Which command is used to revoke the old root token after regenerating a new one?

vault operator generate-root -cancel

A Vault cluster uses Shamir seals with 5 unseal keys and a threshold of 3. The root token has been compromised. The security team wants to regenerate the root token. What is the first step in the regeneration workflow?

Unseal the cluster using the unseal keys

Generate an OTP and initialize the generate-root process

Revoke the compromised root token immediately

Collect all 5 unseal keys from the holders

What is the first step an operator must take to regenerate a root token for a Vault cluster that is currently unsealed?

Generate a one-time password (OTP) to be used during the process.

Seal the Vault cluster to ensure a clean state.

Restart the Vault server to reset internal state.

Revoke the existing root token to prevent conflicts.

A Vault cluster has 7 unseal keys with a threshold of 4. During root token regeneration, the operator has collected 4 unseal keys. What is the next step?

Contribute the 4 unseal keys to complete the process

Collect all 7 unseal keys before contributing

Contribute the keys in any order

Decode the token before contributing the keys

A Vault cluster has 5 unseal keys with a threshold of 3. During root token regeneration, the operator has contributed 2 unseal keys. The operator then realizes that one of the contributed keys was incorrect (a typo). What should the operator do?

Use the incorrect key to decode the final token

Continue contributing the remaining keys; the incorrect key will not affect the process

Cancel the process and restart from the beginning

Contribute the correct key again to overwrite the incorrect one

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 7

Regenerate a Root Token VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

5concepts

Questions 11–15

11foundation · easy
Which command is used to revoke the old root token after regenerating a new one?
Select an answer first
12application · medium
A Vault cluster uses Shamir seals with 5 unseal keys and a threshold of 3. The root token has been compromised. The security team wants to regenerate the root token. What is the first step in the regeneration workflow?
Select an answer first
13foundation · easy
What is the first step an operator must take to regenerate a root token for a Vault cluster that is currently unsealed?
Select an answer first
14application · medium
A Vault cluster has 7 unseal keys with a threshold of 4. During root token regeneration, the operator has collected 4 unseal keys. What is the next step?
Select an answer first
15expert · medium
A Vault cluster has 5 unseal keys with a threshold of 3. During root token regeneration, the operator has contributed 2 unseal keys. The operator then realizes that one of the contributed keys was incorrect (a typo). What should the operator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.