Free Vault-Operations-Professional sample questions

Correct answer: 5 nodes

In a Raft consensus algorithm, the cluster requires a quorum of (N/2)+1 nodes to operate. To tolerate the failure of F nodes, the cluster size must be 2F + 1. Therefore, to tolerate 2 failures, you need 2(2) + 1 = 5 nodes. A 3-node cluster can only tolerate 1 failure.

Correct answer: kms:Encrypt

When initializing Vault with auto-unseal, Vault generates the root key (master key) and attempts to encrypt it using the KMS key. This requires the `kms:Encrypt` permission. During normal unseal operations (restart), `kms:Decrypt` is used. Since the error occurs during initialization (encrypting the master key for the first time), `kms:Encrypt` is the missing permission.

Correct answer: Increase the `ulimit -l` (max locked memory) setting for the Vault user

The `mlock` syscall requires the process to have the ability to lock memory. In Linux, this is controlled by the `memlock` ulimit. If this limit is too low (or default), Vault cannot lock the required memory and will fail to start. The administrator must increase `ulimit -l` or use `setcap cap_ipc_lock=+ep` on the binary.

Correct answer: Restart Vault -> `vault operator unseal -migrate` -> Enter unseal keys

To migrate seals, you first update the configuration file with the new seal stanza. Then you restart the Vault service. Vault will detect a configuration mismatch between the stored barrier and the configuration. You must then run `vault operator unseal -migrate` and provide the threshold number of existing unseal keys. Vault will decrypt the master key using the old method, re-encrypt it using the new auto-unseal mechanism, and complete the migration.

Correct answer: vault write auth/approle/role/cicd secret_id_num_uses=1 secret_id_ttl=30m

The `secret_id_num_uses` parameter controls how many times a SecretID can be used to fetch a token; setting it to 1 makes it single-use. The `secret_id_ttl` parameter sets the expiration of the SecretID itself, meeting the 30-minute requirement.

Correct answer: `rotate` changes the underlying data encryption key; `rekey` changes the unseal keys held by operators.

`vault operator rotate` generates a new encryption key for the storage backend and adds it to the keyring (used for new writes). `vault operator rekey` is used to generate new unseal keys (shares) or change the threshold required to unseal the vault.