VA-003 Explain Vault architecture Practice Question
A DevOps team is setting up a Vault cluster for the first time. They plan to use AWS KMS for auto-unseal and Consul as the storage backend. As part of the architecture, which TWO components are essential for the Vault server to start and serve requests?
⚠ Common exam trap
A common misconception is that the seal mechanism alone is sufficient for Vault to start, but the storage backend is equally essential because it holds the encrypted master key and all persistent data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A storage backend
B is correct because Vault requires a storage backend to persist data such as secrets, policies, and tokens. Without a configured storage backend (e.g., Consul), the Vault server cannot initialize or serve requests, as it has no place to store or retrieve state. The storage backend is the foundation for all Vault operations, including high-availability coordination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A public CA certificate
Why it's wrong here
TLS certificates are recommended for secure communication but not essential for Vault startup; Vault can run without TLS in development mode.
- ✓
A storage backend
Why this is correct
Vault requires a storage backend to persist secrets and configuration; Consul serves this purpose.
- ✓
A configured seal mechanism
Why this is correct
A seal is required to unseal Vault and protect the master key; without it, Vault cannot start in a secure state.
- ✗
A 4096-bit encryption key
Why it's wrong here
The encryption key is derived from the seal, not a separate component that must be explicitly configured.
- ✗
A load balancer
Why it's wrong here
A load balancer is recommended for high availability but not essential for the Vault server to start and serve requests.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.