CCNA Scaling Vault For Performance Questions

An exclude filter removes matching paths from replication, so those secrets are never synchronised to the secondary cluster. The path remains local to the primary, satisfying the requirement to keep specified data off the secondary.

Performance Replication streams write operations from the primary to the secondary. High network latency and a high volume of writes can cause the replication stream to fall behind, resulting in lag. This is the most likely cause of the observed lag and stale reads.

Performance Replication secondaries maintain a local replica of the data and can serve read requests even if the primary is down. However, writes cannot be processed because the secondary does not have the authority to accept writes unless it is promoted to primary. This behavior ensures read availability during a primary outage.

Batch tokens are non-renewable by design, so any renewal attempt fails immediately. This satisfies the stem's constraint directly: the token type itself prohibits the renew operation, unlike service tokens which support renewal via `auth/token/renew`. The failure is inherent to the batch token's encrypted, stateless structure, not a policy restriction.

When a client sends a write to a performance standby, the standby forwards the request to the active node. The active node commits the change to the Raft log, and the change is then replicated back to the standbys. This preserves consistency while allowing reads to be served locally. The statement accurately describes the write forwarding behavior of performance standbys.

Batch tokens are not written to Vault's storage backend; they exist only as self-contained encrypted blobs, so there is no accessor record to revoke. This statelessness is precisely what delivers their performance benefit, and it is the reason individual revocation is impossible.

In a five-node Raft cluster, quorum is achieved when a majority of nodes are active and healthy. The formula floor(n/2)+1 gives floor(5/2)+1 = 3. Therefore, at least three nodes must be operational to maintain quorum, elect a leader, and allow write operations. This ensures fault tolerance of up to two node failures.

Network latency and bandwidth between the primary and Performance Secondary directly govern replication throughput, since the secondary must receive and apply updates from the primary. Slow links delay write propagation and increase staleness, making link speed a genuine performance constraint for the secondary cluster.

Setting `performance_standby = true` in the configuration file on standby nodes enables Performance Standby mode. These nodes can then serve read requests from the active node's data, scaling read performance while maintaining high availability. This is the correct way to enable performance standbys in Vault Enterprise.

Replication path filters let you exclude specific mount paths from being replicated to a Performance Secondary, directly reducing its storage footprint. This satisfies the fine-grained control requirement by allowing selective synchronisation rather than replicating all data.

Integrated Storage (Raft) scales write throughput by adding voting nodes, which increases the quorum's ability to commit log entries in parallel across more followers. Additionally, the active node must have adequate CPU and disk IOPS because it serializes writes and appends to the Raft log. This is the correct way to scale writes without changing clients.

Mounts flagged as local are deliberately excluded from Performance Replication, so they never propagate to secondary clusters. Checking that flag directly explains why this specific secret engine is absent at the secondary site, satisfying the stem's constraint that only one mount fails to replicate while others succeed.

In Raft, the leader sends periodic heartbeats to followers to maintain leadership. If the leader is resource-starved (e.g., high CPU or memory pressure), it may fail to send heartbeats on time, causing followers to initiate elections and potentially elect a new leader. This leads to frequent leader changes and service disruption.

Batch tokens are not persisted to storage; they are generated with an embedded encrypted blob that contains the token's metadata. This eliminates the storage write that a Service token requires, significantly reducing latency and improving throughput for token creation and use. This is the primary performance advantage of Batch tokens.

Increasing max_idle_connections allows the database secrets engine to keep more idle connections in the pool, reducing the need to open new connections when demand spikes. This lowers connection churn and improves performance, as the pool can reuse existing connections. The maximum open connections remains the same, so the total number of connections is still bounded.

A Performance Secondary maintains a replicated copy of data and can serve read requests locally. Write requests are not accepted because the secondary is not the primary and does not have an active write path. If the primary is offline, writes fail until an operator promotes the secondary. This behavior is by design to prevent split-brain. The statement accurately describes the read-only nature of a performance secondary during a primary outage.

Performance Standby nodes serve read-only requests locally, forwarding writes to the active node. This read scaling is their defining function, so the Performance Standby node receives and responds to read requests, satisfying the stem's scenario directly.

Performance Standby nodes serve read-only requests within one Vault cluster, offloading reads from the active node and thereby satisfying the stem's read-scaling requirement. This is distinct from Performance Replication, which spans multiple clusters across regions. The scaling here stays intra-cluster, so no cross-cluster replication topology is involved.

The activation token is required to authenticate the secondary to the primary. It is generated on the primary cluster and then used on the secondary when enabling replication. This token contains the necessary details for the secondary to establish a connection and start receiving data. Without it, the secondary cannot be activated.

Performance Replication enables secondaries to serve read requests locally, satisfying the stem's demand for a benefit over DR Replication. DR Replication secondaries remain on standby and cannot handle reads, whereas Performance Replication secondaries actively serve reads, distributing load and reducing latency for geographically dispersed clients.

Path filters let you exclude high-churn paths from replication, directly cutting the volume of write-ahead log entries shipped to secondaries. Less replicated data means the secondary applies the log faster, reducing measured replication lag at the primary.

Performance Secondary clusters maintain their own Integrated Storage and serve reads locally. If the underlying storage is undersized or has high latency, read operations will be slow even with low replication lag. This is a common oversight when scaling reads: the secondary's local storage performance directly affects read latency.