Fault Tolerant Vault Environments practice questions

Increase the 'max_lease_ttl' on the primary cluster.

Why it fails: Lease TTL settings do not affect cluster-to-cluster request routing latency.

Run 'vault write sys/replication/performance/secondary/update' to increase synchronization speed.

Why it fails: This is not a valid command for performance tuning.

Restart the secondary cluster to clear the internal request cache.

Why it fails: Restarting is a disruptive step and doesn't solve routing issues.

The standby node attempts to become the leader and process the write.

Why it fails: Performance standbys do not promote themselves in response to client writes.

The request is cached locally until the primary is available.

Why it fails: Writes are not cached locally on standbys; they must reach the primary.

The request is rejected with a 403 Forbidden.

Why it fails: Vault automatically handles forwarding for write requests.

vault operator migrate

Why it fails: This command exists for storage migration but the snapshot method is the standard way to migrate data to Raft.

vault write sys/storage/backup

Why it fails: This path does not exist for Raft snapshots.

vault operator seal

Why it fails: Sealing stops the server but does not capture data.

The load balancer must perform a health check and restart the standby nodes.

Why it fails: Load balancers route traffic but do not participate in internal leader election.

Vault requires a manual unseal process on all nodes to trigger a new election.

Why it fails: Unsealing is required for decryption, not for leader election.

The Vault administrator must manually promote a standby node via the CLI.

Why it fails: Vault HA election is automated through the storage backend session lock.

The 'disable_mlock' setting.

Why it fails: This controls memory locking and is unrelated to network replication.

The 'max_lease_ttl' value.

Why it fails: This affects token expiration, not replication lag.

The 'default_max_request_size'.

Why it fails: This limits request sizes, not replication performance.

They are automatically synced back to a new primary.

Why it fails: Promotion is a manual or orchestrated process.

They are encrypted and cannot be accessed.

Why it fails: The DR secondary can decrypt data once it has the master key.

They are unavailable and must be restored from backup.

Why it fails: They are available, just locked in a secondary state.

It is used to authorize the secondary to unseal itself.

Why it fails: Unsealing is a separate process involving key shares.

It is used to allow the secondary to perform write operations.

Why it fails: DR secondaries are read-only and cannot perform write operations.

It is used to encrypt data transferred over the network.

Why it fails: Replication uses TLS for encryption, not the token.

An external Consul agent running on every node.

Why it fails: Integrated Raft storage embeds consensus inside Vault, so no external Consul agent is needed; requiring one contradicts the architecture. A Consul agent per node is correct when Vault uses Consul as its storage backend instead of Raft.

A load balancer to perform round-robin writes.

Why it fails: A load balancer distributes API traffic but must not round-robin writes, since only the active node accepts writes and others return redirects. Round-robin is correct for stateless read traffic across performance standbys, not for write requests.

A shared network file system (NFS) for the storage directory.

Why it fails: Raft persists data on each node's local disk; a shared NFS directory is unsupported and corrupts consensus. NFS is correct for storage backends such as filesystem or when using a shared backend that explicitly supports it, not for Raft.

Deleting the old primary's data from the secondary.

Why it fails: The secondary replaces the primary; this is not a manual step.

Re-initializing the cluster.

Why it fails: Re-initialization is not required upon promotion.

The node has not been initialized with 'vault operator init'.

Why it fails: Nodes joining a cluster should not be initialized independently.

The storage backend is set to 'consul'.

Why it fails: This is a configuration choice, not a failure reason.

The node has a different Vault version.

Why it fails: Version mismatches are generally handled if they are minor, but not the primary cause of join failure.

Configure the primary cluster to forward all read requests to the secondary.

Why it fails: The primary cluster does not forward read requests to the secondary. In Performance Replication, the secondary cluster handles reads locally if configured with Performance Standby nodes and appropriate mount filters. The primary is not involved in routing reads to the secondary. Forwarding reads from primary to secondary is not a feature; it is the opposite of the desired behavior. Therefore, this option is incorrect.

Enable the 'read-only' mode on the secondary cluster.

Why it fails: There is no 'read-only' mode setting in Vault Enterprise that enables local reads on a Performance Replication secondary. While a Performance Replication secondary can serve reads, it does so through Performance Standby nodes and mount filters, not through a read-only mode. The 'read-only' concept is not a configuration option for this purpose. Therefore, this is not a valid configuration.

Set the secondary cluster to act as a Disaster Recovery (DR) secondary.

Why it fails: A DR secondary is designed for disaster recovery and does not serve client requests; it remains in a standby mode and only becomes active upon promotion. DR replication does not support local reads. Performance Replication is the feature that allows local reads on a secondary. Therefore, configuring the cluster as a DR secondary would not achieve the goal of handling read requests locally.

The secondary enters a 'standby' state and only services reads from its local replica until connectivity to the primary is restored.

Why it fails: A standby node in Vault is typically a node within the same cluster that is ready to take over leadership, not a replicated secondary cluster. The secondary cluster does not become a standby; it remains a secondary cluster and continues to service reads based on its replication state. The term 'standby' is specific to HA within a single cluster, not to cross-cluster replication roles.

The secondary automatically promotes itself to primary and begins accepting writes to avoid downtime.

Why it fails: Automatic promotion is not a feature of Performance Replication; promotion must be performed manually using 'vault operator promote' or through the UI/API. Automatic promotion could lead to split-brain scenarios and data conflicts. The secondary remains a secondary until an operator explicitly promotes it, ensuring controlled failover and data consistency.

The secondary enters a 'sealed' state and cannot service any requests until the primary is reachable.

Why it fails: A sealed Vault node cannot service any requests, but sealing is a security state, not a replication state. The secondary cluster does not automatically seal when the primary is unreachable. It continues to operate in its secondary role, servicing reads from its local replica. Sealing would require manual intervention or a seal wrap configuration, and it is unrelated to replication connectivity.

The promotion will succeed only if the operator uses the '-force' flag with 'vault operator promote'.

Why it fails: Vault does not provide a '-force' flag for 'vault operator promote'. Promotion requires a valid promotion token from the primary, and during a network partition, this token cannot be obtained. Forced promotion is not a supported feature; attempting to bypass the token requirement would compromise data integrity and is not allowed. The correct approach is to restore connectivity or follow documented disaster recovery procedures.

The promotion will succeed but the DR secondary will remain read-only until it reconnects to the primary.

Why it fails: If promotion succeeds, the DR secondary becomes a primary and can accept writes. However, promotion cannot succeed without connectivity to the primary to obtain the promotion token. The scenario describes a network partition, so the promotion will fail. There is no intermediate state where the secondary is promoted but remains read-only; promotion is an all-or-nothing operation that transitions the cluster to primary mode.

The promotion will succeed immediately, and the DR secondary will become the new primary, allowing writes in Region B.

Why it fails: Promotion of a DR secondary requires connectivity to the primary to obtain the latest replication state and ensure data consistency. During a network partition, the secondary cannot communicate with the primary, so the promotion will fail. The operator must wait for connectivity to be restored or use a forced promotion with a known good state, which is not the default behavior.

Configure each Vault node with a unique 'node_id' and ensure they can communicate over port 8200 and 8201.

Why it fails: While unique node IDs and proper communication ports are necessary for cluster operation, they are not specific to tolerating an AZ failure. Port 8200 is the API port, and 8201 is used for cluster communication. These are general requirements for any Vault cluster, not the specific configuration needed for AZ fault tolerance.

Configure a load balancer to distribute traffic evenly across all Vault nodes in all AZs.

Why it fails: A load balancer improves client access and failover for API requests, but it does not affect Raft quorum or the cluster's ability to tolerate an AZ failure. Quorum is determined by the number and distribution of Vault nodes, not by how client traffic is balanced. This option is a distractor that addresses availability from the client perspective, not cluster fault tolerance.

Enable 'raft' as the storage backend and set 'cluster_addr' to the node's address in each AZ.

Why it fails: Using Raft storage and setting cluster_addr are basic requirements for any Integrated Storage cluster, but they do not by themselves ensure AZ fault tolerance. The key is the distribution of nodes across AZs and maintaining an odd number to achieve quorum. These settings are necessary but not sufficient for the specific goal.

The secondary cluster must be configured with 'performance_replication' mode in its Vault configuration file.

Why it fails: Performance Replication is enabled through the replication API or CLI after the cluster is initialized, not by a configuration file setting. There is no 'performance_replication' mode in the Vault configuration file. The secondary is activated with a replication token, and the mode is set during that process. Configuration files are used for storage, listener, and seal settings, not for replication mode.

The secondary cluster must be promoted to primary to service reads locally.

Why it fails: Promoting the secondary to primary would make it a separate primary cluster, not a secondary that services reads while forwarding writes. In Performance Replication, the secondary remains a secondary and can service reads without promotion. Promotion is used for failover, not for enabling local reads. Promoting would break the replication relationship and is not required for local read servicing.

The secondary cluster must use a different storage backend than the primary.

Why it fails: The storage backend type does not need to differ between primary and secondary. In fact, using the same backend type (e.g., integrated storage) is common and supported. The replication mechanism handles data synchronization regardless of the backend, as long as it is a supported backend. Using a different backend is not a requirement and could complicate management.

The write request is processed locally on the secondary and then replicated to the primary.

Why it fails: Performance standbys do not process writes locally; they forward them to the primary. Local processing would risk conflicts and divergence, as the primary is the source of truth. Replication is one-way from primary to secondary, so writes must be handled by the primary to maintain consistency.

The write request is queued on the secondary until the primary becomes available.

Why it fails: Vault does not queue write requests on a performance standby. If the primary is unavailable, the write will fail immediately with an error. Queuing is not a feature of Performance Replication; clients must handle retries. The secondary does not buffer writes for later delivery.

The write request is rejected with a 'permission denied' error because the secondary is read-only.

Why it fails: While a replication secondary is read-only for replicated data, a performance standby is a specific mode where the secondary can forward writes to the primary. It is not simply read-only; it acts as a proxy for write operations. Rejecting writes would defeat the purpose of a performance standby, which is to handle both reads and writes by forwarding writes to the primary.

Deploy 4 nodes; quorum requires at least 3 nodes.

Why it fails: A 4-node cluster has a quorum of 3, so it can tolerate only 1 node failure. However, even-numbered clusters are not recommended because they do not provide additional fault tolerance compared to the next lower odd number. A 4-node cluster can tolerate 1 failure, same as a 3-node cluster, but requires more resources. For tolerating one availability zone failure, 3 nodes suffice.

Deploy 5 nodes; quorum requires at least 3 nodes.

Why it fails: A 5-node cluster has a quorum of 3 and can tolerate 2 node failures. While this provides higher fault tolerance, it is more than needed to tolerate a single availability zone failure. The scenario asks for the minimum to tolerate one zone failure, which is 3 nodes. Deploying 5 nodes increases cost and complexity without additional benefit for this requirement.

Deploy 2 nodes; quorum requires both nodes to be online.

Why it fails: A 2-node Raft cluster requires both nodes to be online to maintain quorum because quorum is (2/2)+1 = 2. If one node fails, the cluster loses quorum and becomes unavailable for writes. This does not provide fault tolerance for an availability zone failure. A minimum of 3 nodes is recommended for HA.

Run 'vault operator init' on the DR secondary to generate new unseal keys, then unseal it and promote it with 'vault operator promote'.

Why it fails: This is incorrect. Running 'vault operator init' would create a new, independent Vault cluster, losing the replicated data and breaking the DR relationship. The DR secondary already has the data and unseal keys from the primary. Initialization is only for new clusters. Promotion does not require new unseal keys; it uses the existing cluster's keys and configuration.

Run 'vault operator raft snapshot restore' on the DR secondary using the latest snapshot from the primary, then promote it.

Why it fails: This is incorrect. Snapshot restore is not needed for DR promotion. The DR secondary already has a replica of the data. Restoring a snapshot would overwrite the existing data and could cause inconsistencies. The promotion process is designed to make the existing replica writable without restoring from a snapshot. Using a snapshot would also require additional steps and is not part of the standard DR failover procedure.

Run 'vault operator dr promote' on the DR secondary, then unseal it with the original unseal keys, and update clients to point to the new primary.

Why it fails: This is incorrect. The DR secondary is already unsealed and running; it does not need to be unsealed again after promotion. The 'vault operator dr promote' command promotes the secondary to primary, but you must also ensure that the DR secondary's replication mode is changed and that clients are redirected. Unsealing is not part of the promotion process; the cluster remains unsealed throughout.

Generate a new root token using `vault operator generate-root` on the new primary.

Why it fails: Generating a new root token is not required for DR promotion. The existing root token or other authentication methods remain valid after promotion. While it may be a good practice to rotate credentials after a failover, it is not a mandatory step to make the cluster operational. The promotion itself does not invalidate tokens.

Update the `api_addr` and `cluster_addr` in the Vault configuration on the new primary to reflect its new role, then restart Vault.

Why it fails: The `api_addr` and `cluster_addr` typically do not change during DR promotion because the node's network identity remains the same. Restarting Vault is not required for promotion. Changing these addresses without cause could disrupt cluster communication. The promotion command handles the necessary internal state changes.

Run `vault operator raft snapshot restore` on the new primary to apply the latest data.

Why it fails: The DR secondary already has a replicated copy of the data. Running a snapshot restore is unnecessary and could cause data loss if the snapshot is older. The promotion process uses the existing replicated data. Snapshot restore is used for backup and recovery, not for DR promotion.

The load balancer.

Why it fails: A load balancer distributes client traffic across healthy nodes but holds no cluster state and cannot arbitrate leadership; Vault's integrated storage or Consul performs leader election via consensus. It is tempting because load balancers do sit in front of HA clusters, and would be correct for spreading API requests, not for enforcing single-leader semantics.

The Vault server process configuration file.

Why it fails: The server configuration file only declares storage, listener and HA settings at startup; it cannot coordinate live nodes or resolve split-brain. It is tempting because HA parameters such as api_addr and cluster_addr live there, and it would be correct for defining a node's storage backend, not for runtime leader arbitration.

The Vault CLI.

Why it fails: The Vault CLI is an administrative client that issues API calls; it holds no cluster membership or election state, so it cannot determine leadership. It is tempting because operators use it to inspect leader status, and it would be the right tool for querying which node currently leads, not for guaranteeing only one does.