Explain Vault architecture practice questions

Add more storage backend nodes

Why it fails: Can increase latency due to synchronization overhead.

Disable storage replication

Why it fails: Causes data loss and reduces availability.

Increase the number of Vault nodes without replication

Why it fails: Does not address storage latency and may cause inconsistencies.

All three nodes automatically rejoin after partition

Why it fails: Raft requires manual intervention to recover.

All three nodes continue to serve requests

Why it fails: The isolated node cannot serve writes without quorum.

The two isolated nodes stop serving requests

Why it fails: They can form quorum and continue.

The root token was revoked during unseal

Why it fails: Incorrect. Revocation would appear in audit logs, but the logs show no revocations.

The root token's policy was removed

Why it fails: Incorrect. Policy removal would not immediately invalidate an active token; the token would still be usable until next authentication.

The root token was stored in memory only and lost on seal

Why it fails: Incorrect. While root tokens are ephemeral, they are persisted in storage after initialization; losing them on seal is expected, but they can be regenerated using recovery keys.

Each EC2 instance must have an IAM role attached

Why it fails: Optional, not required for auth method.

Vault must have AWS API credentials configured

Why it fails: Vault uses instance metadata, not credentials.

Vault must be deployed on an EC2 instance in the same region

Why it fails: Can be in any region with network access.

Audit Device

Why it fails: Optional for logging.

A policy

Why it fails: Required for authorization, but the question asks for components to process requests, and auth method is the first step.

A secrets engine

Why it fails: Optional; Vault can operate without one.

Use a single storage backend across datacenters

Why it fails: One storage backend shared across datacenters introduces cross-site latency and a single point of failure for Vault's persistence layer. It tempts when consolidating data, but each Vault cluster requires its own integrated storage or backend local to that datacenter; replication handles cross-site data, not shared storage.

Deploy a single Vault cluster spanning datacenters

Why it fails: A single Vault cluster spanning datacenters couples failure domains: Raft quorum latency across sites and one outage can stall the whole cluster. It tempts for unified secrets access, but the correct design is independent clusters per datacenter with performance replication or disaster recovery replication between them.

Re-initialize Vault and generate new unseal keys

Why it fails: Would lose all secrets.

Generate a new root token using unseal keys

Why it fails: Root token generation requires Vault to be unsealed.

Use the unseal keys to unseal Vault again

Why it fails: Unseal keys cannot unseal if storage is corrupted or empty.

AWS EC2 instance metadata

Why it fails: Vault's AWS auth method verifies a signed PKCS#7 identity document from the instance metadata service; raw metadata alone is not a Vault auth method. It is tempting because EC2 metadata does carry IAM credentials, which would be the correct choice for authenticating to AWS APIs, not to Vault.

The Raft storage backend does not support write operations.

Why it fails: Raft supports writes; only the elected leader commits them, so a healthy backend cannot be the cause. This option is tempting because the storage layer is central to Vault operations, but Raft is precisely the integrated storage designed for read-write clusters, making the claim factually false.

The load balancer is not configured to use the /v1/sys/leader endpoint for routing.

Why it fails: Vault forwards write requests internally to the active node, so leader-aware routing is not required for writes to succeed. This endpoint is genuinely useful for directing clients to the active node to reduce forwarding latency, but its absence cannot produce 502 errors while reads succeed.

One of the Vault nodes is sealed, causing write requests to fail.

Why it fails: The stem states all nodes are unsealed and the cluster is healthy, so a sealed node cannot be responsible. Sealed nodes are the classic cause of failed requests when quorum is lost, which makes this tempting, but the stated health contradicts it and reads would also fail.

Vault's Cubbyhole Response Wrapping

Why it fails: Cubbyhole response wrapping delivers a single-use token containing response data to one client; it does not store or protect a persistent encryption key. It is tempting because wrapping shields secrets in transit, but it cannot keep an S3 data key within the Vault boundary during encryption operations.

Vault's Key Management Secrets Engine (KMSE)

Why it fails: KMSE generates and stores keys in a KMS provider such as AWS KMS, so the key material sits outside Vault's own barrier rather than inside it. It is tempting because KMSE performs the encrypt/decrypt operations, but the component keeping keys within the Vault boundary is the barrier.

Vault's PKI Secrets Engine

Why it fails: The PKI Secrets Engine issues and manages X.509 certificates and private keys; it performs no data encryption and holds no S3 encryption key. It is tempting because it also manages cryptographic material, but certificate issuance is unrelated to keeping a data encryption key inside the Vault boundary.

Shamir's secret sharing splits the master key into key shares.

Why it fails: Shamir's secret sharing reconstructs the unseal key from a threshold of shares; it does not split the master key, which is encrypted by the unseal key. It tempts because Shamir's is genuinely used in Vault's seal mechanism, but the key hierarchy is inverted here.

The storage backend is responsible for sealing and unsealing Vault.

Why it fails: The storage backend persists encrypted data; sealing and unsealing are handled by the barrier and seal mechanism, which never store the unseal key there. It tempts because the backend holds all Vault state, but it cannot decrypt anything without the unseal keys.

In a Vault cluster, when a new leader is elected, it automatically unseals itself.

Why it fails: Unsealing requires the master key shares to reconstruct the root key; leader election only transfers active-node duties within an already-unsealed cluster. It is tempting because automatic unseal is achievable, but only via auto-unseal using a KMS or HSM, not through leader election.

Store the master key in the transit secrets engine and unseal automatically

Why it fails: The transit secrets engine performs cryptographic operations on data but never stores or reconstructs the master key, so it cannot unseal Vault at all. It is tempting because transit handles key management, yet it would only be correct for encrypting application data, not for automating the unseal process.

Use AWS KMS as a seal for auto-unseal

Why it fails: AWS KMS auto-unseal delegates the master key to KMS, so Shamir's shares are never generated or distributed to administrators, contradicting the split-key requirement. It is tempting because KMS genuinely removes manual unsealing, but it would be correct only where no Shamir key-share distribution is mandated.

Use a single unseal key stored in a password manager and manually unseal

Why it fails: A single key held in a password manager removes the Shamir threshold entirely and still demands manual entry, so no automatic unseal occurs when a majority of shares is presented. It is tempting as a convenience for small labs, but it would be correct only where one operator unseals interactively.

Socket audit device with a remote log aggregator

Why it fails: A socket audit device still blocks Vault when the remote aggregator is unreachable or full, halting operations, which contradicts the requirement. It is tempting because remote aggregation centralises audit logs, but the correct configuration uses a non-blocking mode so Vault continues when the device cannot accept writes.

File audit device with blocking=true and a separate backup file

Why it fails: Setting blocking=true makes Vault halt operations when the file device cannot write, directly violating the requirement that Vault must not stop. It is tempting because a backup file appears to add resilience, but blocking mode is precisely the behaviour the scenario forbids; non-blocking mode is needed.

Syslog audit device with local syslog server

Why it fails: A local syslog server is a single point of failure; if it fills or becomes unreachable, Vault blocks and halts operations, failing the requirement. It is tempting because syslog centralises audit events, but the scenario demands a non-blocking configuration so Vault continues writing when the device cannot accept data.

The node's raft index is ahead of the leader's

Why it fails: A node whose Raft index is ahead of the leader's cannot be a valid follower; the leader rejects it, so it will not rejoin automatically. It is tempting because index divergence sounds like a plausible partition symptom, but the actual cause is usually a stale configuration entry requiring manual removal and re-addition.

The node's clock skew is causing Raft timeouts

Why it fails: Clock skew causes Raft heartbeat and election timeouts, but those produce transient leader elections rather than a node permanently failing to rejoin after a partition. It is tempting because timing issues do disrupt Raft, yet the scenario's persistent unreachable node points to a stale Raft configuration entry instead.

The node must be manually removed from the raft configuration and re-added

Why it fails: A Raft node that loses quorum and cannot rejoin is not fixed by manual removal and re-addition; that procedure applies to permanently failed nodes. The likely cause is a stale peer address or configuration mismatch, so the node needs its Raft configuration corrected, not removed. Manual re-addition would risk quorum loss.

The secret is stored in a different mount path

Why it fails: There is no indication that the secret is stored in a different mount path; the problem is consistent with a missing metadata path.

The policy is missing 'update' capability for the path

Why it fails: The 'update' capability is not needed for reading a secret; read and list are sufficient for data access, but metadata access is also required.

The users are in a different namespace that doesn't inherit the policy

Why it fails: The question does not mention namespaces, and there is no evidence that namespace inheritance is the issue.

With Integrated Storage, all nodes can handle write requests

Why it fails: With Integrated Storage, only the active node handles writes; standby nodes forward requests to it, so this claim is false. It tempts because Integrated Storage does provide HA via Raft consensus, but that governs leader election and log replication, not distributing write handling across all nodes.

Disaster Recovery Replication replicates everything including policies and audit logs

Why it fails: DR replication streams only the data needed for recovery, not policies or audit logs, which are excluded from the replication set. It tempts because DR secondaries do hold replicated secrets and can be promoted, but configuration and audit devices are not part of what is transmitted.

File storage backend

Why it fails: File backend is not HA; it is single-node.

In-memory storage backend with replication

Why it fails: In-memory storage backend does not support replication or high availability; it is a single-node backend used for development or testing, not for production HA.

Consul storage backend

Why it fails: Consul depends on an external Consul cluster.

MySQL storage backend

Why it fails: MySQL requires an external database and is not fully HA without additional setup.

vault operator unseal -auto

Why it fails: No -auto flag exists for vault operator unseal; unsealing requires submitting unseal key shares, and auto-unseal is configured in the server config, not via a command flag. It is tempting because auto-unseal is a real feature, but that is the correct choice when configuring a seal stanza, not for manual unsealing.

vault operator unseal <key>

Why it fails: Unsealing requires a threshold of unseal key shares, so a single key submission leaves the server sealed until enough shares are provided. It is tempting because it is the genuine unseal command, but that is the correct choice only when supplying each share in turn until the threshold is met.

vault operator generate-root

Why it fails: generate-root produces a new root token after quorum unsealing; it does not unseal a server and cannot run while sealed. It is tempting because it is a recovery command, but that is the correct choice for regenerating a lost root token on an already-unsealed cluster.

All nodes become unavailable because node1 is the leader

Why it fails: A Raft leader losing contact with the majority cannot commit writes, but followers elect a new leader and remain available for reads and writes. This option is tempting because leader loss sounds fatal, yet it would be correct only in single-node clusters where no quorum survives.

No nodes become unavailable; node1 remains leader but cannot serve writes

Why it fails: A partitioned leader cannot commit writes, but Raft quorum elects a new leader among the remaining peers, so node1 is the only node that becomes unavailable. The option tempts because a leader does briefly retain its title during the election timeout window before stepping down.

Node1, node4, and node5 become unavailable

Why it fails: Only the isolated leader loses quorum and stops serving; the remaining peers form a quorum and elect a new leader, so node4 and node5 stay available. The option tempts by assuming any peer listed in the raft configuration is affected by one node's partition.

Update the metadata of the secret

Why it fails: Metadata updates require the 'update' capability on the metadata path, which this policy does not grant; only read and list are permitted. It is tempting because metadata operations feel adjacent to reading, but 'update' on the metadata endpoint would be the correct choice when a policy explicitly includes that capability.

Delete the secret

Why it fails: Deleting requires the 'delete' capability on the data path, which the policy omits; read and list alone cannot remove the secret. It is tempting because deletion is a common administrative task, and 'delete' would be the correct choice when the policy grants that capability on secret/data/production/*.

Write a new version of the secret

Why it fails: Writing a new version requires the 'create' or 'update' capability on the data path, neither of which the policy grants. It is tempting because versioning is central to Vault KV v2, and 'create' would be the correct choice when the policy explicitly permits writing new versions.