troubleshooting

When configuring path filters for performance replication, what is the effect of using an 'exclude' filter on a path?

A DevOps engineer is using Vault Agent templates to render a database password from a KV v2 secrets engine. The secret is stored at secret/data/db with a key named password. The engineer wants to ensure the rendered file contains only the password value and no extra whitespace or newlines. Which template function should be used to trim whitespace from the secret value?

You want to prevent audit logs from being written to a specific device if the disk is full. What happens to Vault?

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

Where are audit logs physically stored if the 'file' audit device is configured?

You are deploying a new Vault Enterprise cluster that will use a PKCS#11 HSM for auto-unseal. The HSM is a network-attached appliance reachable over TCP. Which TWO configuration elements must be present in the seal stanza to allow Vault to communicate with this HSM? (Choose two.)

An operator is configuring Vault Enterprise to send audit logs to a syslog server. The operator wants to ensure that audit logs are not lost if the syslog server becomes temporarily unavailable. Which configuration parameter should be adjusted to allow Vault to buffer audit logs in memory until the syslog server is reachable?

You want to ensure that a SecretID used by an AppRole is only valid for a single use. Which parameter should be set when creating the SecretID?

A Vault Agent is configured with auto_auth using the AWS auth method and a cache block with use_auto_auth_token = true. A client application connects to the agent's listener and sends a request to read a secret at secret/data/app. The agent's cached token lacks permission for that path, but the client also provides its own Vault token in the X-Vault-Token header. How does the agent handle the request?

You are using Vault Enterprise with integrated storage (Raft) and have a three-node cluster. One node fails and is expected to be down for several hours. You want to ensure the cluster remains available for writes. What is the minimum number of nodes that must be running and healthy to maintain quorum and allow writes?

Which THREE of the following are potential security risks when using the AppRole method if not configured correctly?

Which TWO of the following statements about the 'vault-agent' injector in Kubernetes are correct?

A Vault Enterprise cluster is configured with Performance Replication to a secondary cluster. The secondary cluster is in a different region and is used for disaster recovery and read scaling. You notice that the secondary cluster is experiencing high replication lag, and some read requests return stale data. Which factor is most likely causing the lag?

To monitor the health of a Vault cluster, which endpoint should an external monitoring tool query?

A Vault administrator is preparing a server configuration file for a new Vault Enterprise installation. They want to ensure that the Vault UI is accessible and that the server listens on all network interfaces for API requests. Which configuration settings should they use?

You are using Vault Enterprise with Performance Replication. The primary cluster is in us-east-1, and a secondary cluster is in eu-west-1. You need to ensure that the secondary cluster can continue to serve read requests even if the primary cluster becomes unavailable. Which statement describes the behavior of the secondary cluster in this scenario?

Which THREE actions are permitted by the 'vault operator' command group?

You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?

An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?

A Vault Enterprise operator is investigating a sudden increase in memory usage on a Vault node. They suspect that a large number of leases are accumulating. Which telemetry metric should they examine to track the total number of active leases in the cluster?

Your security team requires that Vault Agent use a specific namespace in Vault Enterprise for all auto-auth and secret retrieval operations. The agent is configured with AppRole auto-auth. Which configuration parameter must you set to ensure the agent operates within the required namespace?

Which THREE features are specific to Vault Enterprise when managing access control?

An operator needs to verify that a Vault Enterprise cluster is currently using a PKCS#11 HSM for its seal and that the seal is healthy. Which command provides the seal type and status without requiring unseal keys?

Which THREE components are involved in a standard high availability (HA) Vault architecture?

A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling Seal Wrap, the operator notices that some existing secrets still appear in plaintext within the storage backend. Which statement explains this behavior?

What is the effect of setting 'token_ttl' on a Role?

An administrator has configured a Vault Enterprise server to use a PKCS#11 HSM for auto-unseal. After a reboot, Vault fails to start and logs show that the PKCS#11 library could not be loaded. Which action should the administrator take first to resolve the issue?

What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?

A Vault Enterprise administrator is configuring a new auth method to authenticate an on-premises application that cannot present a platform identity. The administrator wants to ensure that the initial authentication can only be performed once per login attempt and that the authentication material is bound to the application's network location. Which AppRole role configuration should the administrator apply to achieve these requirements?

What is the benefit of using a Vault Agent sink?

You are running a Vault Enterprise cluster with integrated storage (Raft) across three nodes. One node, vault-3, experiences a hardware failure and is offline for an extended period. After it is repaired and brought back online, you notice that it is not automatically rejoining the cluster. You run `vault operator raft list-peers` on the leader and see that vault-3 is not listed. What is the correct procedure to re-add vault-3 to the cluster?

An administrator is configuring a Vault Enterprise cluster with Integrated Storage (Raft). They want to ensure that the cluster can automatically recover from a full restart without manual unseal steps, while still protecting the master key. They have deployed a supported cloud KMS. Which configuration should they use?

An application is configured to use a Batch token. Which of the following operations will fail when using a Batch token?

Which signal is commonly used with 'change_mode = signal' in Vault Agent templates to reload a service without stopping it?

You are deploying a Vault Enterprise cluster with Integrated Storage (Raft) across three availability zones. To ensure that the cluster remains available if one availability zone fails, how should you distribute the Vault nodes?

You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?

You are performing a Disaster Recovery (DR) promotion. The primary cluster is permanently lost. After running 'vault operator dr promotion', what is the immediate next step you must perform to restore full functionality?

You are configuring a Vault Enterprise cluster with integrated storage to scale for a high-read workload. You plan to add performance standby nodes. Which two statements accurately describe how performance standbys affect scaling and request handling? (Choose two.)

Which THREE conditions might result in a Vault node becoming unhealthy?

In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?

You are using Batch tokens in your environment to improve performance. A developer asks why their Batch token cannot be revoked individually. What is the primary reason?

You are deploying a Vault Enterprise cluster with Integrated Storage and want to ensure high availability. The cluster will have five nodes. What is the minimum number of nodes that must be active and healthy to maintain quorum and allow write operations?

You are deploying Vault with the integrated Raft storage backend. How is high availability achieved?

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

A Vault Enterprise administrator is reviewing the security of a new auth method that will be used by external partners. The partners will authenticate from their own networks and will receive tokens with a limited set of policies. The administrator wants to ensure that if a token is stolen, the blast radius is minimized. Which TWO controls should be applied to the auth role to reduce the impact of a stolen token? (Choose two.)

When configuring the PKCS#11 library, how does Vault find the library on the host OS?

A security engineer is configuring Vault Enterprise to allow an application to authenticate using AppRole. The application will run on a server that has a unique role ID and secret ID. The engineer wants to ensure that the secret ID can be used only once and expires after 24 hours. Which AppRole role configuration parameters should be set to achieve this?

Which THREE factors influence the performance of a Performance Secondary cluster?

A Vault Enterprise cluster is running with three nodes. The active node is handling both reads and writes, and the two standby nodes are idle. You want to scale read performance by allowing the standby nodes to serve read requests while maintaining the same high availability and data consistency guarantees. Which configuration should you enable?

You are operating a Vault Enterprise cluster using the integrated Raft storage backend with three nodes. The cluster is used for production secrets management. After a scheduled maintenance window, you notice that the Vault service on one node was not restarted automatically. When you check the node's status, it is running but not part of the Raft cluster. You need to rejoin the node to the Raft cluster without affecting the existing leader or other peers. Which command should you run on the node to achieve this?

When using the 'vault login -method=kubernetes' command from a pod, which value is automatically sent to the Vault server as the JWT?

Your Vault cluster is behind a load balancer that terminates TLS. For the Kubernetes auth method to properly validate the 'kubernetes_host', what must you configure in Vault?

An application is using the AppRole method and you want to ensure that the SecretID can only be used from a specific CIDR range. Which field in the AppRole role configuration should be updated?

When using Vault with an external storage backend like Consul, what is the effect of changing the 'api_addr' in the Vault configuration file?

When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?

Which TWO of the following are valid parameters for configuring the 'sink' in Vault Agent?

You are operating a Vault Enterprise cluster with Integrated Storage (Raft) and Performance Replication enabled. The primary cluster has three nodes, and the secondary cluster has three nodes. During a planned maintenance window, you need to take down the primary cluster for two hours. You want the secondary cluster to continue serving read requests for replicated data but not accept writes to avoid conflicts when the primary returns. Which action should you take on the secondary cluster before taking down the primary?

A Vault administrator is configuring a new auth method and wants to ensure that the auth method's configuration is protected from unauthorized changes. Which Vault feature should be used to control access to the auth method configuration endpoints?

An administrator is configuring a new Vault Enterprise server that will use Integrated Storage. They need to specify the storage stanza in the configuration file. Which TWO parameters are required within the 'storage "raft"' stanza to ensure the node can participate in the cluster? (Choose two.)

Which TWO settings are considered best practices for hardening a Vault production listener?

A Vault performance standby node receives a request. What happens if the request is a write operation?

Your organization requires fine-grained control over what data is synchronized to a specific Performance Secondary cluster to reduce storage overhead. Which feature should you implement?

You are analyzing Vault's performance and notice high latency in the 'core.fetch_token' metric. What does this suggest?

When integrating Vault with Kubernetes, you are configuring the Vault Kubernetes Auth Method. You need to ensure that the service account token presented by the pod is verified against the Kubernetes TokenReview API. Which configuration is required in Vault to enable this?

Where does the Vault Agent store the token it retrieves via auto-auth by default if a sink is not defined?

When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?

An AppRole's SecretID is stolen. You want to immediately invalidate that specific SecretID without affecting the RoleID or other active tokens. What is the correct action?

You are operating a Vault Enterprise cluster with Performance Replication. The primary cluster is in us-east-1 and a secondary cluster is in eu-west-1. Clients in eu-west-1 are configured to read secrets from the secondary cluster. You notice that after a brief network disruption between the regions, the secondary cluster's replication status shows 'stream-wals' but with a high lag. Some read requests to the secondary are returning stale data. You need to ensure that the secondary cluster serves reads only when it is sufficiently up-to-date. Which action should you take?

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

When using the Kubernetes Auth method, you notice that pods are failing to authenticate. Which log file or command provides the most insight into the validation failure?

An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for seal wrapping and auto-unseal. After enabling the HSM, the administrator notices that the Vault cluster fails to start, reporting that the seal wrap key cannot be retrieved. Which configuration step is most likely missing?

When running 'vault operator raft list-peers', you notice one node is listed but its status is 'dead'. What is the correct procedure to remove it from the Raft cluster?

What is the function of an Identity Alias in Vault?

A Vault Enterprise administrator needs to delegate the management of a specific secrets engine to a team. The team should be able to create, update, and delete roles within the 'database' secrets engine but should not be able to modify the secrets engine's configuration or access other secrets engines. Which policy should the administrator create?

Which telemetry type is most effective for monitoring the 'lease' count in Vault?

You are configuring a Vault Agent to use the AppRole auth method. The agent must retrieve a secret from a KV v2 secrets engine and render it into a configuration file. The secret path is 'secret/data/myapp/config'. Which template function should you use to access the secret's data?

An operations team is deploying a new Vault Enterprise cluster that will use Integrated Storage with Auto-Unseal via AWS KMS. The nodes will be provisioned in an Auto Scaling group behind a load balancer. They want to minimize manual steps during initial cluster formation and ensure that nodes can automatically join when scaled. Which configuration approach should they use?

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

What is the primary function of a 'Performance Standby' node in Vault Enterprise?

How do you properly revoke a root token after it has been used to perform initialization tasks?

Which THREE actions are recommended to secure the Vault-Kubernetes integration against token theft?

You want the Vault Agent to run as a sidecar. Which configuration block allows you to specify the listener address for the Vault Agent's internal API?

Which THREE actions are recommended for maintaining a healthy DR replication setup?

You are the Vault operator for a financial services company. Your Vault Enterprise cluster runs Integrated Storage and is approaching its maximum write throughput during peak trading hours. You need to increase write scalability without changing the client API or adding a separate Disaster Recovery cluster. Which action should you take?

A security team is reviewing how Vault Enterprise tokens are bound to their origin. They observe that a batch token issued by an auth method in one performance standby node is presented to a different performance standby node and is accepted. They want to understand why this behavior is expected and what security property batch tokens lack compared to service tokens. Which statement correctly describes batch tokens in Vault Enterprise?

A Vault Enterprise cluster is deployed across three availability zones in AWS. The administrator wants to ensure that the cluster can tolerate the loss of an entire availability zone without losing quorum. The cluster uses Integrated Storage. How many Vault nodes should be deployed, and what is the minimum number of nodes required to maintain quorum after such a loss?

You are designing a Vault Enterprise cluster for high availability. To ensure that the cluster can tolerate the failure of a single node without losing quorum, and to support Integrated Storage, what is the minimum number of nodes required in the Raft cluster?

Which configuration parameter in the Vault Agent 'cache' block allows you to disable caching for specific requests?

What is the primary purpose of the 'token_ttl' setting in an AppRole role definition?

An operator is troubleshooting a Vault Enterprise cluster where audit logs show that a token was used from an unexpected IP address. The security team wants to enforce that a particular token can only be used from the corporate CIDR block 10.0.0.0/8. Which Vault token parameter should be set to achieve this?

Which TWO factors contribute to the size and performance of Vault audit logs?

An operations team is deploying Vault Enterprise with Integrated Storage across three nodes. They want to ensure that if one node fails, the cluster remains available for both reads and writes. They also want to minimize the risk of split-brain scenarios. Which of the following configurations should they use?

Which component in a Vault HA configuration is responsible for ensuring that only one node acts as the leader at any given time?

Which THREE actions should be taken when analyzing an audit log to identify potential security incidents?

You are setting up a Vault Enterprise server and want to enable the web UI for administrators. Which configuration setting must be added to the Vault configuration file?

Which TWO of the following are true about AppRole 'SecretID' management?

You need to automate the delivery of a Vault token to a new virtual machine during its provisioning process. Which Vault feature is specifically designed to facilitate secure introduction for dynamic infrastructure?

A Vault Enterprise cluster is configured with PKCS#11 auto-unseal. After a scheduled HSM firmware upgrade, Vault nodes fail to unseal and log 'PKCS#11 error: CKR_SLOT_ID_INVALID'. The HSM administrator confirms the partition is online and the PIN is unchanged. Which action should you take first to restore auto-unseal?

You are configuring Vault Agent auto-auth with the AWS auth method. The agent must authenticate using an IAM role attached to an EC2 instance. Which two parameters are required in the auto_auth block's method configuration to enable this? (Choose two.)

Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?

What is the primary difference between HA replication and DR replication in Vault?

Which THREE settings are critical to verify in the Vault configuration file to ensure successful cross-cluster communication?

A Vault Enterprise administrator is configuring a new namespace for a subsidiary company. The subsidiary requires that only users authenticated via their corporate LDAP can access secrets in the namespace. Additionally, the subsidiary's security team must be able to manage policies and auth methods within the namespace but should not have access to the root namespace. Which combination of Vault Enterprise features should the administrator use to meet these requirements?

You are managing a multi-region Vault deployment with Performance Replication. You notice that a specific secret engine mount is not being replicated to the secondary site. What should you check?

You are configuring Vault Agent with a cache stanza to cache responses from a Vault Enterprise cluster. The cache is enabled, and you want to ensure that the agent can continue to serve cached secrets even if the Vault cluster becomes temporarily unavailable. Which cache parameter should you configure to control how long the agent will serve stale data?

What permission level is required for the user account used to authenticate with the HSM?

How can you view the currently enabled audit devices in a Vault cluster?

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

You are implementing a multi-cluster Vault strategy. You want to ensure that a pod in Cluster A cannot authenticate to Vault using a service account token from Cluster B. What configuration must be set?

A platform engineer is configuring a Vault Agent on a database server. The agent must use the AppRole auth method and write the resulting token to a file so that a local backup script can read it. Which top-level configuration block should the engineer populate to define the AppRole role ID and secret ID?

Which TWO authentication methods are commonly configured in the 'auto_auth' block?

You notice that the 'seal status' on your DR secondary differs from the primary cluster. What does this indicate?

When designing a secure Vault-Kubernetes Auth integration, which THREE factors must be considered to prevent token compromise?

You are operating a Vault Enterprise cluster with integrated storage (Raft) and Performance Replication. The primary cluster is in Region A, and the secondary cluster is in Region B. The secondary cluster is currently in a 'secondary' state and is servicing read requests. A client in Region B attempts to write a secret to a KV v2 secrets engine. What happens to this write request?

Which TWO fields are essential in an ACL policy defined in HCL?

A Vault Enterprise operator enables Seal Wrap on a cluster backed by a PKCS#11 HSM. After enabling, they notice that the storage backend contains wrapped values for the barrier key and some data encryption keys, but not for all keys. Which statement explains why only some keys are wrapped?

You are configuring Vault Agent auto-auth with the AppRole auth method on a set of servers. You need to ensure that the agent can authenticate securely using role_id and secret_id. Which two configuration parameters are required within the auto_auth method block for AppRole? (Choose two.)

You are managing a Vault Enterprise cluster with integrated Raft storage. The cluster has five nodes. During a network partition, two nodes become isolated from the other three. The three remaining nodes continue to operate and elect a leader. What is the expected behavior of the two isolated nodes?

You are troubleshooting performance issues in a Vault Enterprise cluster that uses Integrated Storage. You notice that the Raft leader is frequently changing, causing disruptions in service. Which of the following is the most likely cause of this instability?

Which TWO of the following are valid ways to assign policies to a token?

What is the consequence of setting 'cluster_name' in the Vault HCL configuration?

You are evaluating whether to use a Batch token for a high-throughput application that performs frequent secret reads. The application runs on a container platform and can handle token renewals. What is a key characteristic of Batch tokens that affects performance?

Which THREE factors influence the choice of a 'secret engine' configuration?

A Vault Enterprise cluster is configured with a file audit device. An operator notices that audit log entries are being written to disk, but the Vault server's memory usage is steadily increasing. They suspect that audit log buffering is causing the issue. Which configuration parameter directly controls the maximum number of audit log entries that can be buffered in memory before being flushed to the audit device?

If you are running Vault in a high availability cluster, where should you look for information regarding leader election?

When configuring the Kubernetes auth method, what does the 'token_bound_cidrs' parameter on a role do?

Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?

You are scaling a Vault Enterprise cluster to handle a high volume of database credential generation. You configure the database secrets engine with a maximum open connections setting of 100 and a maximum idle connections setting of 20. After a few hours, you notice that the number of open connections to the database frequently reaches 100 and stays there, even when request rates are moderate. You want to reduce the connection churn and improve performance without changing the maximum open connections. What should you do?

Which THREE of the following are common troubleshooting steps when Vault fails to unseal via HSM?

You operate a Vault Enterprise Performance Primary with a Performance Secondary. The secondary is used for read-only workloads in a disaster recovery site. During a planned maintenance window, the primary is taken offline. Which statement describes the expected behavior of the secondary?

Which component is responsible for receiving and responding to read requests in a Performance Standby configuration?

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

You are responsible for a Vault Enterprise cluster using integrated storage (Raft). The cluster has five nodes spread across three availability zones. During a routine maintenance window, you need to replace one node's storage volume. You stop the Vault service on that node, replace the volume, and restart Vault. The node comes back up but does not rejoin the Raft cluster automatically. Which action should you take to rejoin the node to the existing cluster?

A Vault Enterprise cluster is configured with Performance Standby nodes to scale read operations. An administrator notices that some write requests are being forwarded to the active node, causing increased latency. They want to ensure that write requests are handled as efficiently as possible. Which statement correctly describes the behavior of Performance Standby nodes regarding write operations?

Which TWO of the following are valid ways to improve the security of the AppRole authentication process?

A Vault Enterprise operator has just enabled the Transit secrets engine in a namespace dedicated to a payment processing team. The team stores encryption keys in Transit and uses them to encrypt customer credit card data before writing it to an external database. An auditor asks the operator to prove that the plaintext of those credit card numbers never leaves the Vault server. Which property of the Transit secrets engine supports this claim?

Which of the following is the most effective way to secure a Vault token during the 'Secure Client Introduction' phase in an automated environment?

When using 'template_config' to set the 'static_secret_render_interval', what is the minimum value you can set?

A Vault Enterprise administrator is configuring a server to use a custom plugin directory for external secrets engines. The plugin binaries are stored in /opt/vault/plugins. The administrator wants Vault to load plugins from this directory and also wants to ensure that plugins are not automatically downloaded from the internet. Which configuration parameter must be set in the Vault server configuration file?

Which TWO of the following are valid sink types in Vault Agent?

You notice an 'audit_failure' error in the Vault logs. What is the immediate consequence for client requests?

A Vault Enterprise administrator is configuring an external group mapping using the LDAP auth method. They want to ensure that members of the LDAP group 'vault-admins' automatically receive the 'admin' policy when they authenticate. Which configuration is required to achieve this?

What is the purpose of the 'cluster_addr' in the Vault server configuration?

Which TWO of the following statements are true regarding Performance Standby nodes?

A Vault Enterprise operator is configuring telemetry to be sent to a Prometheus server. They want to ensure that metrics are retained for at least 24 hours to allow for trend analysis. Which configuration parameter in the telemetry stanza controls the length of time that Prometheus metrics are retained in memory?

You are deploying Vault Enterprise 1.15 on three nodes and want auto-unseal backed by a PKCS#11 HSM. The HSM vendor provides a shared library at /usr/lib64/libpkcs11.so, and each node must authenticate using an HSM partition PIN. Which seal configuration key holds the PIN so Vault can open the HSM session?

A Vault Enterprise cluster is experiencing intermittent performance issues. The operations team has enabled telemetry and is collecting metrics via StatsD. They notice that the `vault.runtime.alloc_bytes` metric is steadily increasing over several days without a corresponding increase in active tokens or leases. What is the most likely explanation for this trend?

An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?

Which THREE types of metrics are collected by Vault's telemetry system?

Your team runs Vault Agent with auto_auth using the AWS auth method on EC2 instances. The agent's token is about to expire, and you must ensure the agent continues to serve requests without manual intervention. Which TWO behaviors does Vault Agent perform to maintain a valid token? (Choose two.)

Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?

You are configuring Vault replication in an environment with strict firewall rules. Which ports must be open between the primary and secondary clusters?

A Vault Enterprise cluster is configured with a performance standby and a disaster recovery (DR) replica. The administrator wants to ensure that if the primary cluster fails, the DR replica can be promoted and clients can continue to access secrets without re-authenticating. Which statement about token replication is true?

In the context of the Vault Kubernetes Auth Method, what is the role of the 'reviewer_service_account'?

When using the Kubernetes auth method, what does the 'audience' field in the configuration allow you to do?

A security team is reviewing the configuration of a Vault Enterprise cluster that uses the Transit secrets engine for encryption as a service. They want to ensure that the encryption keys are protected against unauthorized export and that cryptographic operations are audited. Which two configurations should they implement? (Choose two.)

A Vault Enterprise cluster is configured with Auto-Unseal using AWS KMS. The security team rotates the KMS key used for Auto-Unseal. After rotation, Vault nodes are restarted. What is the expected behavior when the nodes attempt to unseal?

An administrator needs to enable secure client introduction for a legacy application using the AppRole auth method. The application resides on a server where it can periodically fetch a SecretID. What is the most secure workflow to ensure the secret delivery process is not compromised?

What does the 'root' policy in Vault provide?

What is the primary function of the 'ui = true' configuration setting?

Which component of Vault is responsible for communicating with the HSM?

When testing a new HSM configuration in a development environment, why is it recommended to use a separate partition?

You have a Vault Enterprise cluster with integrated storage (Raft) running three nodes in one data center. To prepare for a potential data center outage, you add three more nodes in a second data center. After a network partition isolates the first data center, the three nodes in the second data center remain active and continue serving reads and writes. Later, the partition is resolved, but the original three nodes have not automatically rejoined. You need to restore the cluster to a healthy state with all six nodes participating, while minimizing downtime. What is the most appropriate action?

Which TWO statements are true about the relationship between Performance Standby nodes and Performance Replication?

A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)

You are using Vault Enterprise with Disaster Recovery (DR) replication. The primary cluster is in Region A, and the DR secondary is in Region B. A catastrophic failure occurs in Region A, and the primary cluster is completely lost. You promote the DR secondary to primary. After promotion, you need to reconfigure the old primary's remaining nodes (if any) to act as a DR secondary for the new primary. However, the old primary's nodes are completely destroyed. What is the recommended approach to re-establish DR replication with a new secondary cluster in Region A?

Which TWO of the following are potential causes for a 'PKCS#11 error' during Vault operation?

You are preparing to add a new Performance Secondary cluster to an existing Vault Enterprise Performance Replication setup. The primary cluster uses integrated storage. To ensure that the new secondary can successfully receive replication data and serve read requests, which step must you take before enabling replication on the secondary?

A Vault Enterprise administrator is preparing a new cluster that will use a PKCS#11 HSM for auto-unseal. Before starting Vault, they need to confirm the HSM library is discoverable. Which environment variable or configuration field should they set to point Vault to the PKCS#11 library?

A Vault Enterprise cluster uses namespaces to isolate teams. An administrator creates a token in the `team-a` namespace with a policy that grants read access to `secret/data/team-a/*`. The administrator then uses this token to read a secret at `secret/data/team-b/config` in the `team-b` namespace. What is the outcome?

When using Vault Agent to authenticate with the AWS auth method, which parameter is required in the 'method' block to identify the IAM role?

A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?

Which component of the Vault Agent is responsible for managing the lifecycle of the vault token retrieved via auto-auth?

Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?

Which THREE actions can the 'change_mode' parameter trigger in the Vault Agent template block?

You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?

A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?

A Vault Enterprise cluster with integrated storage (Raft) is experiencing intermittent performance degradation. The operator observes that the 'vault_raft_leader_lastContact' metric frequently spikes above 500 ms. Which underlying issue is most likely indicated by this metric behavior?

What does the 'vault_core_seal_setup_duration' metric represent?

You are deploying a new Vault Enterprise cluster with integrated storage (Raft) in a single data center. You have three nodes: vault-1, vault-2, and vault-3. After starting Vault on all three nodes, you initialize vault-1, which becomes the leader. You then need to join vault-2 and vault-3 to the cluster. Which command should you run on vault-2 and vault-3 to join them to the Raft cluster?

Which log level should be used when you need to capture detailed debugging information for Vault startup issues?

You are configuring a Vault Enterprise cluster to use a hardware security module (HSM) for seal wrapping and auto-unseal. During testing, you notice that after a node restarts, Vault still requires manual unseal despite the HSM being available. You have verified that the HSM is reachable and the seal stanza is correctly configured. Which of the following is the most likely cause?

Which TWO of the following factors can cause a Vault cluster to lose quorum in a Raft-based deployment?

What is the benefit of using Performance Replication over standard DR Replication?

A Vault Enterprise cluster uses a Control Group to require approval for reading secrets at "secret/data/prod/*". A user with a token that has a policy granting read on that path attempts to read a secret but is blocked pending approval. Which statement accurately describes the token's capabilities during the pending approval?

An administrator is configuring Vault Enterprise to use a hardware security module (HSM) for auto-unseal. The HSM supports PKCS#11. After configuring the seal stanza, Vault fails to start. Which action should the administrator take to troubleshoot the issue?

Your organization uses Vault Enterprise with Performance Replication to replicate secrets across multiple data centers. You are planning a failover test where the primary cluster will be taken offline. You need to ensure that the secondary cluster can be promoted to primary without data loss. Which two actions must you perform before the failover to guarantee a clean promotion? (Choose two.)

Which tool is commonly used to view Vault metrics in a graphical format?

A Vault Enterprise administrator is designing an HSM integration that must survive the loss of a single HSM appliance. The design uses PKCS#11 auto-unseal and Seal Wrap. Which TWO considerations are critical to ensure availability and data recoverability? (Choose two.)

When utilizing performance replication, your Vault cluster experiences high replication lag between the primary and secondary sites. Which action would most effectively reduce this lag?

A junior operator notices that the standby nodes in a three-node Vault Enterprise cluster report a sealed status after a planned restart, while the active node is unsealed. They want to confirm cluster readiness before adding the nodes back to the load balancer. Which endpoint should they query on each node to determine seal status and standby state programmatically?

In a Vault HA setup using Raft, how many nodes are typically recommended for a production cluster to ensure fault tolerance?

You manage a Vault Enterprise cluster with Performance Replication enabled. The primary cluster is in us-east-1 and a secondary cluster is in eu-west-1. Clients in eu-west-1 are experiencing high read latency even though replication lag is consistently low. You have already verified that the secondary is healthy and has Performance Standby nodes. What is the most likely cause?

Your Vault Enterprise cluster is configured with a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you restore a snapshot to a new cluster that also has the same HSM seal configuration. After starting the new cluster, Vault remains sealed and logs indicate a PKCS#11 error. What is the most likely cause?

A Vault Enterprise cluster uses a PKCS#11 HSM for seal wrap and auto-unseal. The security team rotates the HSM partition PIN. Vault nodes are still running with the old PIN in their configuration files. What is the most likely operational impact?

Which TWO of the following are true regarding the Vault Kubernetes Auth Method 'bound_service_account_names' parameter?