Select Two (Multi-Select) Questions

Manual log rotation cron job.

Why wrong: Vault manages its own rotation.

UI access restricted to local IP only.

Why wrong: This is a network security policy, not a monitoring requirement.

Debug mode enabled on all nodes.

Why wrong: Debug mode is for troubleshooting, not standard production.

ttl

Why wrong: TTL is not defined in the ACL policy.

entity

Why wrong: Entities are separate objects.

description

Why wrong: Descriptions are optional metadata.

The node has not been initialized with 'vault operator init'.

Why wrong: Nodes joining a cluster should not be initialized independently.

The storage backend is set to 'consul'.

Why wrong: This is a configuration choice, not a failure reason.

The node has a different Vault version.

Why wrong: Version mismatches are generally handled if they are minor, but not the primary cause of join failure.

hsm_type

Why wrong: This is not a valid parameter.

max_attempts

Why wrong: This is not a standard seal configuration parameter.

Sort logs by timestamp.

Why wrong: Sorting is a function, not a core security analysis action.

Check for successful 'read' operations on all secrets.

Why wrong: Too broad to be effective for security analysis.

They maintain their own independent master key.

Why wrong: All nodes in an HA cluster share the same master key.

They can serve requests for secrets written to any cluster.

Why wrong: They only serve data from the cluster they are part of.

They automatically promote themselves if the primary fails.

Why wrong: Promotion is a separate HA event.

Sentinel policies are written in HCL.

Why wrong: Sentinel has its own domain-specific language.

Sentinel policies replace ACLs.

Why wrong: Sentinel policies supplement ACLs.

Sentinel policies are evaluated before ACLs.

Why wrong: ACLs are typically evaluated before Sentinel.

The number of active leases.

Why wrong: Leases do not affect log size directly.

The number of enabled secrets engines.

Why wrong: The number of engines has negligible impact on log size.

The size of the Vault data store.

Why wrong: Storage size does not correlate with audit log volume.

Secret engine path.

Why wrong: The path is the target, not a component of the config.

Policy name.

Why wrong: Policies are not part of the control group definition itself.

Auth method name.

Why wrong: Auth methods are not directly part of the group config.

Restart the secondary cluster.

Why wrong: Promotion does not require a restart.

Upgrade the secondary's license to Enterprise.

Why wrong: It is already enterprise if it was a secondary.

delete

Why wrong: Delete is not a valid action.

exec

Why wrong: Exec is not a valid action.

Automatic failover to a standby Vault cluster.

Why wrong: Seal Wrap is a key protection feature, not a high availability feature.

Increased storage backend performance.

Why wrong: Seal Wrap adds latency, not performance.

Automatic deletion of audit logs.

Why wrong: This is not a feature of Seal Wrap.

It is only available for non-Enterprise versions.

Why wrong: It is available for both.

It bypasses all Vault policies.

Why wrong: It enforces all Vault policies.

It requires manual pod restarts to update secrets.

Why wrong: It handles updates dynamically via the agent sidecar.

sudo

Why wrong: Sudo is an administrative capability.

control-group

Why wrong: Control-group is a workflow parameter, not a basic capability.

Root Token

Why wrong: Root tokens are not used for normal AppRole operations.

LDAP Password

Why wrong: LDAP is a separate auth method.

Token Auth Method

Why wrong: Token auth is available in OSS.

KV v2 Secrets Engine

Why wrong: KV v2 is available in OSS.

A secondary Vault cluster.

Why wrong: This is part of DR, not local HA.

An external monitoring tool.

Why wrong: Monitoring is useful but not required for HA functionality.

The HSM must use the RSA algorithm for all keys.

Why wrong: HSMs support various algorithms; Vault does not mandate only RSA.

The transit engine must be the only engine enabled.

Why wrong: Other engines can be enabled.

All audit logs must be sent to the HSM.

Why wrong: Audit logs are independent.

ttl

Why wrong: Sink does not manage token TTL.

auth_method

Why wrong: This is not part of the sink configuration.

mode

Why wrong: This is not a parameter for sink blocks.

The user's password strength.

Why wrong: Password strength does not affect authorization.

The number of active mounts.

Why wrong: Mount count does not affect authorization.