Skip to content
Cheat sheets

003 · Domain 8: Vault deployment architecture · 12% of the exam

Task 8.2: Explain the uses of storage backends

Integrated storage as the recommended backend, Consul and other external storage, development-only backends, high availability, and migrating between backends.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A team needs a storage backend for a production Vault cluster that supports high availability, is supported by HashiCorp, keeps data across restarts, and does not require operating a separate storage cluster. Which backend fits?

  1. AIntegrated storage (Raft)
  2. BConsul storage
  3. CFile system storage
  4. DIn-memory storage
Show the answer and why

  • AIntegrated storage (Raft)

    Correct

    It supports high availability, is HashiCorp supported and recommended, and needs no other system to operate.

  • BConsul storage

    Incorrect

    Consul supports HA and is supported, but it is another cluster to deploy and operate.

  • CFile system storage

    Incorrect

    The filesystem backend does not support high availability.

  • DIn-memory storage

    Incorrect

    In-memory storage loses all data when Vault restarts.

HashiCorp recommends integrated storage for most deployments; HCP Vault Dedicated uses it too.

HashiCorp documentation

Task 8.2Report a problem with this question

Question 2 · choose 1

A Vault Community Edition cluster stores its data in Consul. The team wants to move to integrated storage, keeping all existing data, and can accept a maintenance window. How is the data moved?

  1. AStop Vault and run vault operator migrate with consul as storage_source and raft as storage_destination
  2. BChange the storage stanza to raft and restart Vault, which copies the existing Consul data on its first start
  3. CSave a snapshot with vault operator raft snapshot save and restore it on the new cluster
  4. DSet up DR replication to a new integrated storage cluster and promote it
Show the answer and why

  • AStop Vault and run vault operator migrate with consul as storage_source and raft as storage_destination

    Correct

    operator migrate copies data between backends at the storage level and is meant to run offline.

  • BChange the storage stanza to raft and restart Vault, which copies the existing Consul data on its first start

    Incorrect

    Vault does not copy data when the stanza changes; it would start on an empty backend.

  • CSave a snapshot with vault operator raft snapshot save and restore it on the new cluster

    Incorrect

    Raft snapshots exist only for integrated storage, so a Consul-backed cluster cannot produce one.

  • DSet up DR replication to a new integrated storage cluster and promote it

    Incorrect

    Replication needs Vault Enterprise, which the cluster does not run.

Storage migration is an offline copy of encrypted entries from one backend to another with operator migrate; nothing is decrypted on the way.

HashiCorp documentation

Task 8.2Report a problem with this question

Question 3 · choose 1

Comparing integrated storage with the Consul backend, how does the location of the data affect backups?

  1. AConsul holds everything in memory and needs more frequent snapshots
  2. BIntegrated storage holds data only in memory and needs frequent snapshots
  3. CBoth Consul and Raft write data to Vault's in-memory cache only
  4. DNeither needs backups, because Raft replicates every entry
Show the answer and why

  • AConsul holds everything in memory and needs more frequent snapshots

    Correct

    Integrated Storage data is on disk; Consul's is all in memory, which calls for more frequent snapshots.

  • BIntegrated storage holds data only in memory and needs frequent snapshots

    Incorrect

    Integrated storage persists data on disk.

  • CBoth Consul and Raft write data to Vault's in-memory cache only

    Incorrect

    Both backends persist data.

  • DNeither needs backups, because Raft replicates every entry

    Incorrect

    Replication within a cluster is not a backup.

Backup plans follow the backend: normal backups for integrated storage, frequent snapshots for Consul.

HashiCorp documentation

Task 8.2Report a problem with this question

Question 4 · choose 1

A company already runs Consul for service discovery and wants to use the same Consul cluster as Vault's storage backend. What does HashiCorp recommend?

  1. ASharing it is preferred, because one cluster is easier to run
  2. BSharing it is fine if Vault uses its own KV prefix
  3. CA separate Consul cluster dedicated to Vault storage
  4. DConsul cannot be used for Vault storage any longer
Show the answer and why

  • ASharing it is preferred, because one cluster is easier to run

    Incorrect

    The guidance is a dedicated cluster for Vault.

  • BSharing it is fine if Vault uses its own KV prefix

    Incorrect

    A separate prefix does not meet the dedicated-cluster guidance.

  • CA separate Consul cluster dedicated to Vault storage

    Correct

    Use a dedicated Consul cluster for Vault storage, not for service discovery or service mesh.

  • DConsul cannot be used for Vault storage any longer

    Incorrect

    Consul remains an officially supported backend.

External storage means a second system to run and monitor; keep it isolated for Vault.

HashiCorp documentation

Task 8.2Report a problem with this question

Question 5 · choose 1

Which settings does a node's integrated storage configuration typically need?

  1. Astorage "raft" with address and token, pointing at the cluster leader
  2. Bstorage "raft" with path and node_id, plus cluster_addr in the server config
  3. Cstorage "inmem" with node_id, which persists to disk on shutdown
  4. Dstorage "file" with path, which becomes Raft when several nodes share it
Show the answer and why

  • Astorage "raft" with address and token, pointing at the cluster leader

    Incorrect

    Those are Consul-style settings; Raft stores data locally.

  • Bstorage "raft" with path and node_id, plus cluster_addr in the server config

    Correct

    path is where the node stores its data, node_id names it in the cluster, and cluster_addr carries node traffic.

  • Cstorage "inmem" with node_id, which persists to disk on shutdown

    Incorrect

    In-memory storage never persists data.

  • Dstorage "file" with path, which becomes Raft when several nodes share it

    Incorrect

    The file backend has no HA and does not turn into Raft.

node_id must be unique in the cluster, and cluster_addr carries the traffic between nodes.

HashiCorp documentation

Task 8.2Report a problem with this question

Question 6 · choose 1

A team is choosing virtual machine types for a five-node integrated storage cluster. Which hardware guidance does HashiCorp give for integrated storage?

  1. ASpinning disks are preferred, since Raft writes its log sequentially
  2. BDisk type does not matter if each node has plenty of RAM
  3. CBurstable instances suit Vault, since the cluster is idle most of the time
  4. DSSD drives, and no burstable CPU or storage options for the nodes
Show the answer and why

  • ASpinning disks are preferred, since Raft writes its log sequentially

    Incorrect

    The guidance calls for SSDs, not spinning disks.

  • BDisk type does not matter if each node has plenty of RAM

    Incorrect

    The guidance names SSDs for the drives; memory alone does not satisfy it.

  • CBurstable instances suit Vault, since the cluster is idle most of the time

    Incorrect

    HashiCorp advises against burstable CPU and storage for integrated storage.

  • DSSD drives, and no burstable CPU or storage options for the nodes

    Correct

    The storage comparison tells integrated storage users to avoid burstable CPU and storage options and to use SSDs.

Integrated storage runs Raft on every Vault node, so each node needs predictable CPU and fast disks; the reference architecture gives the sizing details.

HashiCorp documentation

Task 8.2Report a problem with this question

Practice domain 8 →Practice all domains →