VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

HashiCorp Certified: Vault Operations Professional Free Sample Questions

Description

Covers production-hardened server configuration, telemetry and audit log monitoring, high-availability and disaster-recovery clustering, HSM unsealing, and ACL policies.

12 free sample questions191 in the full practice test

Try simulator

Vault-Operations-Professional Sample Questions

  1. Question 1

    Intermediate

    Create a Working Vault Server Configuration Given a Scenario · Implement integrated storage for Community and Enterprise Vault

    A senior Vault architect is designing a production cluster using Integrated Storage (Raft). The requirement is to ensure the cluster can sustain the failure of two simultaneous nodes without losing data or service availability.

    What is the minimum number of voting nodes required in this cluster configuration?

    Answer and explanation

    Correct answer: D

    In a Raft consensus algorithm, the cluster requires a quorum of (N/2)+1 nodes to operate. To tolerate the failure of F nodes, the cluster size must be 2F + 1. Therefore, to tolerate 2 failures, you need 2(2) + 1 = 5 nodes. A 3-node cluster can only tolerate 1 failure.

  2. Question 2

    Intermediate

    Create a Working Vault Server Configuration Given a Scenario · Auto unseal Vault

    You are configuring a Vault server to use AWS KMS for auto-unseal. The Vault server starts successfully, but you notice the following error in the logs when attempting to initialize:

    failed to encrypt the master key: AccessDeniedException

    Which specific AWS IAM permission is missing from the IAM role attached to the Vault EC2 instance?

    Answer and explanation

    Correct answer: B

    When initializing Vault with auto-unseal, Vault generates the root key (master key) and attempts to encrypt it using the KMS key. This requires the kms:Encrypt permission. During normal unseal operations (restart), kms:Decrypt is used. Since the error occurs during initialization (encrypting the master key for the first time), kms:Encrypt is the missing permission.

  3. Question 3

    Advanced

    Create a Working Vault Server Configuration Given a Scenario · Practice production hardening

    A financial institution requires that all memory used by Vault processes be prevented from being swapped to disk to avoid leaking sensitive material. You have added disable_mlock = false to the Vault configuration.

    However, Vault fails to start with the error: Failed to lock memory: cannot allocate memory.

    Which Linux system capability or configuration must be adjusted to resolve this?

    Answer and explanation

    Correct answer: C

    The mlock syscall requires the process to have the ability to lock memory. In Linux, this is controlled by the memlock ulimit. If this limit is too low (or default), Vault cannot lock the required memory and will fail to start. The administrator must increase ulimit -l or use setcap cap_ipc_lock=+ep on the binary.

  4. Question 4

    Advanced

    Create a Working Vault Server Configuration Given a Scenario · Auto unseal Vault

    You need to migrate an existing production Vault cluster from Shamir's Secret Sharing to Auto-Unseal using the Transit Secrets Engine hosted on a separate Vault cluster.

    After configuring the seal stanza in the configuration file, what is the required command sequence to complete the migration?

    Answer and explanation

    Correct answer: D

    To migrate seals, you first update the configuration file with the new seal stanza. Then you restart the Vault service. Vault will detect a configuration mismatch between the stored barrier and the configuration. You must then run vault operator unseal -migrate and provide the threshold number of existing unseal keys. Vault will decrypt the master key using the old method, re-encrypt it using the new auto-unseal mechanism, and complete the migration.

  5. Question 5

    Intermediate

    Create a Working Vault Server Configuration Given a Scenario · Enable and configure authentication methods

    You are creating a new AppRole for a CI/CD pipeline. The security team mandates that the SecretID used by the pipeline must be single-use only and must expire after 30 minutes if not used.

    Which command correctly configures the AppRole to meet these requirements?

    Answer and explanation

    Correct answer: B

    The secret_id_num_uses parameter controls how many times a SecretID can be used to fetch a token; setting it to 1 makes it single-use. The secret_id_ttl parameter sets the expiration of the SecretID itself, meeting the 30-minute requirement.

  6. Question 6

    Beginner

    Create a Working Vault Server Configuration Given a Scenario · Rekey Vault and rotate encryption keys

    A Vault administrator needs to rotate the encryption key used to protect data at rest (the barrier key).

    What is the correct distinction between vault operator rotate and vault operator rekey?

    Answer and explanation

    Correct answer: A

    vault operator rotate generates a new encryption key for the storage backend and adds it to the keyring (used for new writes). vault operator rekey is used to generate new unseal keys (shares) or change the threshold required to unseal the vault.

Register free for 6 more questions

Or unlock all 191 Vault-Operations-Professional questions with explanations, timed mode and flashcards.

Related practice tests

All Hashicorp practice exams