Certifications / Vault Associate 003 · Domain 8: Vault deployment architecture · 12% of the exam
Key shares and threshold at init, PGP-encrypted shares, rekeying, operations that need a quorum of key holders, and recovery keys with auto unseal.
Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.
Question 1 · choose 1
A new cluster uses the Shamir seal. Five officers must each hold one unseal key share, any three of them must be needed to unseal, and the operator running the initialization must not see any share in plaintext. Which command meets this? A vault operator init -key-shares=5 -key-threshold=3B vault operator init -key-shares=5 -key-threshold=3 -root-token-pgp-key=<an officer's public key>C vault operator init -recovery-shares=5 -recovery-threshold=3 -recovery-pgp-keys=<five keys>D vault operator init -key-shares=5 -key-threshold=3 -pgp-keys=<five public keys>Show the answer and why A vault operator init -key-shares=5 -key-threshold=3
Incorrect
Without PGP keys the shares are printed in plaintext to the operator.
B vault operator init -key-shares=5 -key-threshold=3 -root-token-pgp-key=<an officer's public key>
Incorrect
That encrypts only the initial root token; the unseal key shares are still printed in plaintext.
C vault operator init -recovery-shares=5 -recovery-threshold=3 -recovery-pgp-keys=<five keys>
Incorrect
Recovery shares apply to auto unseal; a Shamir seal is split with the key share flags.
D vault operator init -key-shares=5 -key-threshold=3 -pgp-keys=<five public keys>
Correct
The shares are split five ways with a threshold of three, and each is encrypted to one officer's PGP key so the operator sees only ciphertext.
Shamir's secret sharing splits the key into shares and a threshold; -pgp-keys encrypts each share at initialization.
Question 2 · choose 1
An operator runs vault operator init with no share options on a cluster with a Shamir seal. How is the key split? A 3 shares, all of which are neededB 1 share, since sharing is optionalC 5 shares, any 3 of which unseal VaultD 5 shares, all of which are neededShow the answer and why A 3 shares, all of which are needed
Incorrect
The default is five shares with a threshold of three.
B 1 share, since sharing is optional
Incorrect
Vault splits the key by default.
C 5 shares, any 3 of which unseal Vault
Correct
The defaults are -key-shares=5 and -key-threshold=3.
D 5 shares, all of which are needed
Incorrect
Only three of the five are required by default.
Choose the split to match how many trusted holders exist and how many must agree.
Question 3 · choose 1
Two of five key holders are leaving the company, and the team wants a new split of seven shares with a threshold of four. Which operation does that? A vault operator rotateB vault operator init again with the new valuesC vault operator generate-rootD vault operator rekey with -key-shares=7 -key-threshold=4Show the answer and why A vault operator rotate
Incorrect
rotate changes the data encryption key, not the shares.
B vault operator init again with the new values
Incorrect
A cluster is initialized only once.
C vault operator generate-root
Incorrect
It does not change the key split.
D vault operator rekey with -key-shares=7 -key-threshold=4
Correct
Rekeying generates a new root key and new unseal shares with the configured split, authorized by the current threshold.
Rekey after holders change, and distribute the new shares, encrypted with PGP if needed.
Question 4 · choose 1
A key holder asks whether their unseal key share lets them read secrets if the root token is lost. What is the answer? A No; shares serve unsealing only, never ordinary requestsB Yes; a share works as a read-only token once Vault is unsealedC Yes, once the threshold of holders logs in togetherD Only if the share was PGP-encrypted at initShow the answer and why A No; shares serve unsealing only, never ordinary requests
Correct
The shares are not useful for making any requests to Vault and can only be used for unsealing.
B Yes; a share works as a read-only token once Vault is unsealed
Incorrect
Shares are not tokens.
C Yes, once the threshold of holders logs in together
Incorrect
Shares do not log anyone in, however many holders act together.
D Only if the share was PGP-encrypted at init
Incorrect
Encryption at init protects the share; it gives it no new power.
Secret sharing avoids trusting one holder with the root key; normal ACLs govern every request after unsealing.
Question 5 · choose 1
A cluster uses AWS KMS auto unseal, and the KMS key becomes unavailable. Can the holders of the recovery keys unseal Vault? A Yes; recovery keys act as Shamir shares in an emergencyB No; recovery keys cannot decrypt the root keyC Yes, after switching the seal stanza to shamirD Yes, with vault operator unseal -recoveryShow the answer and why A Yes; recovery keys act as Shamir shares in an emergency
Incorrect
With auto unseal, recovery keys cannot stand in for the seal.
B No; recovery keys cannot decrypt the root key
Correct
Recovery keys are not sufficient to unseal Vault if the auto unseal mechanism is not working.
C Yes, after switching the seal stanza to shamir
Incorrect
Migration needs the old seal to be available.
D Yes, with vault operator unseal -recovery
Incorrect
No flag turns recovery keys into unseal keys.
Auto unseal creates a hard dependency on the KMS key: protect it and plan for its availability.
Practice domain 8 → Practice all domains →
← Task 8.2 Task 8.4 →