Hsm Integration

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

You are deploying a new Vault Enterprise cluster that will use a PKCS#11 HSM for auto-unseal. The HSM is a network-attached appliance reachable over TCP. Which TWO configuration elements must be present in the seal stanza to allow Vault to communicate with this HSM? (Choose two.)

An operator needs to verify that a Vault Enterprise cluster is currently using a PKCS#11 HSM for its seal and that the seal is healthy. Which command provides the seal type and status without requiring unseal keys?

A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling Seal Wrap, the operator notices that some existing secrets still appear in plaintext within the storage backend. Which statement explains this behavior?

An administrator has configured a Vault Enterprise server to use a PKCS#11 HSM for auto-unseal. After a reboot, Vault fails to start and logs show that the PKCS#11 library could not be loaded. Which action should the administrator take first to resolve the issue?

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

When configuring the PKCS#11 library, how does Vault find the library on the host OS?

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

A Vault Enterprise cluster is configured with PKCS#11 auto-unseal. After a scheduled HSM firmware upgrade, Vault nodes fail to unseal and log 'PKCS#11 error: CKR_SLOT_ID_INVALID'. The HSM administrator confirms the partition is online and the PIN is unchanged. Which action should you take first to restore auto-unseal?

What permission level is required for the user account used to authenticate with the HSM?

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling, they notice that the storage backend contains wrapped values for the barrier key and some data encryption keys, but not for all keys. Which statement explains why only some keys are wrapped?

Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?

You are deploying Vault Enterprise 1.15 on three nodes and want auto-unseal backed by a PKCS#11 HSM. The HSM vendor provides a shared library at /usr/lib64/libpkcs11.so, and each node must authenticate using an HSM partition PIN. Which seal configuration key holds the PIN so Vault can open the HSM session?

Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?

Which component of Vault is responsible for communicating with the HSM?

When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?

Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?

A Vault Enterprise administrator is preparing a new cluster that will use a PKCS#11 HSM for auto-unseal. Before starting Vault, they need to confirm the HSM library is discoverable. Which environment variable or configuration field should they set to point Vault to the PKCS#11 library?

A Vault Enterprise administrator is designing an HSM integration that must survive the loss of a single HSM appliance. The design uses PKCS#11 auto-unseal and Seal Wrap. Which TWO considerations are critical to ensure availability and data recoverability? (Choose two.)

Your Vault Enterprise cluster is configured with a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you restore a snapshot to a new cluster that also has the same HSM seal configuration. After starting the new cluster, Vault remains sealed and logs indicate a PKCS#11 error. What is the most likely cause?

A Vault Enterprise cluster uses a PKCS#11 HSM for seal wrap and auto-unseal. The security team rotates the HSM partition PIN. Vault nodes are still running with the old PIN in their configuration files. What is the most likely operational impact?