VA-003 Explain Vault architecture Practice Question
A company is deploying Vault in a Kubernetes environment. Which three components are essential for a production-ready Vault on Kubernetes? (Choose three.)
⚠ Common exam trap
HashiCorp often tests the misconception that unseal keys can be stored in a ConfigMap for convenience, but the exam expects you to recognize that this violates Vault's security model and is never production-ready.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A persistent volume claim for each Vault pod for storage.
Vault requires durable storage for its encrypted data (the storage backend). In Kubernetes, a PersistentVolumeClaim (PVC) provides this durable block or file storage that survives pod restarts. Without a PVC, Vault would lose its data when the pod is rescheduled, making it unsuitable for production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A ConfigMap to store Vault configuration including unseal keys.
Why it's wrong here
Unseal keys should never be in ConfigMap.
- ✓
A persistent volume claim for each Vault pod for storage.
Why this is correct
Persistent storage is essential for Raft.
- ✓
A service account with appropriate RBAC to interact with the Kubernetes API.
Why this is correct
Required for Kubernetes auth method.
- ✗
An Ingress controller to expose Vault externally.
Why it's wrong here
Ingress is not essential; LoadBalancer works.
- ✓
A StatefulSet to manage Vault pods with stable network identities.
Why this is correct
StatefulSet ensures stable identities.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.