Monitor and Understand Vault Audit Logs VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Vault administrator notices a spike in the 'vault.core.handle_request' metric. To determine whether this spike corresponds to legitimate user activity or a potential attack, which audit log analysis should the administrator perform?

   • ACount the number of audit log entries per second and compare with the metric spike.
   • BSearch for audit log entries with 'error' fields during the spike period.
   • CReview the 'auth' field in audit entries to identify which authentication methods were used.
   • DCheck the audit log entry for the 'time' field to see if timestamps align with the metric.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Vault cluster uses a file audit device. The administrator wants to ensure that audit logs are not lost if the disk becomes full. Which option should be configured on the audit device?

   • Alog_raw
   • Bformat
   • Cblock
   • Dprefix
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An administrator is troubleshooting a failed Vault operation. The audit log entry shows a 'response' object with an 'error' field, but the error message is not descriptive. Which additional field in the audit log entry should the administrator examine to gain more context?

   • Arequest.operation
   • Bauth.entity_id
   • Crequest.data
   • Drequest.client_token
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A compliance auditor requires evidence that all authentication attempts, including failed ones, are recorded. The Vault administrator has enabled a file audit device. Which audit log entry type should the administrator verify is present to satisfy the auditor?

   • AEntries with 'type': 'response' for every authentication attempt, including errors.
   • BEntries with 'type': 'error' for every failed authentication attempt.
   • CEntries with 'type': 'request' for every authentication attempt.
   • DEntries with 'type': 'auth' for every authentication attempt.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A user reports that they are unable to authenticate to Vault. The administrator checks the audit logs and finds no entries for the user's authentication attempt. Which of the following is the most likely cause?

   • AThe user's request is being blocked by a network firewall before reaching Vault.
   • BThe audit device is configured with 'log_raw=false', so authentication requests are not logged.
   • CThe user is using an incorrect authentication method.
   • DThe audit device is configured to filter out authentication requests.
   Reveal Solution Discussion Select an answer first