VA-003 Explain Vault architecture Practice Question
An organization uses Vault with a Consul storage backend. They have three Vault servers and three Consul servers. During a routine maintenance, they restart all Consul servers simultaneously. After the restart, Vault becomes sealed and cannot be unsealed. The Vault logs show 'storage: error listing' and 'failed to check status'. The Consul cluster is healthy with a leader. What is the most likely cause and solution?
⚠ Common exam trap
HashiCorp often tests the misconception that a healthy Consul cluster with a leader guarantees Vault's storage integrity, but the trap here is that Vault's storage backend can suffer from data corruption or missing keys even when Consul's cluster health appears normal, leading candidates to incorrectly attempt re-unsealing or token generation instead of restoring from backup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore Vault's storage backend from a recent backup
When all Consul servers are restarted simultaneously, the Vault storage backend (Consul) may lose critical metadata or consistency state that Vault relies on to maintain its seal/unseal status. Even though the Consul cluster appears healthy with a leader, the underlying data corruption or loss of key-value entries (such as the barrier key or storage index) prevents Vault from reading its storage, causing it to seal and fail to unseal. Restoring Vault's storage backend from a recent backup is the correct solution because it recovers the consistent state of the data, including the encrypted master key and configuration, without requiring re-initialization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Re-initialize Vault and generate new unseal keys
Why it's wrong here
Would lose all secrets.
- ✓
Restore Vault's storage backend from a recent backup
Why this is correct
Restores the encrypted data and master key.
- ✗
Generate a new root token using unseal keys
Why it's wrong here
Root token generation requires Vault to be unsealed.
- ✗
Use the unseal keys to unseal Vault again
Why it's wrong here
Unseal keys cannot unseal if storage is corrupted or empty.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.