A Vault cluster is using Shamir unseal with 5 shares and a threshold of 3. The organization wants to migrate to auto unseal using Azure Key Vault. What is the first step in this migration?

Use 'vault operator rekey' to generate a new master key encrypted by the new seal.

Change the seal block in the config file to 'azurekeyvault' and restart Vault.

Unseal Vault, then change the config and restart; Vault will automatically use the new seal.

Backup the master key and restore it after changing the config.

How does auto unseal differ from manual unseal in Vault?

Manual unseal is more secure because it uses stronger encryption algorithms

Auto unseal requires more human intervention than manual unseal

Auto unseal automatically decrypts the master key using an external service, while manual unseal requires operators to enter unseal keys

Manual unseal uses a cloud KMS to decrypt the master key, while auto unseal uses Shamir keys

A Vault server is configured with auto unseal using AWS KMS. The operations team wants to add a second KMS key for redundancy in case the first key is compromised or rotated. What is the correct approach?

Use the 'awskms' seal with a multi-region KMS key; this provides redundancy across regions.

Create a second seal block in the config file with the second KMS key.

Switch to Shamir unseal and use the KMS as a backup.

Configure the seal block with a list of KMS keys; Vault will try each key in order during unseal.

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 3

Auto Unseal Vault VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 6–10

6foundation · easy
Which of the following is a supported unseal mechanism in Vault?
Select an answer first
7application · medium
A Vault cluster is using Shamir unseal with 5 shares and a threshold of 3. The organization wants to migrate to auto unseal using Azure Key Vault. What is the first step in this migration?
Select an answer first
8foundation · easy
How does auto unseal differ from manual unseal in Vault?
Select an answer first
9foundation · easy
Which configuration parameter is required in the seal block when using AWS KMS for auto unseal?
Select an answer first
10expert · hard
A Vault server is configured with auto unseal using AWS KMS. The operations team wants to add a second KMS key for redundancy in case the first key is compromised or rotated. What is the correct approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

Auto Unseal Vault VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

Which of the following is a supported unseal mechanism in Vault?

A Vault cluster is using Shamir unseal with 5 shares and a threshold of 3. The organization wants to migrate to auto unseal using Azure Key Vault. What is the first step in this migration?

How does auto unseal differ from manual unseal in Vault?

Which configuration parameter is required in the seal block when using AWS KMS for auto unseal?

A Vault server is configured with auto unseal using AWS KMS. The operations team wants to add a second KMS key for redundancy in case the first key is compromised or rotated. What is the correct approach?

Keep studying — Create a working Vault server configuration given a scenario