VAULT-ASSOCIATE-002 Question #62: Real Exam Question with Answer & Explanation

Question

When enabling auto-unseal, how do you specify the seal type? (Choose two.)

Options

• ASet the VAULT_SEAL_TYPE environment variable
• BUse the /sys/seal endpoint on the Vault API
• CCreate a block in the server configuration file
• DConfigure in the storage block of the server configuration file
• EUse the vault operator command

Explanation

Auto-unseal configuration can be defined either within a block in the Vault server configuration file or by utilizing the vault operator command during initial setup or re-keying.

Common mistakes.

• A. Setting the VAULT_SEAL_TYPE environment variable is not a recognized method for configuring the auto-unseal seal type in Vault.
• B. The /sys/seal endpoint is used for managing manual seal/unseal operations for the current Vault instance, not for defining or changing the auto-unseal seal type configuration.
• D. While auto-unseal is configured in the server configuration file, it is typically done within a dedicated seal block, not inside the storage block, which defines where Vault's persistent data is stored.

Concept tested. Vault auto-unseal configuration methods

Reference. https://developer.hashicorp.com/vault/docs/concepts/seal#auto-unseal

No community discussion yet for this question.