Why should Vault be run as a dedicated non-root user?

To allow Vault to access all files on the system

To enable Vault to bind to privileged ports

To limit the privileges of the Vault process in case it is compromised

To simplify the configuration file

A Vault server is running on a Linux VM. The security team has mandated that the OS be hardened. Which of the following actions is part of OS hardening?

Allow all users to run sudo without a password for convenience.

Disable unnecessary services and remove unused software packages from the server.

Keep the default firewall rules and do not modify them.

Enable SSH password authentication for easier remote access.

In a Vault server configuration file, which settings are used to specify the TLS certificate and key?

`tls_cert_file` and `tls_key_file`

`tls_certificate` and `tls_key`

`certificate` and `private_key`

A Vault administrator is documenting the backup and recovery procedures for a production Vault cluster. Which statement correctly describes a best practice for protecting against data loss?

Take a snapshot of the storage backend while Vault is unsealed, and keep the unseal keys with the backup for convenience.

Use Vault's built-in 'vault operator backup' command to create an encrypted backup of all secrets and policies.

Rely on replication to a secondary cluster as the sole backup method, since replicated data is always available for recovery.

Back up the storage backend while Vault is sealed, and store unseal keys and root tokens in a secure location separate from the backup.

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 2

Practice Production Hardening VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

13concepts

13 Concepts in This Objective

Production hardening principles
TLS configuration
Disabling dev mode
File storage backend
Seal and unseal configuration
Audit logging
Resource limits and system tuning
Environment variables and configuration files
High availability and performance standby
Backup and recovery procedures
Security groups and network policies
Operating system hardening
Monitoring and alerting

Questions 26–29

26foundation · easy
Why should Vault be run as a dedicated non-root user?
Select an answer first
27application · medium
A Vault server is running on a Linux VM. The security team has mandated that the OS be hardened. Which of the following actions is part of OS hardening?
Select an answer first
28foundation · easy
In a Vault server configuration file, which settings are used to specify the TLS certificate and key?
Select an answer first
29foundation · medium
A Vault administrator is documenting the backup and recovery procedures for a production Vault cluster. Which statement correctly describes a best practice for protecting against data loss?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.