Vault Operations Advanced

Last checked November 10, 2026 against the official HashiCorp exam page.

1. Question 1Build a working Vault server configuration for a given scenario

   A team needs a Vault server for a proof of concept that will hold real customer data within a month. An engineer proposes starting it in dev mode now and moving the data later. Which statement best explains why this plan is wrong?

   1. ADev mode keeps data in memory, runs with TLS disabled, and must never hold production secrets
   2. BDev mode requires an Enterprise license, so the team would need to purchase one before starting
   3. CDev mode disables every auth method, so each one would need to be re-enabled by hand afterward
   4. DDev mode seals itself after every restart, so the team would need to script an unseal step before tests
   Show answer and explanationHide answer

   Correct answer: A

   Dev mode is meant only for local experiments: it stores data in memory, runs without TLS, and starts unsealed with a printed root token, so its data cannot be carried into a production cluster. The other options describe licensing, auth handling, and sealing behaviour that dev mode does not have.

2. Question 2Monitor a Vault environment

   A platform team wants to alert when Vault's request latency rises, and its Prometheus server scrapes the cluster. Which Vault endpoint returns metrics in a format Prometheus can scrape directly?

   1. AThe vault status command run on a schedule, with its text output parsed by a cron job
   2. BThe audit log device, which forwards every request record to the Prometheus server for graphing
   3. CThe sys/health endpoint, which returns the cluster's recent request latency values as numbers
   4. DThe sys/metrics endpoint with format set to prometheus, which returns metrics for scraping
   Show answer and explanationHide answer

   Correct answer: D

   Vault exposes runtime metrics through sys/metrics, and the format=prometheus parameter produces output Prometheus can scrape. Audit logs record requests rather than metrics, sys/health reports health status rather than latency, and parsing vault status output is not a supported metrics interface.

3. Question 3Apply the Vault security model

   A deployment pipeline runs on self-hosted runners outside Kubernetes and needs to read one secret path. The security team wants each runner to get only the policy it needs, and wants credentials that can be rotated without editing that policy. Which auth method fits best?

   1. AThe root token, copied into the pipeline and replaced whenever a runner is rebuilt
   2. BUserpass, with one shared username and password stored in the pipeline's variables
   3. CAppRole, with a role_id stored in the pipeline and a secret_id issued for each run
   4. DThe Kubernetes auth method, with each runner presenting the service account token from its own cluster
   Show answer and explanationHide answer

   Correct answer: C

   AppRole is designed for machines: the role_id identifies the role, and a secret_id can be issued and rotated separately without changing the policy. Userpass shares one login across runners, the root token gives unlimited access, and runners outside Kubernetes have no service account token to present.

4. Question 4Build fault-tolerant Vault environments

   An operator is building an HA Vault cluster with integrated storage. The team wants the cluster to keep its quorum after losing any single node, using the fewest voting members possible. Which design fits?

   1. ATwo voting nodes, which keeps one standby ready for each active node
   2. BOne voting node, which avoids quorum calculations and still provides high availability
   3. CFour voting nodes, which is the smallest count that tolerates a single node failure
   4. DThree voting nodes, which keeps a quorum of two after the loss of any single node
   Show answer and explanationHide answer

   Correct answer: D

   Raft needs a majority of voting members, so three voters keep a quorum of two when one fails. Two voters cannot survive a failure, four voters tolerate one failure too but are not the smallest option, and a single voter offers no high availability.

5. Question 5Understand HSM integration

   A bank requires that Vault's master key protection come from a hardware security module in its own data center, with no key material held by a public cloud provider. Which Vault feature provides this?

   1. AThe pkcs11 seal stanza, which uses the on-premises HSM for automatic unsealing
   2. BThe awskms seal stanza, which uses AWS-managed keys for automatic unsealing
   3. CA Shamir seal with key shares generated inside the HSM and typed in by operators
   4. DDev mode with an HSM simulator, which keeps the master key in memory on the host
   Show answer and explanationHide answer

   Correct answer: A

   The pkcs11 seal integrates Vault with a PKCS#11-capable HSM, which holds the wrapping key and unseals the cluster automatically. The awskms seal depends on a cloud provider, a Shamir seal still needs operators after each restart, and dev mode is not a production configuration.