CCNA Vault Server Configuration Questions

The 'ui' parameter is a top-level configuration option that enables the Vault UI. Setting it to true makes the UI accessible at the /ui path. The 'listener' stanza's 'address' parameter specifies the bind address; using '0.0.0.0:8200' makes Vault listen on all network interfaces on port 8200. This combination correctly enables the UI and allows API requests from any interface.

The vault operator command group covers cluster lifecycle operations, including rekey, which generates new unseal and master keys. Rekeying the master key is therefore permitted, satisfying the stem's question about actions available within this command group.

Setting tls_disable = false forces the listener to serve TLS, encrypting all client-to-Vault traffic and preventing cleartext communication. This satisfies the stem's hardening requirement, since the default listener configuration permits plaintext HTTP unless TLS is explicitly enabled with certificates.

Running 'vault operator raft join' instructs the new node to contact the existing cluster's leader and join the Raft peer set, which is the required step before the node can participate in Integrated Storage replication.

Vault treats audit devices as blocking: if every enabled audit device fails to write, Vault halts request processing and returns errors, preventing unlogged operations. This fail-closed behaviour guarantees no request is served without an audit trail.

The 'node_id' parameter provides a unique identifier for the node within the Raft cluster. It is required for Integrated Storage because Raft uses node IDs to distinguish cluster members. If omitted, Vault will generate one based on the hostname, but for clarity and stability, it is best practice to set it explicitly. A stable node ID helps with cluster management and recovery.

Setting `tls_min_version` to `tls12` forces the listener to reject TLS 1.0 and 1.1 handshakes, eliminating deprecated protocol versions with known weaknesses. This directly satisfies the hardening requirement by ensuring only TLS 1.2 or higher negotiates with clients, while remaining compatible with Vault's supported cipher suites and typical production clients.

Performance standby nodes cannot service writes, since only the active node holds the write-ahead log and storage backend. The standby therefore forwards the write request over the cluster port to the active node, which processes it and replicates the result back.

Using a secure management system to populate config values satisfies the stem's cloud constraint by keeping secrets out of the configuration file entirely. Vault's config supports environment variables and templated values, so credentials are injected at runtime rather than persisted on disk, avoiding exposure through instance images, snapshots or version control.

vault operator rekey -init starts a rekey operation and accepts new key configuration such as -key-shares and -key-threshold, allowing the number of shares to change. This satisfies the stem's requirement to alter key configuration during rekey.

Cloud auto-join using the 'discovery' stanza with AWS tags or Consul allows nodes to dynamically discover peers without hardcoded IPs. Combined with Auto-Unseal via AWS KMS, nodes can automatically unseal and join the cluster. This is the recommended approach for dynamic environments like Auto Scaling groups, as it eliminates manual configuration updates when nodes are added or replaced.

Running 'vault token revoke' against the root token immediately invalidates it, including all its child tokens and leases, once initialisation tasks are complete. This removes the highly privileged credential, satisfying the requirement to properly revoke rather than merely let it expire.

With 5 nodes spread across three AZs (e.g., 2,2,1), losing one AZ (the one with 2 nodes) leaves 3 nodes, which is exactly quorum (majority of 5 is 3). This maintains quorum and allows the cluster to continue operating. Thus, 5 nodes is the recommended deployment to tolerate AZ loss while maintaining quorum. The minimum number of nodes required for quorum in a 5-node cluster is 3.

With three voters, quorum is two. The loss of any one node still leaves two voters, which can form a quorum and continue to accept writes. Placing each node in a different availability zone ensures that a zone failure only affects one node, so the cluster remains available. Automatic snapshotting helps with backup and recovery but is not directly related to quorum. This configuration balances fault tolerance and split-brain avoidance.

The `ui = true` setting enables the Vault web UI. It is a top-level configuration parameter that activates the built-in UI, allowing administrators to interact with Vault through a browser. Without it, the UI is disabled by default. This setting is straightforward and does not require additional listeners or stanzas.

The cluster_name parameter sets a human-readable identifier that Vault stamps into audit log entries and uses to distinguish clusters during replication, including performance and disaster recovery topologies. It satisfies the stem by naming the specific artefacts where the value appears.

The mount path determines the API endpoint and policy paths through which clients access the engine, so it directly shapes configuration and access control. Choosing where to mount therefore influences how the secret engine is configured and consumed.

Performance Replication is an Enterprise-only server configuration feature, letting clusters replicate data across datacentres for horizontal scaling and DR. It is configured at the server level, satisfying the stem's requirement that the feature belongs to Vault Enterprise and relates directly to server configuration.

The seal stanza must reference the specific KMS key by its identifier or ARN, telling Vault which key encrypts and decrypts the root key. Without this value, Vault cannot target the correct key, so the configuration requirement remains unsatisfied.

Performance Standby nodes are designed to handle read-only operations locally, which offloads read traffic from the active node. Write operations, however, must be forwarded to the active node because they require consensus and state change. This forwarding is automatic and transparent to the client. The active node remains the only node that can process writes, ensuring consistency.

The plugin_directory parameter specifies the directory where Vault looks for plugin binaries. Setting it to /opt/vault/plugins allows Vault to load external plugins from that location. This is the correct parameter to configure for custom plugins. Additionally, to prevent automatic downloads, you would omit or disable the plugin_auto_download parameter, but the primary requirement is to set plugin_directory.

The `cluster_addr` setting specifies the address and port each node advertises for inter-node cluster traffic, enabling replication and request forwarding between Vault servers. It satisfies the stem's requirement by designating the dedicated listener used for node-to-node communication, distinct from the `api_addr` used for client requests.

AWS KMS stores the key version used during encryption within the ciphertext metadata. When Vault calls KMS to decrypt the root key, KMS automatically selects the correct key version for decryption, even after rotation, as long as that version remains enabled. Thus, Vault unseals successfully without configuration changes. This is the expected behavior when key rotation occurs and old versions are retained.

Setting ui = true activates Vault's built-in web-based graphical interface, allowing browser access to manage secrets, policies and authentication. Without it, the UI listener is not served, so operators must use the CLI or API instead.

The tls_key_file parameter specifies the path to the private key corresponding to the server certificate. It is required for TLS to decrypt and sign handshake messages. Without it, Vault cannot complete the TLS handshake. It must be set in the listener stanza and kept secure with appropriate file permissions.

Vault stores only the KMS key identifier and relies on IAM permissions to call Decrypt; AWS KMS rotation creates new backing key material under the same key ID, so no Vault reconfiguration is needed provided permissions persist.