VA-003 Explain Vault architecture Practice Question
Which TWO are core components of Vault's architecture?
⚠ Common exam trap
HashiCorp often tests the distinction between core architectural components (Seal and Storage Backend) and optional or pluggable features (audit devices, auth methods, replication), leading candidates to mistakenly select features that are critical for operation but not part of the minimal core architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Seal
Option A (Seal) is correct because the seal/unseal mechanism is a fundamental architectural component of Vault: Vault always starts in a sealed state, and the master key (protected by the unseal keys or auto-unseal KMS) must be used to decrypt the encryption key so Vault can read its data — this barrier is intrinsic to Vault's core design. Option B (Storage backend) is correct because Vault's architecture is built around a pluggable storage backend (e.g., Integrated Storage/Raft, Consul, File) that persists encrypted data; without a configured storage backend Vault cannot function, making it a core component. Option C (Audit device) is not a core architectural component but an optional, enable-able feature for logging requests and responses to destinations like file or syslog. Option D (Auth method) is a pluggable security feature (e.g., token, userpass, LDAP, AppRole) that authenticates clients but is not part of the base architecture. Option E (Replication) is an optional enterprise capability (performance/DR replication) for scaling and disaster recovery, not a core component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Seal
Why this is correct
The seal is a core architectural component: it wraps the root key and controls whether Vault can decrypt the barrier. When sealed, Vault cannot read storage or serve requests; unsealing reconstructs the root key from threshold shares, enabling operation.
- ✓
Storage backend
Why this is correct
The storage backend is a core component, providing durable persistence for encrypted data. Vault never stores plaintext there; the barrier encrypts everything before it reaches the backend, which may be integrated storage, Consul, or a filesystem.
- ✗
Audit device
Why it's wrong here
Audit devices are configured components that log requests and responses, not one of the core architectural pillars of storage, barrier or HTTP API. It is tempting because auditing is integral to Vault operation, and an audit device would be the correct choice when asked which components record request activity.
- ✗
Auth method
Why it's wrong here
Auth methods are pluggable authentication backends mounted into Vault, not core architectural components; they sit atop the core. It is tempting because authentication is essential to Vault usage, and an auth method would be the correct choice when asked how clients authenticate to Vault.
- ✗
Replication
Why it's wrong here
Replication is an enterprise feature for performance and disaster recovery, not a core architectural component of Vault's request path. It is tempting because replication appears in HA designs, and it would be the correct choice when asked which enterprise capability provides multi-cluster redundancy.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.