Question bank
HashiCorp Certified: Vault Operations Professional
44 HashiCorp Certified: Vault Operations Professional questions with the correct answer and a written explanation, organised across 7 exam domains.
- 44 questions
- 7 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Authentication Methods and Access Control
8 questions in this domain
- Question 1Single Choice
Which task does Vault Agent Auto-Auth perform on behalf of applications that need to access Vault?
- AManages the full authentication lifecycleCorrect answer
- BEncrypts application secrets
- CRenders configuration templates
- DActs as a direct auth method
Why this is the answer
Auto-Auth performs login, retrieves the token, and handles periodic renewal, so applications always have a valid session without custom code.
- Question 2Multiple Select
Which of the following actions are performed by Vault Agent Auto-Auth as part of managing application authentication?
- APerforms login with an auth methodCorrect answer
- BRetrieves the Vault tokenCorrect answer
- CHandles periodic token renewalCorrect answer
- DCreates Vault policies
Why this is the answer
Vault Agent Auto-Auth performs login, retrieves the token, and handles periodic renewal. Creating Vault policies is not part of Auto-Auth.
- Question 3Interactive
In the provided Vault Agent configuration, which block is responsible for managing login and token renewal for the application?
- Aauto_authCorrect answer
- Bvault
- Ctemplate
- Dsink
Why this is the answer
The auto_auth block defines the auth method and enables Vault Agent to manage login, token retrieval, and renewal.
- Question 4Single Choice
How is Vault Agent Auto-Auth different from a direct authentication method used by Vault according to the playbook?
- AUses auth methods but is not one itselfCorrect answer
- BIs a Vault authentication method
- CReplaces all authentication methods
- DOnly caches secret responses
Why this is the answer
Auto-Auth is a Vault Agent feature that uses an auth method to authenticate; it is not an auth method itself.
- Question 5Multiple Select
Which of the following statements about Vault Agent Auto-Auth and its role in authentication are correct according to the playbook?
- AHandles the entire authentication lifecycleCorrect answer
- BCan use AWS, Kubernetes, or AppRoleCorrect answer
- CIs an authentication method
- DSimplifies application credential handlingCorrect answer
Why this is the answer
Auto-Auth is not an auth method; it is a Vault Agent feature that uses AWS, Kubernetes, or AppRole and simplifies credential handling.
- Question 6Interactive
In the provided code snippet, what does the sink file configuration allow the application to do to obtain a Vault token?
- ARead a local token fileCorrect answer
- BAccess Vault without a token
- CPerform automatic unsealing
- DCache Vault responses
Why this is the answer
A sink file stores the current authentication token locally, enabling a token-less application design where the app reads the file.
- Question 7Single Choice
What is the purpose of a sink file written by Vault Agent during authentication in a token-less application design?
- AWrites the token to a local fileCorrect answer
- BStores audit logs locally
- CDefines storage backend settings
- DConfigures TLS certificates
Why this is the answer
Vault Agent writes the current authentication token to a sink file so applications can read local credentials instead of managing tokens.
- Question 8Multiple Select
Which authentication methods can Vault Agent Auto-Auth use to log into Vault according to the playbook?
- AAWSCorrect answer
- BKubernetesCorrect answer
- CAppRoleCorrect answer
- DOkta
Why this is the answer
The playbook names AWS, Kubernetes, and AppRole as credentials that Vault Agent Auto-Auth can manage for applications.
Deploy and Configure Vault
8 questions in this domain
- Question 9Single Choice
Before running a downloaded Vault binary, what command should be used to verify its integrity?
- Asha256sumCorrect answer
- Bchmod
- Csystemctl
- Dvault operator init
Why this is the answer
Checksum verification using tools like sha256sum ensures the binary matches the published digest, mitigating supply-chain tampering.
- Question 10Multiple Select
Which systemd unit directives should be configured to run Vault as a non-privileged account and recover from crashes?
- AUserCorrect answer
- BGroupCorrect answer
- CRestartCorrect answer
- DExecStart
Why this is the answer
User and Group restrict Vault to a non-privileged account, while Restart allows the process to recover after crashes. ExecStart is necessary to start Vault but does not enforce least privilege or recovery policy.
- Question 11Interactive
Review the Vault configuration snippet. What is the most likely reason other nodes cannot join this cluster?
- AListener is bound to loopbackCorrect answer
- BStorage backend is Raft
- Ccluster_addr is defined
- DThere is no TLS
Why this is the answer
Binding the listener to 127.0.0.1 only accepts local connections, so remote cluster members cannot reach the node. For HA, the listener should bind to an address reachable by other nodes.
- Question 12Single Choice
What is the default unseal mechanism when no seal block is configured?
- AShamir's Secret SharingCorrect answer
- BAWS KMS
- CTransit engine
- DLDAP
Why this is the answer
Without a seal block, Vault uses Shamir's Secret Sharing to split the unseal key across key shares.
- Question 13Multiple Select
Which statements about audit logs and system logs are correct?
- AAudit logs capture security-relevant requests and responses for compliance.Correct answer
- BSystem logs report internal application health and errors.Correct answer
- CAn audit device that cannot write will cause Vault to block all requests.Correct answer
- DAudit logs and system logs both contain the same information.
Why this is the answer
Audit logs record security-relevant events for compliance, system logs report health and errors, and audit devices fail closed to prevent unlogged activity.
- Question 14Interactive
The systemd unit shown runs the Vault service. What directive is missing to avoid running as root?
- AUser=vaultCorrect answer
- BEnvironment=VAULT_ADDR=http://127.0.0.1:8200
- CExecReload=/bin/kill -HUP $MAINPID
- DTimeoutStartSec=30
Why this is the answer
Without User= and Group= directives, systemd runs the service as root, violating least privilege.
- Question 15Single Choice
What is the primary purpose of the cluster_addr configuration setting?
- AHandling communication between Vault nodes in a clusterCorrect answer
- BBinding the API for client requests
- CDefining the storage backend path
- DEnabling the audit device
Why this is the answer
cluster_addr is used for Vault-to-Vault cluster traffic, including Raft consensus and replication; api_addr is for client API access.
- Question 16Multiple Select
Which backends are valid persistent storage options for Vault as mentioned in the playbook?
- ARaftCorrect answer
- BConsulCorrect answer
- CCloud storageCorrect answer
- DMySQL
Why this is the answer
Vault supports Raft integrated storage, Consul, and cloud storage backends; MySQL is not a supported Vault storage backend.
Enterprise Features and Governance
4 questions in this domain
- Question 17Single Choice
What is a core consideration when deploying Vault through RPM/DEB packages rather than manually placing the binary on the server?
- ARPM/DEB packages make checksum verification unnecessary because the package manager validates the binary.
- BManual binary execution provides built-in service management, while RPM/DEB requires a separate supervisor process.
- CManaged package installations simplify version control and upgrades, but operators should still confirm binary integrity via checksum verification.Correct answer
- DRPM/DEB packages are only appropriate for test environments because Vault cannot use managed packages in HA deployments.
Why this is the answer
Managed packages ease installation and upgrades, but checksum verification remains a key integrity step. Package managers do not remove the need to verify binary authenticity and version compatibility.
- Question 18Multiple Select
Which two operational requirements are essential when configuring systemd for Vault? Select two.
- ASet User and Group directives to a non-privileged account such as vault.Correct answer
- BRun the Vault process as root so it can write to protected directories and bind to privileged ports.
- CConfigure a Restart policy such as always or on-failure so Vault recovers after crashes or reboots.Correct answer
- DUse Type=oneshot so systemd considers the service successfully started immediately after the command exits.
Why this is the answer
Systemd units should avoid root execution and enable restart for resilience. Non-privileged User/Group and Restart policies are explicit best practices in Vault operations.
- Question 19Interactive
Review the systemd unit file shown in the code block. Which critical hardening directive is missing from this Vault service configuration?
- AUser=vault and Group=vault to prevent the process from running as root.Correct answer
- BEnvironment=VAULT_DEV_ROOT_TOKEN_ID to enable development mode.
- CLimitNOFILE=infinity to guarantee maximum throughput.
- DSuccessExitStatus=0 to mark any termination as successful.
Why this is the answer
The unit file does not set User or Group, so systemd defaults to root. Vault best practice requires running the process as a non-privileged vault user.
- Question 20Single Choice
What is the key difference between audit logs and system logs in a Vault deployment?
- AAudit logs record application health, while system logs record API request and response payloads.
- BAudit logs capture security-relevant request/response events for compliance, while system logs capture internal Vault health and errors.Correct answer
- CBoth log types are identical and can be configured with a single log_level setting.
- DSystem logs are fail-closed and block Vault if logging fails, while audit logs are always best-effort.
Why this is the answer
Audit logs are for security/compliance and can be configured to fail closed. System logs provide internal operational visibility, such as errors and health, and are not interchangeable.
High Availability and Replication
6 questions in this domain
- Question 21Single Choice
What is the default manual seal mechanism used to protect Vault's unseal key?
- AShamir's Secret SharingCorrect answer
- BAuto-unseal using AWS KMS
- CTransit Auto-Unseal
- DA single static unseal key
Why this is the answer
Shamir's Secret Sharing is the default manual unseal process. Key shards are distributed among operators and must be combined to unseal Vault.
- Question 22Multiple Select
Which two systemd directives should be configured to ensure the Vault process does not run as root?
- AUserCorrect answer
- BGroupCorrect answer
- CExecStart
- DRestart
Why this is the answer
Setting User and Group in the systemd unit makes Vault run under a non-privileged account. ExecStart defines the command and Restart controls recovery.
- Question 23Interactive
Review the provided systemd unit file. Which essential hardening directive is missing to prevent Vault from running with elevated privileges?
- AUser and Group directivesCorrect answer
- BTLS certificate paths
- Capi_addr and cluster_addr
- Dstorage backend block
Why this is the answer
Without User and Group directives, systemd defaults to root, violating the principle of least privilege. The other settings are unrelated or belong in the Vault config.
- Question 24Single Choice
What is the purpose of `cluster_addr` in a Vault HA deployment?
- AInter-node cluster communication and heartbeatsCorrect answer
- BClient-facing API traffic
- CAudit log forwarding
- DStorage backend connections
Why this is the answer
cluster_addr is used for inter-node cluster communication, including heartbeats and request forwarding. api_addr is used for client-facing API traffic.
- Question 25Multiple Select
Which consequences can occur when the listener is bound only to `127.0.0.1` in a clustered deployment?
- ARemote clients cannot reach the Vault APICorrect answer
- BOther nodes cannot communicate with the instanceCorrect answer
- CThe configuration is insufficient for high availabilityCorrect answer
- DTLS is automatically enabled for all traffic
Why this is the answer
A loopback listener restricts access to local processes and is not sufficient for HA. It prevents remote nodes and clients from communicating with this instance.
- Question 26Interactive
Review the provided HCL configuration. Which missing settings must be added so this Vault node can discover and join a cluster?
- Aapi_addr and cluster_addrCorrect answer
- Bseal block with AWS KMS
- Ctelemetry block
- Dlog_level setting
Why this is the answer
Vault requires api_addr and cluster_addr to be set for node discovery and cluster communication. The other blocks are optional or unrelated.
Monitoring, Logging, and Auditing
5 questions in this domain
- Question 27Single Choice
What is the primary purpose of an audit device in Vault?
- ATo record detailed request and response logs for compliance and security forensicsCorrect answer
- BTo cache secret responses for faster application access
- CTo encrypt data at rest using the barrier key
- DTo automatically unseal Vault using a cloud KMS provider
Why this is the answer
Audit devices capture security-relevant request and response logs for compliance, forensics, and monitoring. Caching, encryption, and auto-unseal are handled by other components of Vault.
- Question 28Multiple Select
Which two statements correctly distinguish audit logs from system logs in Vault?
- AAudit logs record security-relevant request/response events for compliance and forensics.Correct answer
- BSystem logs provide visibility into internal application health and errors.Correct answer
- CSystem logs replace audit logs when compliance evidence is required.
- DAudit logs summarize CPU and memory utilization across the cluster.
Why this is the answer
Audit logs and system logs are complementary. Audit logs focus on security-relevant request and response events, while system logs track internal application health, errors, and operational behavior.
- Question 29Interactive
In the provided HCL configuration, what is the purpose of the final stanza?
- AIt enables Prometheus-compatible telemetry and metrics collection.Correct answer
- BIt defines an additional Raft storage backend.
- CIt configures an audit device that writes to a log file.
- DIt configures TLS certificates for listener communication.
Why this is the answer
The telemetry stanza exposes operational metrics such as request latency and error rates in Prometheus format, enabling proactive monitoring and incident response.
- Question 30Single Choice
What should happen if an audit device is configured to fail-closed and cannot write to its destination?
- AIt should block all requests to prevent unmonitored access.Correct answer
- BIt should continue serving requests and skip audit logging.
- CIt should buffer logs in memory until the destination recovers.
- DIt should switch to system logs for temporary audit storage.
Why this is the answer
Fail-closed means that if an audit device cannot write its logs, Vault blocks requests instead of allowing unlogged activity. This guarantees security-relevant operations are never left undocumented.
- Question 31Multiple Select
Which two actions should be taken to secure a Vault TCP listener in production?
- AExplicitly provide a TLS certificate and private key in the listener block.Correct answer
- BConfigure allowed cipher suites to meet your security policy.Correct answer
- CSet the listener address to 127.0.0.1 in all environments to improve cluster communication.
- DUse the default listener settings because Vault enables TLS by default.
Why this is the answer
TLS is not enabled automatically in production; operators must explicitly configure certificate paths and cipher suites. Binding to 127.0.0.1 can prevent cluster nodes from communicating with each other.
Secrets Engines and Data Protection
8 questions in this domain
- Question 32Single Choice
Why should a Vault operator verify the binary checksum after downloading?
- AVerify binary integrityCorrect answer
- BConfigure systemd automatically
- CEnable audit logging
- DSet the listener address
Why this is the answer
Checksum verification confirms the binary has not been corrupted or tampered with during download.
- Question 33Multiple Select
Which configuration elements are required in a systemd unit file to start Vault as a managed service without running as root? Select all that apply.
- AUser=vaultCorrect answer
- BGroup=vaultCorrect answer
- CExecStart pointing to vault serverCorrect answer
- DEnvironment=VAULT_DEV_ROOT_TOKEN_ID=root
Why this is the answer
A secure systemd unit should specify a non-privileged User and Group and define the Vault server ExecStart path. Root token environment variables violate security best practices.
- Question 34Interactive
Review the listener configuration provided in the code block. What is the main issue if this Vault instance belongs to a cluster?
- AIt listens only on the loopback interfaceCorrect answer
- BIt enables TLS encryption
- CIt uses a non-standard port
- DIt disables audit devices
Why this is the answer
The listener address 127.0.0.1 restricts connections to localhost, so other cluster nodes cannot communicate with this Vault instance.
- Question 35Single Choice
What type of Vault log records request and response data for security forensics and compliance?
- AAudit logsCorrect answer
- BSystem logs
- CTelemetry metrics
- DStartup logs
Why this is the answer
Audit devices capture detailed request and response logs for compliance and security forensics, while system logs record operational health and errors.
- Question 36Multiple Select
Which statements accurately describe Shamir seal and auto-unseal? Select all that apply.
- AShamir distributes key shards among operatorsCorrect answer
- BAuto-unseal uses an external provider to wrap the unseal keyCorrect answer
- CAuto-unseal removes the need to protect KMS IAM settings
- DShamir unseal requires no human intervention
Why this is the answer
Shamir distributes key shards among operators, and auto-unseal delegates the wrapping of the unseal key to an external provider. Auto-unseal still requires strict IAM protection.
- Question 37Interactive
In the provided Vault configuration snippet, why are the api_addr and cluster_addr values an issue for a cluster?
- AThe node cannot be reached by other cluster nodesCorrect answer
- BThe node will use TLS for all communication
- CRaft will use api_addr for consensus traffic
- DThe node will auto-unseal through the storage backend
Why this is the answer
Loopback addresses restrict communication to localhost. Other nodes cannot contact this instance because cluster_addr also points to 127.0.0.1.
- Question 38Single Choice
Which key is responsible for encrypting data at rest in Vault's storage backend?
- ABarrier keyCorrect answer
- BMaster key
- CRoot token
- DUnseal key
Why this is the answer
The barrier key is the actual key used by the encryption engine to protect data at rest. The master key decrypts the barrier key during unseal.
- Question 39Multiple Select
Which capabilities does Vault Agent provide? Select all that apply.
- AAuto-Auth lifecycle managementCorrect answer
- BResponse cachingCorrect answer
- CTemplate rendering and reload signalingCorrect answer
- DReplacing Vault server high availability
Why this is the answer
Vault Agent handles authentication, caches responses, and renders templates. It provides resilience but does not replace a highly available Vault cluster.
Upgrades, Scaling, and Troubleshooting
5 questions in this domain
- Question 40Single Choice
In Vault's default manual unseal process, which mechanism distributes key shards among multiple operators?
- AShamir's Secret SharingCorrect answer
- BAuto-Unseal
- CTransit Auto-Unseal
- DKMS Provider
Why this is the answer
Shamir's Secret Sharing is the default manual unseal mechanism. It splits the master key into shards distributed among operators, requiring a threshold to unseal Vault.
- Question 41Multiple Select
Which two statements correctly identify common Vault operational traps related to clustering and systemd service management?
- ALoopback listener alone is enough for HA cluster.
- BMissing User/Group directives may run Vault as root.Correct answer
- CSame api_addr and cluster_addr can cause routing loops.Correct answer
- DEven Raft node count is preferred for quorum.
Why this is the answer
B and C are documented traps. Missing User/Group can run Vault as root; mixing api_addr and cluster_addr risks routing loops. Loopback bindings and even Raft counts are HA mistakes.
- Question 42Interactive
Review the Vault configuration snippet provided. What is the most critical issue for an HA cluster deployment?
- ALoopback binding blocks remote cluster traffic.Correct answer
- BTLS configuration is incomplete for production.
- Capi_addr and cluster_addr use different addresses.
- DRaft requires Consul to form an HA cluster.
Why this is the answer
Loopback binding allows only local clients, so other nodes cannot join the cluster. TLS must be explicit in production, but the immediate HA blocker is the listener address.
- Question 43Single Choice
Which statement best describes the role of the Master Key in Vault's unseal hierarchy?
- AIt decrypts the Barrier Key, unsealing the barrier.Correct answer
- BIt encrypts all secrets written to storage.
- CIt is identical to the root token.
- DIt is stored in plaintext for recovery.
Why this is the answer
The Master Key decrypts the Barrier Key. The Barrier Key protects data at rest. The root token is separate and should be retired.
- Question 44Multiple Select
Which two statements about Vault audit devices and audit logging are correct?
- AAudit devices should fail closed if logging fails.Correct answer
- BAudit logs are interchangeable with system logs.
- CAudit logs record security-relevant events for compliance.Correct answer
- DVault should ignore audit write failures.
Why this is the answer
Audit logs are security-relevant and should fail closed. If an audit device cannot write, Vault blocks all requests to prevent unlogged activity. System logs are not interchangeable.
Frequently asked questions
Everything about the HashiCorp Certified: Vault Operations Professional question bank and how to use it.