Monitor and Understand Vault Audit Logs VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of enabling audit logging in a Vault cluster?

   • ATo improve Vault performance by caching frequently requested secrets
   • BTo replace the need for Vault's built-in authentication methods
   • CTo automatically block unauthorized requests before they reach the storage backend
   • DTo provide a chronological record of requests and responses for security, compliance, and troubleshooting
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Vault cluster is configured with a file audit device. The administrator needs to ensure that audit logs are available for compliance even if the local disk fails. The organization has a SIEM that can receive logs over TCP. Which configuration best meets the requirement while minimizing administrative overhead?

   • AEnable a syslog audit device to send logs to the SIEM over TCP, and keep the file device for local retention.
   • BEnable a socket audit device to send logs to the SIEM over UDP, and keep the file device.
   • CEnable a file audit device on a network-attached storage (NAS) mount, and rely on the NAS for redundancy.
   • DEnable a socket audit device to send logs to the SIEM over TCP, and disable the file device.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Vault server has a file audit device writing to /var/log/vault/audit.log. The disk filled up overnight, causing Vault to stop responding. The administrator wants to prevent this recurrence while retaining logs for at least 90 days. Which approach should the administrator implement?

   • AEnable the audit device with the 'log_raw' option to reduce log size.
   • BSet the audit device to write to /dev/null to avoid disk usage.
   • CConfigure logrotate to rotate the audit log daily, compress rotated files, and keep 90 rotations.
   • DIncrease the disk size and set the audit device to write synchronously.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An administrator needs to find all audit log entries where a specific user attempted to read a secret at 'secret/data/myapp'. The audit logs are stored in a file. Which command would the administrator use to extract these entries?

   • Ajq 'select(.request.path == "secret/data/myapp")' /var/log/vault/audit.log
   • Bawk '/secret\/data\/myapp/ {print}' /var/log/vault/audit.log
   • Cgrep 'myapp' /var/log/vault/audit.log | grep 'user'
   • Dgrep 'secret/data/myapp' /var/log/vault/audit.log
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An administrator needs to identify all audit log entries where a user attempted to access a secret but was denied. The audit logs are in JSON format. Which command would most efficiently extract these entries?

   • Agrep 'denied' /var/log/vault/audit.log
   • Bjq 'select(.error != null)' /var/log/vault/audit.log
   • Cjq 'select(.request.path | contains("secret")) | select(.response.error != null)' /var/log/vault/audit.log
   • Djq 'select(.auth.display_name == "alice") | select(.request.path | contains("secret")) | select(.response.error != null)' /var/log/vault/audit.log
   Reveal Solution Discussion Select an answer first