22 questions · Vault Server Configuration topic · All types, answers revealed
Which THREE actions are permitted by the 'vault operator' command group?
Standard operator task.
Why this answer
The 'vault operator' group handles core cluster management tasks like unsealing, rekeying, and Raft cluster maintenance.
You are deploying a hardened production Vault cluster. Which setting in the 'listener' stanza is recommended to prevent cleartext communication?
Setting this to false ensures the listener requires TLS.
Why this answer
The 'tls_disable' parameter must be set to 'false' to enforce encrypted communication, which is a production hardening requirement.
You are migrating from a file-based storage backend to Integrated Storage. What must you do before joining the new node to the cluster?
This is the required command to add a node to the Raft cluster.
Why this answer
You must ensure the storage stanza is correctly configured for 'raft' and the node has a unique 'node_id' to participate.
When an audit log is configured, what happens if the audit device cannot write to its destination (e.g., disk is full)?
Vault halts to maintain audit integrity.
Why this answer
By default, if Vault cannot write to the audit device, it will stop processing requests to ensure no un-audited operations occur.
Which TWO settings are considered best practices for hardening a Vault production listener?
Enforces modern, secure TLS versions.
Why this answer
For production, you must enable TLS and restrict the listener address to secure interfaces, avoiding 0.0.0.0 if possible.
A Vault performance standby node receives a request. What happens if the request is a write operation?
Performance standby nodes proxy write requests to the leader.
Why this answer
Performance standby nodes forward write operations to the active node because only the active node can write to the storage backend.
When running Vault on a cloud provider, what is the best practice for storing the Vault configuration file?
This keeps sensitive configuration parameters secure.
Why this answer
Configuration files should not contain secrets. Using environment variables or a configuration management system to inject values at runtime is the preferred secure approach.
You need to rotate the Vault master key (rekey). Which command should be used if you want to change the key configuration (e.g., number of shares) while performing the rekey?
This initializes the rekey process allowing for new threshold/shares.
Why this answer
The 'vault operator rekey -init' command is used to start the process of changing the master key configuration.
Which THREE components are necessary to secure Vault communications?
Essential for encrypted transport.
Why this answer
Secure communication relies on TLS certificates, private keys, and properly configured CA chains to establish trust between clients and the server.
How do you properly revoke a root token after it has been used to perform initialization tasks?
This command invalidates the token in the backend.
Why this answer
Once a root token has served its purpose, it should be revoked using 'vault token revoke -self' or by an administrator to adhere to the principle of least privilege.
When initializing a Vault server, you choose to store the recovery keys. What is the main security advantage of using recovery keys alongside Auto-Unseal?
Recovery keys are used for critical administrative tasks like root token generation.
Why this answer
Recovery keys allow for performing sensitive operations like root token generation and unseal key migration if the Auto-Unseal mechanism becomes unavailable.
Which command is used to check the health status of a Vault node?
This is the standard command for checking node status.
Why this answer
The 'vault status' command provides the current health, seal status, and active/standby role of the node.
What is the consequence of setting 'cluster_name' in the Vault HCL configuration?
This provides clear identification for audit tracking.
Why this answer
The 'cluster_name' field is used to identify the cluster, which is particularly useful for performance replication and audit logs to distinguish between multiple clusters.
Which THREE factors influence the choice of a 'secret engine' configuration?
Determines the namespace/location.
Why this answer
Secret engine configuration depends on the type of data (KV, Dynamic), the required lease TTL, and the access control policies applied to the path.
Which TWO features are part of the 'Vault Enterprise' offering and directly relate to server configuration?
Enterprise-only replication feature.
Why this answer
Performance replication and HSM support are key enterprise features that require specific configuration blocks in the Vault HCL file.
Which THREE items must be configured to enable Auto-Unseal using a cloud provider KMS?
Required to identify the master key.
Why this answer
Auto-unseal requires a cloud-specific configuration block, appropriate IAM permissions for the Vault instance, and a valid key ID/ARN.
What is the purpose of the 'cluster_addr' in the Vault server configuration?
It defines the address used for internal cluster traffic.
Why this answer
The 'cluster_addr' is used for communication between nodes in a Vault cluster (e.g., for Raft replication).
You are configuring a production Vault cluster using Integrated Storage. What is the most critical configuration parameter that must be set in the 'storage' stanza to ensure the node can correctly identify and join the existing Raft cluster during a bootstrap operation?
The node_id provides a unique identifier for the node within the Raft configuration.
Why this answer
The 'node_id' is required for every node in a Raft cluster to uniquely identify itself to other peers in the integrated storage configuration.
What is the primary function of the 'ui = true' configuration setting?
This enables the built-in Vault UI.
Why this answer
Setting 'ui = true' enables the Vault Web UI, allowing users to interact with Vault via a browser.
When configuring an audit device, which configuration parameter is essential for high-availability auditing?
Vault supports multiple audit devices to ensure logging reliability.
Why this answer
For high-availability, you should configure multiple audit devices. If one fails, Vault stops processing requests if 'log_raw' is not configured correctly or if the audit device is not robust.
A Vault cluster is configured with Auto-Unseal using AWS KMS. The underlying KMS key is rotated. What action is required to ensure Vault continues to operate without interruption?
Vault uses the KMS key ID to request decryption; key rotation happens transparently if the policy permits.
Why this answer
Vault's Auto-Unseal configuration automatically handles the KMS key rotation if the IAM policy allows the 'decrypt' action on the new key version.
Which TWO items are required to successfully join a new node to an existing Integrated Storage cluster?
Needed to establish initial contact.
Why this answer
To join a Raft cluster, the new node needs the 'leader_api_addr' of the existing cluster and an authentication token to authorize the join.
Ready to test yourself?
Try a timed practice session using only Vault Server Configuration questions.