Troubleshooting practice questions

Which TWO statements are true when troubleshooting a failed Vault CLI command?

Trap 1: Run 'vault write' to test if the token can write to a path.

Writing is not a troubleshooting step; reading or looking up is more diagnostic.

Trap 2: Run 'vault status' to check if the server is reachable.

While server connectivity is important, the command failure may be due to token issues rather than connectivity.

Trap 3: Run 'vault read' to test if any secret is accessible.

While reading may reveal permission issues, it is not a direct troubleshooting step for CLI failures.

A
Run 'vault token lookup' to verify the token is valid and has the expected policies.
This helps diagnose token-related issues.
B
Run 'vault write' to test if the token can write to a path.
Why wrong: Writing is not a troubleshooting step; reading or looking up is more diagnostic.
C
Run 'vault login' to re-authenticate and obtain a new token if needed.
If the token is expired or invalid, logging in again is necessary.
D
Run 'vault status' to check if the server is reachable.
Why wrong: While server connectivity is important, the command failure may be due to token issues rather than connectivity.
E
Run 'vault read' to test if any secret is accessible.
Why wrong: While reading may reveal permission issues, it is not a direct troubleshooting step for CLI failures.

Question 2mediummulti select

A DevOps engineer is troubleshooting an issue where a token cannot read a secret from the KV v2 engine at path 'secret/team-alpha/db-creds'. The token's policy includes the following: path "secret/team-alpha/*" { capabilities = ["read"] }. Which TWO reasons could explain the failure?

Trap 1: The user needs to use the token's accessor to read the secret

The accessor is used for management, not for access.

Trap 2: The secret engine is not tuned to allow reads

Engine tuning does not alter policy permissions.

Trap 3: The token is not a child of the root token

Parentage does not affect path-level permissions.

A
The user needs to use the token's accessor to read the secret
Why wrong: The accessor is used for management, not for access.
B
The path in the policy needs to be 'secret/data/team-alpha/*'
KV v2 requires the 'data' prefix in policy paths for secret access.
C
The token may have an additional restrictive policy from a parent token
Inherited policies from parent tokens or identity can impose additional restrictions.
D
The secret engine is not tuned to allow reads
Why wrong: Engine tuning does not alter policy permissions.
E
The token is not a child of the root token
Why wrong: Parentage does not affect path-level permissions.

Question 3mediummultiple choice

A DevOps engineer is troubleshooting a Vault CLI command that is failing with the error 'Error writing data: Error making API request'. The engineer has verified that the Vault token is valid and unexpired. Which of the following is the most likely cause of this error?

Trap 1: The Vault token has been revoked.

The stem explicitly states the token is valid and unexpired.

Trap 2: Network connectivity to Vault is intermittent, causing timeouts.

Network timeouts produce different error messages like 'connection refused' or 'timeout'.

Trap 3: The secret engine at that path has not been enabled.

Missing engine typically returns a 'path not found' error, not a generic API request error.

A
The Vault token has been revoked.
Why wrong: The stem explicitly states the token is valid and unexpired.
B
Network connectivity to Vault is intermittent, causing timeouts.
Why wrong: Network timeouts produce different error messages like 'connection refused' or 'timeout'.
C
The secret engine at that path has not been enabled.
Why wrong: Missing engine typically returns a 'path not found' error, not a generic API request error.
D
The policy attached to the token does not allow writing to the specified path.
A policy deny will cause a permission denied error, often reported as 'Error making API request'.

Question 4easymultiple choice

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Trap 1: Revoke the lease and request a new credential with a longer TTL.

Incorrect. Revoking the lease and requesting a new credential with a longer TTL does not solve the root cause; the application must renew the lease to maintain the credential for its full duration.

Trap 2: Increase the TTL of the database role to 2 hours.

Incorrect. Increasing the role's TTL only extends the maximum lease duration; it does not eliminate the need for the client to renew the lease.

A
Revoke the lease and request a new credential with a longer TTL.
Why wrong: Incorrect. Revoking the lease and requesting a new credential with a longer TTL does not solve the root cause; the application must renew the lease to maintain the credential for its full duration.
B
Modify the application to renew the lease before it expires using the lease ID.
Correct. The application must actively renew the lease using its lease ID before the lease expires to avoid authentication errors.
C
Use the lease ID from the response to call sys/leases/renew periodically.
Correct. Calling `sys/leases/renew` periodically with the lease ID is a valid method to renew the lease, provided the renewal occurs before the TTL expires.
D
Increase the TTL of the database role to 2 hours.
Why wrong: Incorrect. Increasing the role's TTL only extends the maximum lease duration; it does not eliminate the need for the client to renew the lease.

Question 5mediummulti select

A DevOps engineer is troubleshooting a script that uses the Vault CLI to authenticate and read a secret. The script works when run manually from a terminal, but fails when executed by a CI/CD pipeline. The engineer has verified that the same environment variables (VAULT_ADDR, VAULT_TOKEN) are set in both environments. Which two of the following are likely causes of the failure? (Choose two.)

Trap 1: The pipeline's VAULT_TOKEN is expired or revoked.

The same token is used in both environments, so expiry/revocation would affect manual run too.

Trap 2: The pipeline uses a different version of the Vault CLI.

Version differences rarely cause permission errors; the CLI is largely backward-compatible.

Trap 3: The pipeline's shell does not have the vault binary in the PATH.

This would cause a 'command not found' error, not a permission denied from Vault.

A
The pipeline does not have the VAULT_ADDR variable set correctly.
Without correct VAULT_ADDR, the CLI cannot connect to Vault, causing failure.
B
The pipeline's VAULT_TOKEN is expired or revoked.
Why wrong: The same token is used in both environments, so expiry/revocation would affect manual run too.
C
The pipeline uses a different version of the Vault CLI.
Why wrong: Version differences rarely cause permission errors; the CLI is largely backward-compatible.
D
The pipeline runs in a restricted network that cannot reach the Vault server.
Network restrictions can block API calls even if all variables are correct.
E
The pipeline's shell does not have the vault binary in the PATH.
Why wrong: This would cause a 'command not found' error, not a permission denied from Vault.

Question 6mediummultiple choice

A Vault administrator is troubleshooting an issue where after a network outage, the Vault cluster is sealed and cannot be unsealed. The cluster has 5 nodes using Integrated Storage. The administrator runs `vault status` on each node and receives 'sealed' response. The administrator suspects that the cluster lost quorum during the outage. The administrator checks the Raft configuration and finds that there are 3 voter nodes and 2 non-voter nodes. Which action should the administrator take to recover the cluster?

Trap 1: Manually unseal all nodes simultaneously.

Unsealing does not restore quorum.

Trap 2: Use `vault operator raft remove-peer` to remove the non-voter nodes.

Requires a leader to remove peers.

Trap 3: Use `vault operator raft recover` on one of the non-voter nodes.

Non-voters may lack latest data.

A
Manually unseal all nodes simultaneously.
Why wrong: Unsealing does not restore quorum.
B
Use `vault operator raft remove-peer` to remove the non-voter nodes.
Why wrong: Requires a leader to remove peers.
C
Use `vault operator raft recover` on one of the non-voter nodes.
Why wrong: Non-voters may lack latest data.
D
Use `vault operator raft recover` on a voter node to create a new cluster.
Raft recover on a voter node restores quorum.

Question 7easymulti select

A DevOps team is troubleshooting token access in Vault. They need to determine which of the following token operations require sudo capability. Which TWO operations require sudo capability?

Trap 1: Create a token

Token creation does not require sudo; it is controlled by create permission on token auth method.

Trap 2: Renew a token

Renewing a token does not require sudo; it extends the token's TTL.

Trap 3: Read token accessor information

Reading token accessor info is a read-only operation and does not require sudo.

A
Create a token
Why wrong: Token creation does not require sudo; it is controlled by create permission on token auth method.
B
Renew a token
Why wrong: Renewing a token does not require sudo; it extends the token's TTL.
C
Read token accessor information
Why wrong: Reading token accessor info is a read-only operation and does not require sudo.
D
Revoke a token
Revoking a token requires sudo capability because it destroys a token.
E
Access a token's capabilities against a path
Accessing token capabilities requires sudo because it reveals effective permissions.