Auto Unseal Vault VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When configuring auto unseal with Azure Key Vault, which parameters must be specified in the seal block?

   • Atenant_id, client_id, client_secret, vault_name, key_name
   • Bproject_id, location, key_ring, crypto_key
   • Caccess_key, secret_key, region, kms_key_id
   • Daddress, token, mount_path, key_name
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Vault server configured with AWS KMS auto unseal was working, but after a reboot it fails to start and logs show: 'error during seal configuration: failed to decrypt: AccessDeniedException'. The IAM role attached to the EC2 instance has permission to use the KMS key. What is the most likely cause and fix?

   • AThe KMS key was deleted; restore the key from AWS backup.
   • BThe IAM role's trust policy does not allow the EC2 service to assume it; update the trust policy.
   • CThe KMS key policy does not grant the IAM role the kms:Decrypt permission; update the key policy.
   • DThe Vault config file has the wrong region; change the region to the one where the KMS key resides.
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A Vault server is configured with auto unseal using AWS KMS. The administrator wants to test the auto unseal by sealing and unsealing the server. Which command sequence should be used?

   • ARun 'vault operator unseal' twice to seal and unseal.
   • BRun 'vault status' to seal, then 'vault operator unseal' to unseal.
   • CRestart the Vault service to seal, then run 'vault operator unseal'.
   • DRun 'vault operator seal' to seal, then 'vault operator unseal' to unseal.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of Vault's auto unseal feature?

   • ATo automatically rotate the root token after a defined interval
   • BTo automatically replicate data to a secondary cluster for disaster recovery
   • CTo automatically decrypt the master key using an external service, allowing Vault to unseal without manual intervention
   • DTo automatically back up the seal configuration to a remote location
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization has a primary Vault cluster and a separate Vault cluster used solely for auto unseal. The transit engine is enabled on the secondary cluster with a key named 'unseal-key'. The primary cluster's config file has the seal block set to transit. Which additional configuration is required on the primary cluster to complete the auto unseal setup?

   • AProvide the address of the secondary cluster and the key name; the token is inherited from the primary cluster's root token.
   • BOnly set the key name; the secondary cluster address is read from the primary cluster's storage backend configuration.
   • CProvide the address and token for the secondary Vault cluster, and set the key name in the seal block.
   • DSet the key name and the mount path to 'transit/' in the seal block; the address is auto-discovered via service discovery.
   Reveal Solution Discussion Select an answer first