CCNA Explain Vault architecture Questions — Page 2 of 2

MCQeasy

A security engineer wants to ensure that all requests to Vault are logged for compliance. Which component must be configured?

A.Secrets Engine

B.Storage Backend

C.Audit Device

D.Auth Method

AnswerC

Logs all requests to Vault.

Why this answer

An audit device is the Vault component responsible for logging all requests and responses to a specified destination (e.g., syslog, file, socket). It must be enabled and configured to meet compliance requirements for recording every interaction with Vault. Without an audit device, Vault does not generate any persistent logs of API calls.

Exam trap

HashiCorp often tests the distinction between components that perform actions (secrets engines, auth methods) versus components that record actions (audit devices), leading candidates to confuse a functional component with a logging component.

How to eliminate wrong answers

Option A is wrong because a secrets engine (e.g., KV, AWS, database) manages the lifecycle of secrets but does not log requests; it is a target for operations, not a logging mechanism. Option B is wrong because a storage backend (e.g., Consul, Raft, file) persists Vault's encrypted data and configuration but does not capture request/response audit trails. Option D is wrong because an auth method (e.g., token, LDAP, OIDC) authenticates users or machines but does not produce compliance logs of subsequent Vault operations.

Practice this question →

Multi-Selectmedium

Which THREE are required for Vault to encrypt data at rest? (Choose three.)

Select 3 answers

A.Audit device

B.Barrier encryption key

C.Storage backend

D.Seal mechanism

E.Authentication method

AnswersB, C, D

The key used to encrypt and decrypt data stored in the backend.

Why this answer

The barrier encryption key is the master key used to encrypt and decrypt the Vault data encryption key (DEK), which in turn encrypts all data written to the storage backend. Without this key, Vault cannot protect data at rest because the DEK would be stored in plaintext. It is a fundamental component of Vault's security architecture, ensuring that even if the storage backend is compromised, the data remains encrypted.

Exam trap

HashiCorp often tests the misconception that authentication methods or audit devices are involved in data encryption at rest, when in fact they serve orthogonal purposes (identity verification and logging, respectively) and are not part of the encryption pipeline.

Practice this question →

Multi-Selecteasy

A DevOps team is setting up a Vault cluster for the first time. They plan to use AWS KMS for auto-unseal and Consul as the storage backend. As part of the architecture, which TWO components are essential for the Vault server to start and serve requests?

Select 2 answers

A.A public CA certificate

B.A storage backend

C.A configured seal mechanism

D.A 4096-bit encryption key

E.A load balancer

AnswersB, C

Vault requires a storage backend to persist secrets and configuration; Consul serves this purpose.

Why this answer

B is correct because Vault requires a storage backend to persist data such as secrets, policies, and tokens. Without a configured storage backend (e.g., Consul), the Vault server cannot initialize or serve requests, as it has no place to store or retrieve state. The storage backend is the foundation for all Vault operations, including high-availability coordination.

Exam trap

A common misconception is that the seal mechanism alone is sufficient for Vault to start, but the storage backend is equally essential because it holds the encrypted master key and all persistent data.

Practice this question →

MCQmedium

A Vault administrator notices that the audit log file on the Vault server is filling up the disk. What is the best course of action to prevent disk full issues?

A.Disable audit logging to reduce disk usage.

B.Switch to a syslog audit device.

C.Increase the disk size of the Vault server.

D.Configure the file audit device with log rotation.

AnswerD

Rotation manages disk space effectively.

Why this answer

Configuring log rotation on the file audit device allows the Vault server to automatically archive or delete old audit logs based on size or time thresholds, preventing the disk from filling up while retaining necessary audit data. This is the recommended approach in Vault for managing disk space without disabling security auditing or relying on external infrastructure changes.

Exam trap

HashiCorp often tests the misconception that disabling or redirecting audit logs is an acceptable solution for disk management, when in fact the correct approach is to manage log growth through rotation while maintaining audit functionality.

How to eliminate wrong answers

Option A is wrong because disabling audit logging removes the ability to track and monitor all API requests and operations, which is a critical security requirement for compliance and forensic analysis. Option B is wrong because switching to a syslog audit device does not inherently prevent disk full issues; it simply redirects logs to an external syslog server, which could still fill up its own disk or cause log loss if the syslog server is unavailable. Option C is wrong because increasing disk size is a temporary, reactive fix that does not address the root cause of unbounded log growth and may not be feasible in all environments.

Practice this question →

Multi-Selecthard

Which three characteristics are true about Vault's storage backend and seal mechanisms? (Choose three.)

Select 3 answers

A.Auto-unseal using a cloud KMS eliminates the need for unseal keys entirely.

B.Consul as a storage backend requires Consul's own gossip protocol for leader election.

C.The Shamir seal requires multiple unseal keys to be entered before Vault can operate.

D.HSM seals can be used to auto-unseal Vault while also providing a hardware root of trust.

E.Integrated Storage uses Raft consensus and can be used in production for both HA and DR.

AnswersC, D, E

Shamir splits the master key into shards.

Why this answer

The Shamir seal splits the master key into multiple key shares, requiring a threshold number of these shares to be entered during the unseal process before Vault can decrypt its data encryption key and become operational. This ensures that no single individual can unseal Vault, providing a distributed trust model.

Exam trap

HashiCorp often tests the misconception that auto-unseal eliminates unseal keys entirely, when in fact it only automates the unseal process while still relying on an encrypted master key stored in the storage backend.

Practice this question →