Monitor and Understand Vault Operational Logs VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A Vault administrator is investigating a security incident where a user may have accessed a secret. The administrator has access to the audit logs, but the operational logs for the same time period are missing. Which action should the administrator take to preserve evidence and ensure a complete picture?

   • ARely solely on the audit logs for the investigation
   • BReconstruct the operational logs from the audit logs
   • CCheck if the operational logs were shipped to a centralized log aggregator
   • DIgnore the missing logs and proceed with the audit logs only
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Vault cluster is running in HA mode with three nodes. The operational logs on the active node show repeated 'failed to acquire lock' messages. Clients are still able to read secrets, but writes are failing intermittently. Which issue is most likely indicated by these logs?

   • AIncorrect unseal keys
   • BNetwork partition between nodes
   • CAudit log device failure
   • DStorage backend lock contention
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can an operator increase Vault's log verbosity without restarting the server?

   • AUse the vault debug command
   • BSet the VAULT_LOG_LEVEL environment variable
   • CSend a SIGUSR1 signal to the Vault process
   • DModify the log_level in the configuration file
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of the timestamp field in a Vault log entry?

   • ATo indicate the log level
   • BTo record when the event occurred
   • CTo store the log message
   • DTo identify the Vault node
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security incident response team is investigating a potential data breach. They have audit logs showing that a specific token was used to read a large number of secrets in a short time. The operational logs show that the Vault node was restarted during the same time period. Which conclusion can be drawn from correlating these logs?

   • AThe token was used to unseal the Vault
   • BThe audit logs are unreliable because of the restart
   • CThe restart caused the token to be revoked
   • DThe restart may have been caused by the high load from the secret reads
   Reveal Solution Discussion Select an answer first