Skip to content
Cheat sheets

003 · Domain 8: Vault deployment architecture · 12% of the exam

Task 8.5: Differentiate between self-managed and HashiCorp-managed Vault clusters

Who runs upgrades, storage, seals and backups, the admin namespace and admin token in HCP Vault Dedicated, and features only one side offers.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A bank must auto-unseal Vault with its own on-premises HSM and use seal wrapping to meet FIPS 140 requirements. The security team accepts running the cluster itself. Which deployment meets these requirements?

  1. ASelf-managed Vault Enterprise using the bank's HSM as its seal
  2. BHCP Vault Dedicated configured with the bank's HSM as its seal
  3. CSelf-managed Vault Community Edition with the pkcs11 seal
  4. DHCP Vault Dedicated with its managed KMS auto-unseal and seal wrap
Show the answer and why

  • ASelf-managed Vault Enterprise using the bank's HSM as its seal

    Correct

    HSM auto-unseal and seal wrapping are Vault Enterprise features available when you run the cluster.

  • BHCP Vault Dedicated configured with the bank's HSM as its seal

    Incorrect

    HashiCorp manages the seal on HCP Vault Dedicated, and HSM auto-unseal is not offered there.

  • CSelf-managed Vault Community Edition with the pkcs11 seal

    Incorrect

    The pkcs11 seal and seal wrapping require Vault Enterprise.

  • DHCP Vault Dedicated with its managed KMS auto-unseal and seal wrap

    Incorrect

    HCP Vault Dedicated does not offer FIPS 140-2 seal wrap.

On HCP Vault Dedicated HashiCorp manages the seal, and a few features, such as HSM auto-unseal and FIPS seal wrap, remain self-managed only.

HashiCorp documentation

Task 8.5Report a problem with this question

Question 2 · choose 1

Who upgrades Vault versions on HCP Vault Dedicated compared with a self-managed cluster?

  1. AThe customer upgrades both, through the HCP Portal
  2. BNeither cluster is upgraded in place; new versions need new clusters
  3. CHashiCorp upgrades both when licensed
  4. DHashiCorp for HCP; the operators for their own clusters
Show the answer and why

  • AThe customer upgrades both, through the HCP Portal

    Incorrect

    HCP upgrades are automatic.

  • BNeither cluster is upgraded in place; new versions need new clusters

    Incorrect

    Both can be upgraded in place.

  • CHashiCorp upgrades both when licensed

    Incorrect

    Self-managed clusters are upgraded by their operators.

  • DHashiCorp for HCP; the operators for their own clusters

    Correct

    Minor and major versions are upgraded automatically on HCP Vault Dedicated.

Version management is one of the operational tasks that HCP takes off the customer.

HashiCorp documentation

Task 8.5Report a problem with this question

Question 3 · choose 1

How does an administrator get initial privileged access to HCP Vault Dedicated compared with a self-managed cluster?

  1. Avault operator init on the HCP cluster prints a root token
  2. BAn admin token from the HCP Portal, valid for 6 hours
  3. CHashiCorp support emails a root token on request
  4. DThe unseal keys downloaded from the portal are used to log in
Show the answer and why

  • Avault operator init on the HCP cluster prints a root token

    Incorrect

    HCP clusters are initialized by HashiCorp.

  • BAn admin token from the HCP Portal, valid for 6 hours

    Correct

    On HCP the portal issues a 6-hour admin token; self-managed init generates a root token.

  • CHashiCorp support emails a root token on request

    Incorrect

    Access comes from the portal's token action.

  • DThe unseal keys downloaded from the portal are used to log in

    Incorrect

    HCP manages unsealing; customers receive no unseal keys.

HCP removes init and unseal from the customer's tasks and gives time-limited admin tokens instead.

HashiCorp documentation

Task 8.5Report a problem with this question

Question 4 · choose 1

On a self-managed cluster, an operator can seal Vault to stop access during an incident. On HCP Vault Dedicated, which control blocks most Vault API endpoints in the admin namespace while the cluster keeps running?

  1. ANamespace API lock on the admin namespace and its children
  2. Bvault operator seal, run with the HCP admin token
  3. CDisabling the cluster's public endpoint in the HCP Portal
  4. DA paths filter that excludes the admin namespace
Show the answer and why

  • ANamespace API lock on the admin namespace and its children

    Correct

    Namespace API lock blocks most API endpoints in the admin namespace and its descendants; HCP offers it where the cluster seal used to be.

  • Bvault operator seal, run with the HCP admin token

    Incorrect

    Most authenticated sys endpoints, sealing included, are not available on HCP Vault Dedicated.

  • CDisabling the cluster's public endpoint in the HCP Portal

    Incorrect

    That removes only the public address; clients on private networks could still reach the cluster.

  • DA paths filter that excludes the admin namespace

    Incorrect

    A paths filter blocks no API requests, so the admin namespace would stay reachable.

HCP Vault Dedicated replaces the cluster seal control with namespace API lock and keeps only a few authenticated sys endpoints, such as sys/leader and sys/metrics, available.

HashiCorp documentation

Task 8.5Report a problem with this question

Question 5 · choose 1

Which edition of Vault does an HCP Vault Dedicated cluster run?

  1. AVault Community Edition with extra HCP plugins
  2. BA separate HCP-only Vault fork with its own API
  3. CVault Enterprise, built from the same binary
  4. DWhichever edition the customer uploads
Show the answer and why

  • AVault Community Edition with extra HCP plugins

    Incorrect

    It runs Enterprise, not Community Edition.

  • BA separate HCP-only Vault fork with its own API

    Incorrect

    The same CLI, API and UI work with it.

  • CVault Enterprise, built from the same binary

    Correct

    HCP Vault Dedicated is a hosted version of Vault Enterprise using the same binary.

  • DWhichever edition the customer uploads

    Incorrect

    HashiCorp operates the cluster and its version.

Self-managed clusters can run Community Edition or Enterprise; HCP is always Enterprise.

HashiCorp documentation

Task 8.5Report a problem with this question

Practice domain 8 →Practice all domains →