nerdexam
HashiCorp

VAULT-ASSOCIATE-002 · Question #62

When enabling auto-unseal, how do you specify the seal type? (Choose two.)

The correct answer is C. Create a block in the server configuration file E. Use the vault operator command. Auto-unseal configuration can be defined either within a block in the Vault server configuration file or by utilizing the vault operator command during initial setup or re-keying.

Submitted by ahmad_uae· Apr 18, 2026Operate Vault

Question

When enabling auto-unseal, how do you specify the seal type? (Choose two.)

Options

  • ASet the VAULT_SEAL_TYPE environment variable
  • BUse the /sys/seal endpoint on the Vault API
  • CCreate a block in the server configuration file
  • DConfigure in the storage block of the server configuration file
  • EUse the vault operator command

How the community answered

(59 responses)
  • A
    2% (1)
  • B
    3% (2)
  • C
    95% (56)

Why each option

Auto-unseal configuration can be defined either within a block in the Vault server configuration file or by utilizing the `vault operator` command during initial setup or re-keying.

ASet the VAULT_SEAL_TYPE environment variable

Setting the `VAULT_SEAL_TYPE` environment variable is not a recognized method for configuring the auto-unseal seal type in Vault.

BUse the /sys/seal endpoint on the Vault API

The `/sys/seal` endpoint is used for managing manual seal/unseal operations for the current Vault instance, not for defining or changing the auto-unseal seal type configuration.

CCreate a block in the server configuration fileCorrect

The `seal` block within the Vault server configuration file (e.g., `config.hcl`) is the primary declarative method to specify the auto-unseal type and its specific parameters, such as the cloud KMS provider.

DConfigure in the storage block of the server configuration file

While auto-unseal is configured in the server configuration file, it is typically done within a dedicated `seal` block, not inside the `storage` block, which defines where Vault's persistent data is stored.

EUse the vault operator commandCorrect

The `vault operator init` command, used for initializing a new Vault cluster, can accept parameters to configure auto-unseal at startup, making it a way to specify the seal type during operational management.

Concept tested: Vault auto-unseal configuration methods

Source: https://developer.hashicorp.com/vault/docs/concepts/seal#auto-unseal

Topics

#Auto-unseal#Seal configuration#Server configuration#Vault operator commands

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full VAULT-ASSOCIATE-002 Practice