HashiCorp Vault Operations Professional Practice Exam

What the HashiCorp Vault Operations Professional exam covers

• Create a Working Vault Server Configuration150 questions
• Monitor a Vault Environment120 questions
• Employ the Vault Security Model150 questions
• Build Fault-Tolerant Vault Environments170 questions
• Harden Vault for Production110 questions
• Scale Vault for Performance112 questions

Free HashiCorp Vault Operations Professional sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 812.

1. Question 1Create a Working Vault Server Configuration

   You are writing a Vault server configuration file for a new Integrated Storage node. Which parameter inside the storage "raft" stanza is required and specifies the filesystem directory where Vault stores its Raft data?

   • Anode_id
   • BpathCorrect
   • Cretry_join
   • Dcluster_addr
   ✓ Correct answer: B

   The storage "raft" stanza requires path, the filesystem location where Vault writes the Raft log store and FSM snapshots (raft.db and the snapshots directory). Without it Vault cannot start because it has nowhere to persist cluster state.

   Why the other options are wrong

   • Anode_id is optional and identifies this server within the cluster, but it is not what stores data.
   • Cretry_join is optional and controls automatic cluster joining, not the data location.
   • Dcluster_addr is a top-level listener setting for cluster communication, not part of the storage stanza.
2. Question 2Create a Working Vault Server Configuration

   What does the disable_renewal field in a seal "transit" stanza control?

   • AWhether Vault automatically renews the token it uses to authenticate to the external transit clusterCorrect
   • BWhether the local barrier encryption key on this node is ever rotated automatically
   • CWhether the TLS certificates on the local listener are renewed on a schedule
   • DWhether the Raft storage snapshots are retained on disk after each renewal cycle
   ✓ Correct answer: A

   disable_renewal controls whether Vault attempts to renew the token configured for authenticating to the external Transit-backed unseal cluster. Leaving renewal enabled, the default, keeps that token alive for as long as the unsealing Vault instance runs, avoiding an unexpected auto-unseal failure when the token would otherwise expire.

   Why the other options are wrong

   • BBarrier key rotation is done with operator rotate, not the transit seal disable_renewal field.
   • CListener TLS renewal is unrelated to the transit seal authentication token.
   • DSnapshot retention is a backup setting and is not governed by disable_renewal.
3. Question 3Monitor a Vault EnvironmentSelect all that apply

   Which two statements correctly describe Vault's behavior when audit devices fail? (Choose TWO)

   • AIf every enabled audit device fails to log a request, Vault denies that request.Correct
   • BVault remains unsealed while blocking requests for audit failures; it does not reseal itself.Correct
   • CA request is blocked as soon as any single device fails, even if others are still healthy.
   • DAudit logging failures are recorded only in the operational log and never affect request processing.
   • EVault requires a full cluster restart before it will accept requests again after any audit failure.
   ✓ Correct answer: A, B

   The blocking behavior triggers only when all enabled audit devices fail together, and the cluster's seal state is not affected by this; a barrier reseal is a distinct event unrelated to audit health.

   Why the other options are wrong

   • CA single failing device out of several does not block requests, since others can still succeed.
   • DAudit failures directly gate request processing; they are not merely a passive log entry.
   • ENo restart is required; once a working audit device is restored or added, requests resume immediately.
4. Question 4Monitor a Vault Environment

   How does the purpose of GET /v1/sys/metrics differ from GET /v1/sys/health?

   • Asys/metrics feeds full telemetry to observability tooling, while sys/health gives a simple status code for LB checksCorrect
   • BThey are simply aliases, both returning the exact same JSON response body to any caller
   • Csys/health always requires a root token, while sys/metrics never requires any token at all
   • Dsys/metrics is only available in Vault Enterprise, while sys/health is available everywhere
   ✓ Correct answer: A

   sys/metrics is meant to feed dashboards and alerting pipelines with detailed counters, gauges, and timers, while sys/health is a fast, minimal endpoint whose HTTP status code alone conveys node state to a load balancer without needing to parse a body.

   Why the other options are wrong

   • BTheir response bodies and intended consumers are quite different; they are not interchangeable.
   • CNeither endpoint's default authentication requirement matches this description; sys/health is commonly unauthenticated by design, and sys/metrics is authenticated by default.
   • DBoth endpoints exist in Vault Community Edition as well as Enterprise.
5. Question 5Employ the Vault Security Model

   An operator sets `token_type = "batch"` on an AppRole role. A CI job authenticates and then attempts to renew the returned token before running a long build. What happens?

   • AThe renewal succeeds and extends the token's TTL by the requested increment
   • BThe renewal fails; batch tokens are not renewable and are issued with a fixed TTLCorrect
   • CThe renewal succeeds but resets the token to a periodic TTL automatically
   • DThe renewal fails only if the AppRole's secret ID has also expired
   ✓ Correct answer: B

   A batch token's lifetime is set once, at issuance, as the minimum of the requested TTL and the mount's allowed maximum, and it cannot be extended afterward. The CI job's renewal call is rejected regardless of how the job's secret ID or role is configured, since non-renewability is an inherent property of the batch token type.

   Why the other options are wrong

   • ARenewal is exactly the operation batch tokens cannot perform.
   • CNothing about a renewal attempt converts a batch token into a periodic one; the request is simply rejected.
   • DThe outcome does not depend on secret ID state; batch token renewal is unconditionally unsupported.
6. Question 6Employ the Vault Security Model

   Before consuming a wrapping token, an operator wants to confirm it is still valid and see when it was created and how much TTL remains, without actually revealing the wrapped secret data. Which capability supports this?

   • Asys/wrapping/lookupCorrect
   • Bvault unwrap, since it always previews metadata before returning data
   • Csys/wrapping/rewrap, which is required before any inspection is possible
   • Didentity/oidc/token, since wrapping tokens are validated the same way as identity tokens
   ✓ Correct answer: A

   This endpoint reports details such as creation_time and creation_ttl for a wrapping token, letting an operator confirm its validity and remaining lifetime without triggering the single-use consumption that vault unwrap would cause.

   Why the other options are wrong

   • Bvault unwrap directly consumes the token and returns the actual secret data; it does not offer a non-consuming preview.
   • CRewrap issues a brand-new wrapping token for the same data; it is not a prerequisite for simply inspecting an existing token's metadata.
   • DWrapping tokens and OIDC identity tokens are different objects validated through entirely different endpoints.
7. Question 7Build Fault-Tolerant Vault Environments

   An operator runs vault write -f sys/replication/dr/secondary/disable against a cluster that is currently a DR secondary. What is the effect?

   • AThe cluster stops replicating and becomes an independent standalone cluster with its own dataCorrect
   • BThe cluster is permanently deleted and must be reinstalled from scratch
   • CThe cluster is instantly promoted to become the new DR primary
   • DReplication pauses temporarily and resumes automatically after 24 hours
   ✓ Correct answer: A

   secondary/disable severs the replication relationship entirely. The cluster keeps whatever data it had replicated up to that point but no longer receives updates from the primary and now behaves as an independent Vault cluster that must be managed on its own.

   Why the other options are wrong

   • BDisabling replication does not destroy the cluster or its storage, the Vault process and data remain intact.
   • CDisable is not the same operation as promote, it removes the secondary role rather than elevating it.
   • DThere is no automatic resumption timer, re-establishing replication requires a fresh manual activation.
8. Question 8Build Fault-Tolerant Vault Environments

   Compliance requires that Vault never lose more than 30 minutes of committed data if the cluster's storage is destroyed and must be restored purely from an automated snapshot. What is the most direct configuration choice to meet this?

   • ASet the automated snapshot interval to 30 minutes or lessCorrect
   • BSet the retain value to at least 30, regardless of interval
   • CEnable DR replication instead, since snapshots cannot meet any RPO under 24 hours
   • DSet Autopilot's last_contact_threshold to 30 minutes
   ✓ Correct answer: A

   The interval between automated snapshots is what bounds the recovery point objective: a 30-minute or shorter interval means the worst-case data loss when restoring from the latest snapshot is roughly the interval length. Retention count only affects how many historical restore points you keep, not how fresh the newest one is.

   Why the other options are wrong

   • Bretain controls history depth, not how fresh the newest snapshot is
   • CSnapshots absolutely can meet a 30-minute RPO with an appropriately short interval; this assumption is false
   • DThis Autopilot setting governs Raft cluster membership health, not backup RPO
9. Question 9Harden Vault for Production

   Before starting a rolling upgrade, an operator needs to confirm which node is currently active so it can be upgraded last. Which command shows this?

   • Avault statusCorrect
   • Bvault operator usage
   • Cvault audit list
   • Dvault secrets list
   ✓ Correct answer: A

   Running vault status against a given node returns its HA mode (active or standby) along with seal state and version, which is exactly the information needed to plan an upgrade order that leaves the active node for last.

   Why the other options are wrong

   • Bvault operator usage reports Enterprise client usage counters, not leader/standby role.
   • Cvault audit list enumerates enabled audit devices and says nothing about cluster leadership.
   • Dvault secrets list enumerates enabled secrets engines and is unrelated to HA role.
10. Question 10Scale Vault for Performance

    A client connects to a performance standby node and issues a write. Compared to a client that connects directly to the active node for the same write, what is different?

    • ANothing at all is different; Vault always internally load-balances every write across all cluster nodes
    • BThe write is rejected outright, since standby nodes are only able to forward reads, never writes
    • CThe write takes an extra hop, forwarded from the standby to the active node over the internal RPC, adding a little latencyCorrect
    • DThe write is queued locally on the standby node and later applied to storage as part of a background batch job
    ✓ Correct answer: C

    Any standby, performance standby or plain, forwards writes to the active node over Vault's internal request-forwarding RPC, which adds a small extra network hop and latency compared to a client that writes directly against the active node. The write itself is processed identically once it reaches the active node; only the path to get there differs.

    Why the other options are wrong

    • AWrites are not internally load-balanced; they are always funneled to the single active node, whichever node first receives them
    • BStandby nodes forward writes just fine; they do not reject them outright
    • DThere is no local queue-and-batch step on the standby; the write is forwarded immediately, not deferred

Related HashiCorp resources

• HashiCorp Vault Operations Professional study guideKey concepts
• HashiCorp practice examsAll HashiCorp
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• HashiCorp Terraform Associate (004) practice examRelated
• HashiCorp Vault Associate (003) practice examRelated

HashiCorp Vault Operations Professional practice exam FAQ