Which command enables audit logging to a file in Vault?

`vault audit create file file_path=/var/log/vault_audit.log`

`vault audit enable file file_path=/var/log/vault_audit.log`

`vault audit add file path=/var/log/vault_audit.log`

What is the purpose of a performance standby node in Vault?

To store a backup of all secrets in a separate location

To provide read-only access to secrets and offload read traffic from the active node

To provide a separate API endpoint for administrative tasks

To automatically take over as the active node if the primary fails

What is the primary purpose of enabling audit logging in Vault?

To store secrets in a separate location

To improve performance by caching requests

To record all requests and responses for security monitoring

To automatically block malicious requests

What is the purpose of the seal/unseal mechanism in Vault?

To encrypt data at rest in the storage backend

To protect the master key by requiring multiple unseal keys to decrypt it

To authenticate users before they can access secrets

To encrypt network traffic between clients and the server

A Vault cluster is being deployed with a Shamir seal. The security policy requires that no single person can unseal the Vault alone, and that the unseal keys are stored securely offline. The administrator has generated 5 unseal keys with a threshold of 3. Which additional practice should be implemented to meet the policy?

Give all five unseal keys to the same person for convenience.

Distribute the unseal keys to five different trusted individuals and store them in separate physical safes.

Store all unseal keys in a single encrypted file on the same server as Vault.

Store the unseal keys in the Vault configuration file for easy access during unsealing.

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 2

Practice Production Hardening VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

13concepts

13 Concepts in This Objective

Production hardening principles
TLS configuration
Disabling dev mode
File storage backend
Seal and unseal configuration
Audit logging
Resource limits and system tuning
Environment variables and configuration files
High availability and performance standby
Backup and recovery procedures
Security groups and network policies
Operating system hardening
Monitoring and alerting

Questions 11–15

11foundation · easy
Which command enables audit logging to a file in Vault?
Select an answer first
12foundation · easy
What is the purpose of a performance standby node in Vault?
Select an answer first
13foundation · easy
What is the primary purpose of enabling audit logging in Vault?
Select an answer first
14foundation · easy
What is the purpose of the seal/unseal mechanism in Vault?
Select an answer first
15application · medium
A Vault cluster is being deployed with a Shamir seal. The security policy requires that no single person can unseal the Vault alone, and that the unseal keys are stored securely offline. The administrator has generated 5 unseal keys with a threshold of 3. Which additional practice should be implemented to meet the policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.