A Vault operator has completed the root token regeneration process and has the encoded token. The operator realizes that the OTP was lost. What should the operator do?

Revoke the old root token and use the encoded token as the new root token

Try to decode the token using a different OTP

Use the unseal keys to decode the token

Restart the root token regeneration process with a new OTP

A Vault administrator has successfully regenerated a new root token. The old root token is still active. What should the administrator do to maintain security?

Leave the old root token active as a backup

Re-seal the cluster to invalidate the old token

Revoke the old root token using vault token revoke

Rotate the unseal keys to invalidate the old token

A Vault cluster uses Shamir seals with 5 unseal keys and a threshold of 3. The root token has been compromised, and the security team needs to regenerate it. However, one of the unseal key holders is on vacation and cannot contribute their key. The remaining 4 holders are available. What should the team do?

Wait for the vacationing holder to return before proceeding

Re-generate the unseal keys to include the vacationing holder

Use the vacationing holder's key without their knowledge

Proceed with the 3 available unseal key holders to regenerate the root token

A Vault cluster has a threshold of 3 out of 5 unseal keys. During root token regeneration, the operator has contributed 2 unseal keys. What happens when the operator attempts to contribute a third unseal key?

The process completes and outputs the encoded root token

The process fails and requires restarting from the beginning

The process outputs a partial token that requires more keys

The process continues and requires all 5 unseal keys

A Vault operator is regenerating the root token. The operator has initialized the process with an OTP and has received a nonce. However, the operator accidentally ran 'vault operator generate-root -init' again with a different OTP. What is the impact of this action?

The operator can still use the old nonce with the new OTP

The previous process is cancelled, and a new process starts with the new OTP

The previous process continues, and the new OTP is ignored

The process is paused until the operator decides which OTP to use

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 7

Regenerate a Root Token VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

5concepts

Questions 6–10

6expert · medium
A Vault operator has completed the root token regeneration process and has the encoded token. The operator realizes that the OTP was lost. What should the operator do?
Select an answer first
7application · medium
A Vault administrator has successfully regenerated a new root token. The old root token is still active. What should the administrator do to maintain security?
Select an answer first
8expert · medium
A Vault cluster uses Shamir seals with 5 unseal keys and a threshold of 3. The root token has been compromised, and the security team needs to regenerate it. However, one of the unseal key holders is on vacation and cannot contribute their key. The remaining 4 holders are available. What should the team do?
Select an answer first
9application · medium
A Vault cluster has a threshold of 3 out of 5 unseal keys. During root token regeneration, the operator has contributed 2 unseal keys. What happens when the operator attempts to contribute a third unseal key?
Select an answer first
10expert · medium
A Vault operator is regenerating the root token. The operator has initialized the process with an OTP and has received a nonce. However, the operator accidentally ran 'vault operator generate-root -init' again with a different OTP. What is the impact of this action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.