Auto Unseal Vault VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is required to configure transit auto unseal in Vault?

   • AA database backend to store the master key
   • BA cloud KMS service with a customer-managed key
   • CA Shamir secret sharing scheme with a threshold of shares
   • DA transit engine enabled on another Vault cluster with a dedicated encryption key
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which command can be used to check the seal status of a Vault server?

   • Avault operator init -status
   • Bvault status
   • Cvault unseal -check
   • Dvault seal-status
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which seal type is used to configure transit auto unseal in Vault's configuration file?

   • Agcpckms
   • Bazurekeyvault
   • Cawskms
   • Dtransit
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the role of a cloud KMS in Vault's auto unseal?

   • AIt provides a secure enclave to run Vault's encryption operations
   • BIt authenticates users before allowing them to unseal Vault
   • CIt encrypts and decrypts the master key using a customer-managed key
   • DIt stores the master key in plaintext for quick access
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Vault cluster is using Shamir unseal with 5 key shares and a threshold of 3. The organization wants to reduce operational overhead but cannot use any cloud KMS due to regulatory constraints. Which approach is the most appropriate?

   • AUse the Vault UI to automate unsealing with a stored key share.
   • BReduce the threshold to 1 and store the single key share in a password manager.
   • CSwitch to a single Shamir key share and use a scheduled job to unseal automatically.
   • DUse a transit engine on a separate Vault cluster for auto unseal.
   Reveal Solution Discussion Select an answer first