Courseiva

CCNA Monitoring Vault Environments Questions

24 questions · Monitoring Vault Environments · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

You want to prevent audit logs from being written to a specific device if the disk is full. What happens to Vault?

A.Vault enters a blocked state for all client requests.
B.Vault switches to a secondary file automatically.
C.Vault stops recording logs but continues operation.
D.Vault deletes the oldest logs to make room.
AnswerA

Because it is a security failure, Vault stops accepting traffic.

Why this answer

If a configured audit device cannot write, Vault blocks requests until the device is removed or restored, adhering to the fail-closed design.

Practice this question →
2
MCQeasy

Where are audit logs physically stored if the 'file' audit device is configured?

A.In standard system syslog.
B.In the storage backend database.
C.In the local filesystem at the configured path.
D.In Vault's memory buffer.
AnswerC

The file audit device is explicitly designed for local file output.

Why this answer

The 'file' audit device writes entries to a specified file path provided in the configuration.

Practice this question →
3
MCQmedium

To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?

A./sys/leader
B./sys/health
C./sys/metrics
D./sys/monitor
AnswerB

The /sys/health endpoint is the standard for health checking.

Why this answer

The /sys/health endpoint provides information about the initialization status, standby status, and overall health of the Vault node.

Practice this question →
4
Multi-Selecthard

Which THREE conditions might result in a Vault node becoming unhealthy?

Select 3 answers
A.Storage backend connection failure.
B.The node is in a 'sealed' state.
C.Telemetry endpoint is down.
D.The node cannot connect to the cluster leader.
E.Audit logs are full.
AnswersA, B, D

Inaccessible storage renders the node unhealthy.

Why this answer

A node can become unhealthy if the storage backend is unreachable, the node is sealed, or it cannot reach the cluster leader.

Practice this question →
5
MCQmedium

What is the purpose of the 'prometheus_retention_time' setting in the Vault telemetry stanza?

A.To control the frequency of metric exports.
B.This setting is invalid and will be ignored by Vault.
C.To define how long Vault keeps metrics in memory.
D.To tell Prometheus how long to store Vault's data.
AnswerB

The setting is not a valid parameter for the telemetry stanza.

Why this answer

This setting does not exist in the telemetry stanza; it is a distractor. Monitoring retention is handled by the Prometheus server, not Vault itself.

Practice this question →
6
MCQeasy

Which command is used to rotate the audit log file on a Vault server to ensure logs are written to a new file?

A.vault audit rotate
B.vault server reload
C.vault operator seal
D.vault log rotate
AnswerA

This command forces the audit device to rotate the log file.

Why this answer

vault audit rotate is the specific command to instruct Vault to close the current audit log file and open a new one.

Practice this question →
7
MCQhard

You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?

A.The audit file device is too slow.
B.The request buffer is full.
C.The storage backend is struggling with high frequency read/write operations.
D.Vault is misconfigured for high availability.
AnswerC

Token operations are bound to the storage backend performance.

Why this answer

High latency in fetch_token metrics usually indicates database or storage backend contention during token creation or lookup processes.

Practice this question →
8
Multi-Selectmedium

Which TWO of the following are valid telemetry sinks supported by Vault?

Select 2 answers
A.Splunk
B.Nagios
C.ELK Stack
D.Prometheus
E.StatsD
AnswersD, E

Prometheus is a natively supported telemetry sink.

Why this answer

Vault supports multiple telemetry sinks including StatsD and Prometheus.

Practice this question →
9
MCQmedium

Which telemetry type is most effective for monitoring the 'lease' count in Vault?

A.Summaries
B.Histograms
C.Counters
D.Gauges
AnswerD

Gauges reflect current state values like lease counts.

Why this answer

Gauges are used to track values that can increase or decrease, such as the current number of active leases.

Practice this question →
10
MCQhard

When reviewing Vault server logs, you see 'request_path' entries that are redacted. Why is this occurring?

A.The audit device is configured with 'log_raw=false'.
B.Vault is in recovery mode.
C.You are not logged in as a root user.
D.The log level is set to 'info'.
AnswerA

This setting dictates whether sensitive data is redacted.

Why this answer

By default, audit logs redact sensitive information if the audit device is not configured to include sensitive payloads, or if the request contains sensitive parameters.

Practice this question →
11
Multi-Selecthard

Which THREE pieces of information are captured in standard Vault audit logs for every request?

Select 3 answers
A.Requester identity.
B.The server's CPU load at the time of request.
C.Request path.
D.Timestamp of the request.
E.The client's IP address.
AnswersA, C, D

The token or accessor is recorded to show who performed the action.

Why this answer

Audit logs record the time, the request path, and the identity (token/accessor) associated with the request.

Practice this question →
12
Multi-Selectmedium

Which TWO factors contribute to the size and performance of Vault audit logs?

Select 2 answers
A.The size of the request/response payloads.
B.The number of active leases.
C.The number of enabled secrets engines.
D.The number of requests per second.
E.The size of the Vault data store.
AnswersA, D

Large payloads consume more log storage and bandwidth.

Why this answer

The request payload size and the frequency of incoming requests directly impact the audit log volume and performance.

Practice this question →
13
Multi-Selecthard

Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?

Select 3 answers
A.Review logs for 'sys/policy' updates.
B.Search for 'create' operations on auth/token/create.
C.Sort logs by timestamp.
D.Filter by '403 Forbidden' responses.
E.Check for successful 'read' operations on all secrets.
AnswersA, B, D

Policy changes are high-risk security events.

Why this answer

Analyzing logs involves filtering for unauthorized access, checking for high-risk operations, and verifying administrative actions.

Practice this question →
14
Multi-Selectmedium

Which TWO of these are valid audit device types in Vault?

Select 2 answers
A.file
B.syslog
C.database
D.socket
E.stdout
AnswersA, B

The file audit device is a standard feature.

Why this answer

Vault supports 'file' and 'syslog' audit devices as standard options.

Practice this question →
15
MCQeasy

How can you view the currently enabled audit devices in a Vault cluster?

A.vault audit list
B.vault read sys/audit
C.vault list audit/devices
D.vault status -audit
AnswerA

This is the standard CLI command to list audit backends.

Why this answer

The 'vault audit list' command displays all currently enabled audit devices and their configuration paths.

Practice this question →
16
MCQhard

You are troubleshooting high CPU usage in Vault. Which telemetry metric category should you examine first?

A.vault.core.token.create
B.vault.audit.request
C.vault.route.request
D.vault.storage.read
AnswerC

Request routing metrics help identify which paths are causing load.

Why this answer

Request handling metrics allow you to see if specific paths or operations are causing high demand on the CPU.

Practice this question →
17
MCQmedium

An auditor notices that audit logs are missing entries for a specific mount point. What is the most likely cause?

A.The audit device is in a blocked state.
B.The audit device is not enabled for the specific path prefix.
C.Vault is running in dev mode.
D.The audit log rotation policy is set to delete logs immediately.
AnswerB

Audit devices are global, but if the device itself is not enabled, no logs will appear.

Why this answer

Audit devices must be enabled separately, and if a path is not covered by an enabled audit device, activity will not be recorded.

Practice this question →
18
MCQmedium

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

A.The telemetry metrics.
B.The server logs.
C.The storage backend logs.
D.The audit logs.
AnswerB

Server logs output details regarding Raft status and leader elections.

Why this answer

The server logs will provide specific information about cluster synchronization and leader election status.

Practice this question →
19
MCQhard

You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?

A.Vault automatically switches to the secondary audit device.
B.Requests are permitted for read-only operations.
C.All requests are allowed but a warning is logged.
D.All incoming requests will be rejected until the audit device is restored.
AnswerD

This is the fail-closed security posture of Vault.

Why this answer

Vault is designed to fail-closed regarding audit logs. If the audit device fails, requests are blocked to prevent un-audited operations.

Practice this question →
20
Multi-Selectmedium

Which TWO configurations are required to effectively monitor Vault in a production environment?

Select 2 answers
A.Manual log rotation cron job.
B.Enabled telemetry endpoint.
C.At least one audit device enabled.
D.UI access restricted to local IP only.
E.Debug mode enabled on all nodes.
AnswersB, C

Metrics are essential for health monitoring.

Why this answer

Production environments require robust monitoring of metrics and thorough audit logging for compliance and troubleshooting.

Practice this question →
21
Multi-Selecthard

Which THREE types of metrics are collected by Vault's telemetry system?

Select 3 answers
A.Storage backend performance.
B.Core operation counts.
C.Request latency.
D.Audit file size.
E.User password history.
AnswersA, B, C

Storage metrics track backend I/O.

Why this answer

Vault telemetry includes metrics for request performance, storage backend status, and internal core operations.

Practice this question →
22
MCQmedium

What does the 'vault_core_seal_setup_duration' metric represent?

A.The time taken to initialize the storage backend.
B.The time between audit log rotations.
C.The time spent waiting for a lease to expire.
D.The duration of the unseal process.
AnswerD

This tracks the time spent during the seal/unseal phase.

Why this answer

This metric measures the time taken for Vault to perform the seal setup process during initialization or unsealing.

Practice this question →
23
MCQeasy

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

A.debug
B.warn
C.error
D.info
AnswerA

Debug provides the most granular logs for troubleshooting.

Why this answer

The 'debug' log level provides the most verbosity, which is useful for diagnosing complex startup or configuration errors.

Practice this question →
24
MCQeasy

Which tool is commonly used to view Vault metrics in a graphical format?

A.Vault Audit Viewer
B.Vault UI
C.Grafana
D.Logstash
AnswerC

Grafana is the industry standard for visualizing Vault/Prometheus metrics.

Why this answer

Grafana is the standard tool used to visualize Prometheus metrics, which Vault exports.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Monitoring Vault Environments questions.

Start 20-question session