Scenario practice questions

A large e-commerce company uses Vault to manage database credentials for microservices. They have a Vault cluster of 5 nodes using Integrated Storage (Raft). To increase capacity, they add a sixth node to the cluster. Shortly after, they notice intermittent 'no leader' errors in the Vault logs, and some clients experience failures when reading secrets. The cluster was functioning correctly before the addition. What is the most likely cause and the recommended action?

Trap 1: The cluster's Raft protocol requires all nodes to be voters, but…

New nodes are voters by default. Even if the new node were a non-voter, the existing 5 voters would still have an odd number; the problem is even-numbered voters.

Trap 2: The new node has a different storage performance, causing it to lag…

While performance can cause issues, the sudden 'no leader' errors after adding a node are more characteristic of even-number quorum problems than a slow node.

Trap 3: The new node was not properly joined to the cluster and is running…

If the node were standalone, it wouldn't affect the existing cluster's leader election. The entire cluster is experiencing 'no leader' errors.

A
The cluster now has an even number of nodes, which can cause split-brain scenarios and leader election issues. Recommended action: remove the new node to revert to 5 nodes, or add a seventh node to make it odd.
Raft performs best with an odd number of nodes to avoid split-brain. With 6 nodes, quorum is 4, and a partition could lead to no leader.
B
The cluster's Raft protocol requires all nodes to be voters, but the new node is a non-voter. Recommended action: promote the new node to voter.
Why wrong: New nodes are voters by default. Even if the new node were a non-voter, the existing 5 voters would still have an odd number; the problem is even-numbered voters.
C
The new node has a different storage performance, causing it to lag behind and not participate in consensus. Recommended action: replace the new node with a faster instance.
Why wrong: While performance can cause issues, the sudden 'no leader' errors after adding a node are more characteristic of even-number quorum problems than a slow node.
D
The new node was not properly joined to the cluster and is running as a standalone server. Recommended action: re-run the join command and ensure the node is part of the cluster.
Why wrong: If the node were standalone, it wouldn't affect the existing cluster's leader election. The entire cluster is experiencing 'no leader' errors.

Question 2easymultiple choice

A developer wants to authenticate to Vault using a username and password without any external identity provider. Which authentication method should be enabled?

Trap 1: Token authentication

Token authentication uses pre-generated tokens, not username/password.

Trap 2: LDAP authentication

LDAP requires an external LDAP directory service.

Trap 3: AppRole authentication

AppRole uses role ID and secret ID, not username/password.

A
Userpass authentication
Userpass allows local username/password authentication.
B
Token authentication
Why wrong: Token authentication uses pre-generated tokens, not username/password.
C
LDAP authentication
Why wrong: LDAP requires an external LDAP directory service.
D
AppRole authentication
Why wrong: AppRole uses role ID and secret ID, not username/password.

Question 3easymultiple choice

In a Vault HA cluster, which node is responsible for handling all write requests?

Trap 1: All nodes

Only the active node handles writes; standby nodes serve reads and forward writes.

Trap 2: Standby nodes

Standby nodes are read-only and forward write requests to the active node.

Trap 3: The node that receives the request

The receiving node must forward the write to the active node if it is not the active node itself.

A
All nodes
Why wrong: Only the active node handles writes; standby nodes serve reads and forward writes.
B
The active node only
The active node is the only node that can accept and process write requests.
C
Standby nodes
Why wrong: Standby nodes are read-only and forward write requests to the active node.
D
The node that receives the request
Why wrong: The receiving node must forward the write to the active node if it is not the active node itself.

Question 4mediummultiple choice

A Vault administrator is configuring Consul as the storage backend. The Consul cluster will span three data centers with low latency links. Which Consul deployment is recommended for Vault to ensure data safety?

Trap 1: 3 Consul servers across 3 datacenters (1 per DC)

Cross-datacenter latency can cause write delays and potential consistency issues.

Trap 2: 3 Consul servers in each datacenter (total 9)

Multiple datacenters add complexity and latency without benefit for Vault storage.

Trap 3: 3 Consul servers in one datacenter with agents in others

Agents do not participate in the Raft consensus, so server count and placement are critical.

A
3 Consul servers across 3 datacenters (1 per DC)
Why wrong: Cross-datacenter latency can cause write delays and potential consistency issues.
B
3 Consul servers in each datacenter (total 9)
Why wrong: Multiple datacenters add complexity and latency without benefit for Vault storage.
C
3 Consul servers in one datacenter with agents in others
Why wrong: Agents do not participate in the Raft consensus, so server count and placement are critical.
D
5 Consul servers in a single datacenter
A single datacenter setup provides strong consistency and low latency for Vault writes.

Question 5hardmulti select

Which TWO of the following scenarios require the use of a periodic token?

Trap 1: A token that never expires and has a TTL of 0.

Periodic tokens have no TTL, but they are not the only way to have a token with TTL 0; non-periodic tokens can have TTL 0 but will be revoked immediately.

Trap 2: A human operator who needs a token that can be used for multiple…

Human operators typically use tokens with TTLs and renewals, not periodic tokens.

Trap 3: A token that should not be revoked when the token that created it…

Orphan tokens achieve this without needing to be periodic.

A
A token that never expires and has a TTL of 0.
Why wrong: Periodic tokens have no TTL, but they are not the only way to have a token with TTL 0; non-periodic tokens can have TTL 0 but will be revoked immediately.
B
A human operator who needs a token that can be used for multiple sessions.
Why wrong: Human operators typically use tokens with TTLs and renewals, not periodic tokens.
C
A batch job that must continue running even if the parent token is revoked.
Periodic tokens are not children of a parent token; they are created by sudo users and are independent.
D
A token that should not be revoked when the token that created it is revoked.
Why wrong: Orphan tokens achieve this without needing to be periodic.
E
A long-running application that needs a token that can be renewed indefinitely.
Periodic tokens can be renewed indefinitely as long as max_ttl is not set or is long enough.

Question 6hardmulti select

Which THREE of the following are true regarding Vault's high availability (HA) and replication? (Choose three.)

Trap 1: With Integrated Storage, all nodes can handle write requests

Only the leader (active node) handles writes; followers forward.

Trap 2: Disaster Recovery Replication replicates everything including…

DR Replication replicates secrets, config, and policies, but audit logs are not replicated.

A
With Integrated Storage, all nodes can handle write requests
Why wrong: Only the leader (active node) handles writes; followers forward.
B
In an HA cluster with Integrated Storage, only the active node can serve write requests
Standby nodes forward writes to the active node; only the active node handles writes.
C
Performance standby nodes can serve read requests without forwarding
Performance standby nodes handle reads locally, reducing load on the active node.
D
Performance Replication replicates mounts and auth methods but not policies
Policies are not replicated in Performance Replication; they must be manually configured on each cluster.
E
Disaster Recovery Replication replicates everything including policies and audit logs
Why wrong: DR Replication replicates secrets, config, and policies, but audit logs are not replicated.

Question 7hardmultiple choice

An application uses a periodic token with period=24h. The application renews every 12h. After 48h, the token is still valid. After 72h, the token is still valid. What is the maximum lifetime of this periodic token?

Trap 1: 72h

The token can last beyond 72h.

Trap 2: 48h

The token lasted 72h and can continue.

Trap 3: 24h

The token lasts longer than 24h due to renewal.

A
Unlimited (as long as it keeps renewing)
Periodic tokens have no max TTL and can be renewed indefinitely.
B
72h
Why wrong: The token can last beyond 72h.
C
48h
Why wrong: The token lasted 72h and can continue.
D
24h
Why wrong: The token lasts longer than 24h due to renewal.

Question 8mediummultiple choice

An application uses Vault's KV v2 secrets engine to read a static secret (e.g., API key) at path 'secret/data/myapp/config'. The application initially reads the secret and uses the returned lease_id to successfully renew the lease every hour. After a maintenance window, the application starts failing to renew the lease, receiving an error that the lease is not renewable or does not exist. The secret data is still present and accessible via a new read. What is the most likely cause of this failure?

Trap 1: The secret was deleted and recreated under the same path.

Incorrect. Deleting and recreating the secret would not cause a lease renewal failure unless the new secret has a different lease, but the old lease would still exist until it expires.

Trap 2: The KV v2 engine was disabled and re-enabled.

Incorrect. Disabling and re-enabling the engine would invalidate all leases, but the secret data would not be accessible at the same path until the engine is re-enabled and the secret recreated.

Trap 3: The lease expired during the maintenance window because the…

Incorrect. KVV2 static secret reads do not produce renewable leases, so the lease cannot expire due to non-renewal.

A
The token used to renew the lease has expired.
Correct. The token used to renew the lease has expired, causing the renewal to fail because authentication fails.
B
The secret was deleted and recreated under the same path.
Why wrong: Incorrect. Deleting and recreating the secret would not cause a lease renewal failure unless the new secret has a different lease, but the old lease would still exist until it expires.
C
The KV v2 engine was disabled and re-enabled.
Why wrong: Incorrect. Disabling and re-enabling the engine would invalidate all leases, but the secret data would not be accessible at the same path until the engine is re-enabled and the secret recreated.
D
The lease expired during the maintenance window because the application did not renew it on time.
Why wrong: Incorrect. KVV2 static secret reads do not produce renewable leases, so the lease cannot expire due to non-renewal.

Question 9hardmultiple choice

During a security assessment, a penetration tester discovers that Vault's seal configuration uses a single master key stored in a file on the server. The attacker gains root access to the server and retrieves the unseal key. What is the best mitigation to prevent this scenario?

Trap 1: Restrict network access to the Vault server with a firewall

Firewall does not prevent compromise of the server itself.

Trap 2: Use Shamir's secret sharing to split the key across multiple files

If all files are on the same server, the attacker can access all shares.

Trap 3: Encrypt the unseal key file with a strong password

The attacker can retrieve the encryption key from memory or configuration.

A
Restrict network access to the Vault server with a firewall
Why wrong: Firewall does not prevent compromise of the server itself.
B
Use a cloud auto-unseal mechanism such as AWS KMS
Auto-unseal with KMS stores the master key in KMS, not on the server, requiring additional cloud credentials to retrieve.
C
Use Shamir's secret sharing to split the key across multiple files
Why wrong: If all files are on the same server, the attacker can access all shares.
D
Encrypt the unseal key file with a strong password
Why wrong: The attacker can retrieve the encryption key from memory or configuration.

Question 10hardmultiple choice

A company requires that Vault data be continuously replicated from a primary data center to a secondary data center for disaster recovery. The secondary data center must be able to become writable in the event of a primary failure. Which Vault feature should they use?

Trap 1: Performance Replication

Performance Replication is for read scaling, not disaster recovery failover.

Trap 2: Consul as storage backend

Consul provides storage and HA coordination, but not cross-cluster replication capabilities.

Trap 3: Performance Standby

Performance Standby nodes are part of a single cluster and do not replicate data across clusters.

A
Performance Replication
Why wrong: Performance Replication is for read scaling, not disaster recovery failover.
B
Consul as storage backend
Why wrong: Consul provides storage and HA coordination, but not cross-cluster replication capabilities.
C
Performance Standby
Why wrong: Performance Standby nodes are part of a single cluster and do not replicate data across clusters.
D
Disaster Recovery Replication
DR replication mirrors all data and allows promotion of the secondary cluster to primary for failover.