debug' log level provides the most verbosity, which is useful for diagnosing complex startup or configuration errors.
You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?
The seal configuration includes retry logic for HSM connectivity.
Why this answer
Vault periodically retries the seal initialization process. Once the HSM becomes reachable, Vault attempts to use the provided credentials to unseal itself automatically.
When promoting a Performance Secondary to a Primary, what happens to the existing Performance Secondaries?
Replication links must be redefined when the primary changes.
Why this answer
Performance secondaries are tied to a specific primary. If the primary changes or is promoted, the secondary relationships must be re-established.
Which TWO items are required to successfully join a new node to an existing Integrated Storage cluster?
Needed to establish initial contact.
Why this answer
To join a Raft cluster, the new node needs the 'leader_api_addr' of the existing cluster and an authentication token to authorize the join.
Which TWO of the following factors can cause a Vault cluster to lose quorum in a Raft-based deployment?
Raft requires a majority of nodes to be alive to elect a leader.
Why this answer
Quorum requires a majority of nodes to be healthy. Losing too many nodes or having network issues causes loss of quorum.
You are configuring Vault to use a PKCS#11 HSM for auto-unseal. You have verified the library path and slot ID. When starting Vault, the service fails with a 'failed to login to HSM' error despite the PIN being correct. Which configuration step is the most likely culprit?
The HSM must contain a pre-existing key with the label specified in the stanza.
Why this answer
The 'hmac_key_label' or 'key_label' in the seal configuration must match the label of the key pre-provisioned on the HSM. If the label is incorrect or missing, the PKCS#11 module will fail to authenticate the key object.
What is the benefit of using Performance Replication over standard DR Replication?
This is the primary distinction of performance clusters.
Why this answer
Performance replication allows the secondary to serve read requests, unlike DR replication which is strictly for failover.
You are using the Kubernetes Auth method and want to restrict a role so that it can only be used by pods in a specific namespace. How do you implement this constraint?
Vault enforces this at the role level during authentication.
Why this answer
When creating a role in the Kubernetes auth method, the 'bound_namespaces' field is used to restrict the role to specific Kubernetes namespaces.
Which tool is commonly used to view Vault metrics in a graphical format?
Grafana is the industry standard for visualizing Vault/Prometheus metrics.
Why this answer
Grafana is the standard tool used to visualize Prometheus metrics, which Vault exports.
When utilizing performance replication, your Vault cluster experiences high replication lag between the primary and secondary sites. Which action would most effectively reduce this lag?
Reducing the volume of data being replicated is the most effective way to address persistent lag.
Why this answer
The 'replication_buffer_size' and 'max_replication_lag' parameters are key, but tuning the network or reducing the volume of writes via path filters is the most effective operational approach.
In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?
3 nodes provide a minimum fault-tolerant quorum.
Why this answer
A minimum of 3 nodes is standard for Raft to allow for majority consensus (quorum) if one node fails.
Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?
Wildcards are supported for flexibility.
Why this answer
It restricts authentication to specific service accounts and prevents unauthorized service accounts from assuming the role.
Page 3 of 3
Practice Vault Enterprise by domain
Target a specific domain to shore up weak areas.