VA-003 Explain Vault architecture Practice Question
A Vault cluster uses DR replication. The primary cluster fails, and the DR secondary is promoted to primary. After promotion, some secret data written to the primary shortly before the failure is missing on the new primary. What is the most likely reason?
⚠ Common exam trap
HashiCorp often tests the misconception that DR replication is synchronous or that the 'force' promotion option can recover missing writes, when in fact asynchronous replication inherently risks data loss of the most recent writes that have not yet been replicated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The data had not yet been replicated to the DR secondary before the primary failed.
In Vault DR replication, data is asynchronously replicated from the primary to the secondary cluster. If the primary fails before the replication stream has transmitted the most recent writes, those writes are lost. When the DR secondary is promoted to primary, it only contains data that was successfully replicated up to the point of failure. This is the most likely reason the secret data is missing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The data had not yet been replicated to the DR secondary before the primary failed.
Why this is correct
Disaster Recovery Replication is asynchronous, so writes acknowledged by the primary may not have reached the DR secondary before the failure. Promotion exposes that gap, explaining the missing secret data without any corruption or misconfiguration.
- ✗
The seal wrapping key was rotated on the primary after the last replication.
Why it's wrong here
Seal wrapping key rotation is a local operation and does not cause loss of replicated secret data. It tempts because key rotation sounds like it could disrupt replication, but the actual cause is asynchronous replication lag, where writes not yet shipped are lost on failover.
- ✗
The secret engine was not enabled on the DR secondary.
Why it's wrong here
Secret engines are replicated to DR secondaries as part of the mount configuration, so an engine not being enabled there is not the cause. It tempts because mount mismatches can break replication, but DR replication copies mounts automatically; the real cause is replication lag.
- ✗
The DR secondary was promoted with the 'force' option, which skips replication of the last writes.
Why it's wrong here
The 'force' promotion option bypasses the safety check on replication state; it does not skip transmitting the last writes. It tempts because forcing promotion sounds like it discards data, but the missing secrets stem from asynchronous replication lag before the failure.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.