Skip to content
Cheat sheets

003 · Domain 8: Vault deployment architecture · 12% of the exam

Task 8.4: Explain the uses of disaster recovery and performance replication

Vault Enterprise replication: DR secondaries that mirror tokens and leases but serve no clients, performance secondaries that serve reads with their own tokens, local mounts and paths filters.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 2

A Vault Enterprise primary cluster replicates to a disaster recovery (DR) secondary. Which two statements about the DR secondary are true? (Choose TWO.)

  1. AIt serves read requests for clients near it
  2. BIt keeps track of its own tokens and leases
  3. CIt does not receive the primary's local mounts
  4. DIt mirrors the primary's tokens and leases
  5. EIt does not serve client requests until it is promoted
Show the answer and why

  • AIt serves read requests for clients near it

    Incorrect

    Serving client requests is what performance secondaries do.

  • BIt keeps track of its own tokens and leases

    Incorrect

    That describes performance secondaries; DR mirrors the primary's.

  • CIt does not receive the primary's local mounts

    Incorrect

    Local mounts, unlike with performance replication, are replicated to DR secondaries.

  • DIt mirrors the primary's tokens and leases

    Correct

    DR secondaries share the token and lease infrastructure, so applications continue after a promotion.

  • EIt does not serve client requests until it is promoted

    Correct

    DR secondaries do not handle reads or writes until they become a primary.

DR replication is a warm standby of everything; performance replication scales reads with secondaries that issue their own tokens.

HashiCorp documentation

Task 8.4Report a problem with this question

Question 2 · choose 1

A Vault Enterprise primary runs in the EU. Applications in the US need a nearby cluster that answers their requests, but the mount eu-customers must never be copied outside the EU. Which design fits?

  1. AA DR secondary in the US, since DR replicates only configuration
  2. BA performance secondary in the US, relying on its own token and lease store to keep eu-customers local
  3. CA performance secondary in the US with a paths filter that excludes eu-customers
  4. DPerformance standby nodes in the US for the EU cluster
Show the answer and why

  • AA DR secondary in the US, since DR replicates only configuration

    Incorrect

    DR secondaries copy everything and serve no clients until promoted.

  • BA performance secondary in the US, relying on its own token and lease store to keep eu-customers local

    Incorrect

    Secondaries keep their own tokens and leases, but shared mount data such as KV values is still replicated.

  • CA performance secondary in the US with a paths filter that excludes eu-customers

    Correct

    A performance secondary serves local clients, and a paths filter keeps chosen mounts from being replicated to it.

  • DPerformance standby nodes in the US for the EU cluster

    Incorrect

    Standbys are nodes of the same cluster and hold the same data, eu-customers included.

A performance secondary serves nearby clients, and a paths filter keeps chosen mounts off it for data-residency needs.

HashiCorp documentation

Task 8.4Report a problem with this question

Question 3 · choose 1

A client connected to a Vault Enterprise performance secondary writes a new KV secret. What happens?

  1. AThe secondary rejects it, since secondaries are read-only
  2. BThe secondary passes it to the primary transparently
  3. CThe write stays local to the secondary
  4. DThe client must resend it to the primary
Show the answer and why

  • AThe secondary rejects it, since secondaries are read-only

    Incorrect

    Writes are forwarded, not rejected.

  • BThe secondary passes it to the primary transparently

    Correct

    If an action would modify shared state, the secondary forwards it to the primary.

  • CThe write stays local to the secondary

    Incorrect

    Shared KV data is owned by the primary.

  • DThe client must resend it to the primary

    Incorrect

    Forwarding is transparent to the client.

Forwarding keeps the primary as the single writer of shared data while clients use their nearest cluster.

HashiCorp documentation

Task 8.4Report a problem with this question

Question 4 · choose 1

A Vault Enterprise team set up automated integrated storage snapshots on its performance replication primary. What must it do for the performance secondary cluster?

  1. ASet up its own automated snapshot configuration on the secondary cluster
  2. BNothing; the snapshot configuration and files replicate to the secondary
  3. CNothing until a promotion, which copies the primary's snapshots over
  4. DPoint the secondary's restore path at the primary's snapshot storage
Show the answer and why

  • ASet up its own automated snapshot configuration on the secondary cluster

    Correct

    Each primary and secondary performance cluster must be configured explicitly to create its own automated snapshots.

  • BNothing; the snapshot configuration and files replicate to the secondary

    Incorrect

    Automated integrated storage snapshots are not replicated as part of performance replication.

  • CNothing until a promotion, which copies the primary's snapshots over

    Incorrect

    Promotion does not copy snapshots; the secondary needs its own configuration.

  • DPoint the secondary's restore path at the primary's snapshot storage

    Incorrect

    Nothing replicates the snapshot set-up; each cluster schedules its own snapshots.

Performance secondaries share configuration and most secrets with the primary, but automated integrated storage snapshots are configured per cluster.

HashiCorp documentation

Task 8.4Report a problem with this question

Question 5 · choose 1

Which storage backends support Vault Enterprise replication?

  1. AAny backend at all, since replication works above storage
  2. BOnly the file backend, for simple copying
  3. COnly in-memory storage, for speed
  4. DThose with transactional updates, like Raft or Consul
Show the answer and why

  • AAny backend at all, since replication works above storage

    Incorrect

    The backend must support transactional updates.

  • BOnly the file backend, for simple copying

    Incorrect

    The file backend is not listed for replication.

  • COnly in-memory storage, for speed

    Incorrect

    In-memory storage keeps no durable data.

  • DThose with transactional updates, like Raft or Consul

    Correct

    Replication requires a storage backend that supports transactional updates.

Primary and secondary need not use the same backend, but each must support transactions.

HashiCorp documentation

Task 8.4Report a problem with this question

Question 6 · choose 1

A team upgrades a replicated Vault Enterprise deployment. Can a secondary run a newer version than the primary for a while?

  1. ANo; both must be upgraded at the same instant
  2. BYes, indefinitely, since versions are independent
  3. CYes, during the upgrade window, but not for long
  4. DOnly the primary may run the newer version
Show the answer and why

  • ANo; both must be upgraded at the same instant

    Incorrect

    Upgrade instructions allow the secondary to go first.

  • BYes, indefinitely, since versions are independent

    Incorrect

    Mixed versions are not recommended beyond the upgrade.

  • CYes, during the upgrade window, but not for long

    Correct

    A secondary can run a newer version than its primary; mixed versions should not last.

  • DOnly the primary may run the newer version

    Incorrect

    It is the secondary that can be newer.

Upgrade secondaries first, then the primary, and keep the window short.

HashiCorp documentation

Task 8.4Report a problem with this question

Practice domain 8 →Practice all domains →