Scenario practice questions

Which THREE of the following are true regarding Vault's high availability (HA) and replication? (Choose three.)

Trap 1: With Integrated Storage, all nodes can handle write requests

Only the leader (active node) handles writes; followers forward.

Trap 2: Disaster Recovery Replication replicates everything including…

DR Replication replicates secrets, config, and policies, but audit logs are not replicated.

A
With Integrated Storage, all nodes can handle write requests
Why wrong: Only the leader (active node) handles writes; followers forward.
B
In an HA cluster with Integrated Storage, only the active node can serve write requests
Standby nodes forward writes to the active node; only the active node handles writes.
C
Performance standby nodes can serve read requests without forwarding
Performance standby nodes handle reads locally, reducing load on the active node.
D
Performance Replication replicates mounts and auth methods but not policies
Policies are not replicated in Performance Replication; they must be manually configured on each cluster.
E
Disaster Recovery Replication replicates everything including policies and audit logs
Why wrong: DR Replication replicates secrets, config, and policies, but audit logs are not replicated.

Question 2mediummultiple choice

A CI/CD pipeline needs to generate thousands of short-lived tokens each day for jobs that run for at most 5 minutes. The tokens should not be renewable or revocable individually. Which token type should be used?

Trap 1: Orphan tokens

Orphan is a token property, not a distinct type.

Trap 2: Service tokens

Service tokens are renewable and revocable, which is unnecessary and adds management overhead.

Trap 3: Periodic tokens

Periodic tokens have a long lifetime and would not fit short-lived needs.

A
Orphan tokens
Why wrong: Orphan is a token property, not a distinct type.
B
Service tokens
Why wrong: Service tokens are renewable and revocable, which is unnecessary and adds management overhead.
C
Batch tokens
Batch tokens are non-renewable, non-revocable, and ideal for high-volume short-lived tokens.
D
Periodic tokens
Why wrong: Periodic tokens have a long lifetime and would not fit short-lived needs.

Question 3hardmulti select

Which TWO of the following scenarios require the use of a periodic token?

Trap 1: A token that never expires and has a TTL of 0.

Periodic tokens have no TTL, but they are not the only way to have a token with TTL 0; non-periodic tokens can have TTL 0 but will be revoked immediately.

Trap 2: A human operator who needs a token that can be used for multiple…

Human operators typically use tokens with TTLs and renewals, not periodic tokens.

Trap 3: A token that should not be revoked when the token that created it…

Orphan tokens achieve this without needing to be periodic.

A
A token that never expires and has a TTL of 0.
Why wrong: Periodic tokens have no TTL, but they are not the only way to have a token with TTL 0; non-periodic tokens can have TTL 0 but will be revoked immediately.
B
A human operator who needs a token that can be used for multiple sessions.
Why wrong: Human operators typically use tokens with TTLs and renewals, not periodic tokens.
C
A batch job that must continue running even if the parent token is revoked.
Periodic tokens are not children of a parent token; they are created by sudo users and are independent.
D
A token that should not be revoked when the token that created it is revoked.
Why wrong: Orphan tokens achieve this without needing to be periodic.
E
A long-running application that needs a token that can be renewed indefinitely.
Periodic tokens can be renewed indefinitely as long as max_ttl is not set or is long enough.

Question 4mediummultiple choice

A Vault administrator is configuring Consul as the storage backend. The Consul cluster will span three data centers with low latency links. Which Consul deployment is recommended for Vault to ensure data safety?

Trap 1: 3 Consul servers across 3 datacenters (1 per DC)

Cross-datacenter latency can cause write delays and potential consistency issues.

Trap 2: 3 Consul servers in each datacenter (total 9)

Multiple datacenters add complexity and latency without benefit for Vault storage.

Trap 3: 3 Consul servers in one datacenter with agents in others

Agents do not participate in the Raft consensus, so server count and placement are critical.

A
3 Consul servers across 3 datacenters (1 per DC)
Why wrong: Cross-datacenter latency can cause write delays and potential consistency issues.
B
3 Consul servers in each datacenter (total 9)
Why wrong: Multiple datacenters add complexity and latency without benefit for Vault storage.
C
3 Consul servers in one datacenter with agents in others
Why wrong: Agents do not participate in the Raft consensus, so server count and placement are critical.
D
5 Consul servers in a single datacenter
A single datacenter setup provides strong consistency and low latency for Vault writes.

Question 5easymultiple choice

A developer wants to authenticate to Vault using a username and password without any external identity provider. Which authentication method should be enabled?

Trap 1: Token authentication

Token authentication uses pre-generated tokens, not username/password.

Trap 2: LDAP authentication

LDAP requires an external LDAP directory service.

Trap 3: AppRole authentication

AppRole uses role ID and secret ID, not username/password.

A
Userpass authentication
Userpass allows local username/password authentication.
B
Token authentication
Why wrong: Token authentication uses pre-generated tokens, not username/password.
C
LDAP authentication
Why wrong: LDAP requires an external LDAP directory service.
D
AppRole authentication
Why wrong: AppRole uses role ID and secret ID, not username/password.

Question 6hardmultiple choice

During a security assessment, a penetration tester discovers that Vault's seal configuration uses a single master key stored in a file on the server. The attacker gains root access to the server and retrieves the unseal key. What is the best mitigation to prevent this scenario?

Trap 1: Restrict network access to the Vault server with a firewall

Firewall does not prevent compromise of the server itself.

Trap 2: Use Shamir's secret sharing to split the key across multiple files

If all files are on the same server, the attacker can access all shares.

Trap 3: Encrypt the unseal key file with a strong password

The attacker can retrieve the encryption key from memory or configuration.

A
Restrict network access to the Vault server with a firewall
Why wrong: Firewall does not prevent compromise of the server itself.
B
Use a cloud auto-unseal mechanism such as AWS KMS
Auto-unseal with KMS stores the master key in KMS, not on the server, requiring additional cloud credentials to retrieve.
C
Use Shamir's secret sharing to split the key across multiple files
Why wrong: If all files are on the same server, the attacker can access all shares.
D
Encrypt the unseal key file with a strong password
Why wrong: The attacker can retrieve the encryption key from memory or configuration.

Question 7easymultiple choice

In a Vault HA cluster, which node is responsible for handling all write requests?

Trap 1: All nodes

Only the active node handles writes; standby nodes serve reads and forward writes.

Trap 2: Standby nodes

Standby nodes are read-only and forward write requests to the active node.

Trap 3: The node that receives the request

The receiving node must forward the write to the active node if it is not the active node itself.

A
All nodes
Why wrong: Only the active node handles writes; standby nodes serve reads and forward writes.
B
The active node only
The active node is the only node that can accept and process write requests.
C
Standby nodes
Why wrong: Standby nodes are read-only and forward write requests to the active node.
D
The node that receives the request
Why wrong: The receiving node must forward the write to the active node if it is not the active node itself.

Question 8mediummultiple choice

A company is using Vault Transit to encrypt files before uploading them to an S3 bucket. They notice that for a given plaintext file, the ciphertext output is always identical, even when encrypting at different times. They are using the `encrypt` endpoint with the default AES-GCM algorithm. The team is concerned about security because the repeated ciphertext leaks information (e.g., file equality). What is the most likely cause of this behavior?

Trap 1: They are using the wrong key

Using the wrong key would result in different (invalid) ciphertexts, not consistent ones.

Trap 2: They are using a deterministic encryption scheme

While this is true, convergent encryption is the specific feature in Vault that causes this; option B is more precise.

Trap 3: They are not providing an encryption context

Missing context does not make encryption deterministic; Vault still generates a random nonce.

A
They are using the wrong key
Why wrong: Using the wrong key would result in different (invalid) ciphertexts, not consistent ones.
B
They are using a deterministic encryption scheme
Why wrong: While this is true, convergent encryption is the specific feature in Vault that causes this; option B is more precise.
C
They are using convergent encryption
Convergent encryption derives the key from the plaintext, resulting in identical ciphertexts for identical plaintexts.
D
They are not providing an encryption context
Why wrong: Missing context does not make encryption deterministic; Vault still generates a random nonce.

Question 9hardmultiple choice

A company requires that Vault data be continuously replicated from a primary data center to a secondary data center for disaster recovery. The secondary data center must be able to become writable in the event of a primary failure. Which Vault feature should they use?

Trap 1: Performance Replication

Performance Replication is for read scaling, not disaster recovery failover.

Trap 2: Consul as storage backend

Consul provides storage and HA coordination, but not cross-cluster replication capabilities.

Trap 3: Performance Standby

Performance Standby nodes are part of a single cluster and do not replicate data across clusters.

A
Performance Replication
Why wrong: Performance Replication is for read scaling, not disaster recovery failover.
B
Consul as storage backend
Why wrong: Consul provides storage and HA coordination, but not cross-cluster replication capabilities.
C
Performance Standby
Why wrong: Performance Standby nodes are part of a single cluster and do not replicate data across clusters.
D
Disaster Recovery Replication
DR replication mirrors all data and allows promotion of the secondary cluster to primary for failover.

Read the full NAT/PAT explanation →

Question 10easymultiple choice

A DevOps team uses Vault to manage secrets for a microservices application. The application authenticates to Vault using AppRole, and each service obtains a periodic token with a TTL of 24 hours and a period of 1 hour. The tokens are used to read secrets from a path. Recently, the team noticed that some services are unable to read secrets after a few hours, with error messages indicating that the token is not authorized or has expired. Upon investigation, the team finds that the tokens are being renewed properly but still fail after some time. What is the most likely cause of this issue?

Trap 1: The Vault server's maximum number of tokens per client has been…

Incorrect: Error messages indicate token not authorized or expired, not a rate limit or quota issue.

Trap 2: The tokens are not being renewed correctly due to a bug in the…

Incorrect: The team observed that tokens are being renewed properly, but still fail, indicating a different issue.

Trap 3: The AppRole secret ID is being revoked, causing tokens to become…

Incorrect: Revoking the secret ID affects authentication, but already issued tokens are not directly affected; the error is about token expiration, not authentication.

A
The Vault server's maximum number of tokens per client has been exceeded.
Why wrong: Incorrect: Error messages indicate token not authorized or expired, not a rate limit or quota issue.
B
The tokens are not being renewed correctly due to a bug in the renewal logic.
Why wrong: Incorrect: The team observed that tokens are being renewed properly, but still fail, indicating a different issue.
C
The tokens have a shorter max TTL than the period, causing them to expire before they can be renewed.
Correct: Periodic tokens have a max TTL that caps total lifetime; if max TTL is less than the period, the token will expire and cannot be renewed.
D
The AppRole secret ID is being revoked, causing tokens to become invalid.
Why wrong: Incorrect: Revoking the secret ID affects authentication, but already issued tokens are not directly affected; the error is about token expiration, not authentication.