HashiCorp Vault Associate (003) Question 181
Single answer7 Vault architecture fundamentalsA company is deploying Vault in production for multiple internal applications. The security team wants Vault to remain available during the loss of a single server and to ensure that no single administrator can decrypt the Vault by themselves after a restart. Which architecture choice best meets these requirements?
- A
Deploy a single Vault server using integrated storage and configure auto-unseal so administrators do not need unseal keys
- B
Deploy a Vault cluster with integrated storage, use multiple unseal key shares with a threshold less than the total number of shares, and run enough nodes to tolerate one node failure
- C
Deploy multiple standalone Vault servers, each with its own local storage, and give every administrator a full copy of the unseal key for emergency access
- D
Deploy a Vault cluster with one active node and one standby node, but configure only one unseal key share so startup is faster during maintenance
Show answer and explanation
Correct answer: B
Explanation
This question tests core Vault architecture fundamentals: high availability, integrated storage, and the purpose of Shamir unseal key sharing. In production, Vault is commonly deployed as a cluster rather than as a single server so it can continue serving requests when a node fails. With integrated storage, Vault can provide HA without requiring an external storage backend. For manual unseal, Vault uses Shamir's Secret Sharing to split the unseal key into shares, and a configured threshold of those shares is required to unseal the Vault. This prevents any single person from unsealing it alone when configured with more than one share required. HashiCorp documentation and deployment guidance emphasize clustering for HA and using unseal shares/thresholds to enforce operational separation of duties.
- A. Incorrect.
Incorrect. A single Vault server does not meet the availability requirement because losing that server makes Vault unavailable. While auto-unseal can reduce operational overhead, it does not address the requirement that no single administrator should be able to decrypt or unseal Vault manually. This option also removes the shared-control property the scenario is asking for.
- B. Correct.
Correct. A Vault cluster with integrated storage supports high availability and production deployment patterns. Running multiple nodes allows Vault to remain available if one node fails, assuming quorum and proper cluster sizing. Using Shamir unseal with multiple key shares and a threshold lower than the total number of shares enforces split knowledge so that no single administrator can unseal Vault alone. This directly matches both the availability and security requirements.
- C. Incorrect.
Incorrect. Multiple standalone Vault servers with separate local storage do not form a single HA Vault cluster and would not provide coordinated failover for the same data set. Giving each administrator a full unseal key defeats the purpose of Shamir key sharing because any one administrator could unseal Vault independently, violating the shared-control requirement.
- D. Incorrect.
Incorrect. A cluster with active and standby nodes can provide HA, but configuring only one unseal key share means a single person can unseal Vault, which conflicts with the requirement for separation of responsibility. Faster startup does not justify weakening the security model in this scenario.