VA-003 Explain Vault architecture Practice Question
A Vault cluster uses DR replication. The primary cluster fails, and the DR secondary is promoted to primary. After promotion, some secret data written to the primary shortly before the failure is missing on the new primary. What is the most likely reason?
⚠ Common exam trap
HashiCorp often tests the misconception that DR replication is synchronous or that the 'force' promotion option can recover missing writes, when in fact asynchronous replication inherently risks data loss of the most recent writes that have not yet been replicated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The data had not yet been replicated to the DR secondary before the primary failed.
In Vault DR replication, data is asynchronously replicated from the primary to the secondary cluster. If the primary fails before the replication stream has transmitted the most recent writes, those writes are lost. When the DR secondary is promoted to primary, it only contains data that was successfully replicated up to the point of failure. This is the most likely reason the secret data is missing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The data had not yet been replicated to the DR secondary before the primary failed.
Why this is correct
Asynchronous replication means some writes may be lost.
- ✗
The seal wrapping key was rotated on the primary after the last replication.
Why it's wrong here
Key rotation does not affect data replication.
- ✗
The secret engine was not enabled on the DR secondary.
Why it's wrong here
DR replicates the entire state.
- ✗
The DR secondary was promoted with the 'force' option, which skips replication of the last writes.
Why it's wrong here
Force promotion stops replication but does not skip writes.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.