Explain Vault architecture →mediumMultiple ChoiceObjective-mapped

VA-003 Explain Vault architecture Practice Question

Exhibit

Refer to the exhibit.
```hcl
seal "gcpckms" {
  project    = "my-project"
  region     = "global"
  key_ring   = "vault-keyring"
  crypto_key = "vault-key"
}
storage "raft" {
  path = "/opt/vault/data"
  node_id = "node1"
}
listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = true
}
```

A Vault server is configured with the above snippet. After starting, the server remains in a sealed state. Which command should the operator run to complete the initial unseal?

⚠ Common exam trap

Test-takers frequently confuse the initialization step with the unseal step, assuming a Vault server can be unsealed without first generating the unseal keys via `vault operator init`.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

vault operator init

The snippet shows a Vault configuration but no `seal` or `unseal` keys have been generated yet. The `vault operator init` command generates the initial root token and unseal keys, which are required before any unseal operation can be performed. Without initialization, the server has no keys to unseal with, so it remains in a sealed state.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
vault operator unseal -auto
Why it's wrong here
There is no -auto flag; auto-unseal works automatically after initialization.
✗
vault operator unseal <key>
Why it's wrong here
Auto-unseal does not require manual unseal keys; initialization is needed first.
✗
vault operator generate-root
Why it's wrong here
generate-root is for generating a new root token, not for initial unseal.
✓
vault operator init
Why this is correct
Initialization generates the root token and sets up the seal; unseal happens automatically via GCP KMS.

Go deeper

VA-003 Explain Vault architecture Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question