Vault Server Configuration

A Vault administrator is preparing a server configuration file for a new Vault Enterprise installation. They want to ensure that the Vault UI is accessible and that the server listens on all network interfaces for API requests. Which configuration settings should they use?

Which THREE actions are permitted by the 'vault operator' command group?

You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?

You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?

When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?

An administrator is configuring a new Vault Enterprise server that will use Integrated Storage. They need to specify the storage stanza in the configuration file. Which TWO parameters are required within the 'storage "raft"' stanza to ensure the node can participate in the cluster? (Choose two.)

Which TWO settings are considered best practices for hardening a Vault production listener?

A Vault performance standby node receives a request. What happens if the request is a write operation?

When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?

You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?

An operations team is deploying a new Vault Enterprise cluster that will use Integrated Storage with Auto-Unseal via AWS KMS. The nodes will be provisioned in an Auto Scaling group behind a load balancer. They want to minimize manual steps during initial cluster formation and ensure that nodes can automatically join when scaled. Which configuration approach should they use?

How do you properly revoke a root token after it has been used to perform initialization tasks?

A Vault Enterprise cluster is deployed across three availability zones in AWS. The administrator wants to ensure that the cluster can tolerate the loss of an entire availability zone without losing quorum. The cluster uses Integrated Storage. How many Vault nodes should be deployed, and what is the minimum number of nodes required to maintain quorum after such a loss?

An operations team is deploying Vault Enterprise with Integrated Storage across three nodes. They want to ensure that if one node fails, the cluster remains available for both reads and writes. They also want to minimize the risk of split-brain scenarios. Which of the following configurations should they use?

You are setting up a Vault Enterprise server and want to enable the web UI for administrators. Which configuration setting must be added to the Vault configuration file?

What is the consequence of setting 'cluster_name' in the Vault HCL configuration?

Which THREE factors influence the choice of a 'secret engine' configuration?

Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?

Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?

A Vault Enterprise cluster is configured with Performance Standby nodes to scale read operations. An administrator notices that some write requests are being forwarded to the active node, causing increased latency. They want to ensure that write requests are handled as efficiently as possible. Which statement correctly describes the behavior of Performance Standby nodes regarding write operations?

A Vault Enterprise administrator is configuring a server to use a custom plugin directory for external secrets engines. The plugin binaries are stored in /opt/vault/plugins. The administrator wants Vault to load plugins from this directory and also wants to ensure that plugins are not automatically downloaded from the internet. Which configuration parameter must be set in the Vault server configuration file?

What is the purpose of the 'cluster_addr' in the Vault server configuration?

A Vault Enterprise cluster is configured with Auto-Unseal using AWS KMS. The security team rotates the KMS key used for Auto-Unseal. After rotation, Vault nodes are restarted. What is the expected behavior when the nodes attempt to unseal?

What is the primary function of the 'ui = true' configuration setting?

A Vault Enterprise administrator is configuring a new cluster with Integrated Storage and wants to enable TLS for secure communication. The administrator has obtained a server certificate, a private key, and a CA certificate. Which TWO configuration parameters must be set in the listener stanza to enable TLS? (Choose two.)

A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?