Hsm Integration

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

You have enabled 'seal_wrap' in Vault Enterprise. Which specific cryptographic operation is performed by the HSM under this feature?

You are troubleshooting a performance issue where Vault seems to be stalling during cryptographic operations. You suspect the HSM is the bottleneck. Which Vault metric should you examine to confirm HSM latency?

Which TWO of the following must be true for Seal Wrap to function correctly?

You are configuring Vault to use a Network HSM. The connection is intermittent. Which configuration parameter controls the timeout for HSM communication?

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

When configuring the PKCS#11 library, how does Vault find the library on the host OS?

You are using Seal Wrap. If you perform a 'vault operator rekey', what happens to the keys protected by Seal Wrap?

Which THREE of the following are required configuration parameters in the 'seal' stanza when using a PKCS#11 HSM?

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

Which TWO of the following are benefits of using Seal Wrap in Vault Enterprise?

What permission level is required for the user account used to authenticate with the HSM?

When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?

Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?

Which THREE of the following statements regarding PKCS#11 HSM integration in Vault are correct?

Which component of Vault is responsible for communicating with the HSM?

When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?

Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?

You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?

You are configuring Vault to use a PKCS#11 HSM for auto-unseal. You have verified the library path and slot ID. When starting Vault, the service fails with a 'failed to login to HSM' error despite the PIN being correct. Which configuration step is the most likely culprit?