Practice Secure Vault Initialization VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Vault operator is troubleshooting a cluster that is not responding. The `vault status` command returns an error. What is the most likely cause?

   • AVault is not running or the API address is unreachable
   • BVault is sealed and cannot respond to status requests
   • CVault is not initialized and cannot respond to status requests
   • DThe root token has expired
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational corporation is deploying Vault across three data centers. The security team requires that Vault can be unsealed even if one entire data center is unavailable, but no single data center should have enough key shares to unseal alone. Each data center has 3 operators. What is the minimum key threshold that satisfies these constraints?

   • A4
   • B6
   • C7
   • D3
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A Vault administrator is running `vault operator init` and wants to capture the output in a structured format for automated processing. Which flag should be used?

   • A-output-format=json
   • B-json
   • C-output=json
   • D-format=json
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is it recommended to use Shamir's Secret Sharing when initializing Vault?

   • AIt encrypts the unseal keys so they can be safely stored in the Vault configuration file.
   • BIt generates a new unseal key each time Vault is restarted, improving security.
   • CIt allows a single person to unseal Vault quickly without needing to coordinate with others.
   • DIt splits the unseal key into multiple shares, requiring a threshold of shares to reconstruct the key and unseal Vault.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization is setting up Vault for the first time. The security team requires that the root token be immediately revoked after initialization and that unseal keys be generated with a threshold of 4 out of 7. The administrator runs the initialization command. What is the correct next step after capturing the output?

   • AStore the root token in a secure location and revoke it after creating a new admin token
   • BImmediately revoke the root token using `vault token revoke -self`
   • CDelete the root token from the output and proceed with unsealing
   • DRevoke the root token using `vault token revoke root`
   Reveal Solution Discussion Select an answer first