HashiCorp Vault Associate (003) Question 200
Single answer8 Vault deployment architectureA company is deploying Vault for a production application across three virtual machines in a single region. They want Vault to remain available if one node fails and they want to avoid managing an external storage system such as Consul. The security team also requires that Vault data be encrypted at rest and that only one node actively service write requests at a time. Which deployment architecture best meets these requirements?
- A
Deploy Vault in dev mode on all three virtual machines and place a load balancer in front of them
- B
Deploy a three-node Vault cluster using Integrated Storage (Raft) with high availability enabled
- C
Deploy three standalone Vault servers, each with local file storage, and use round-robin DNS for client access
- D
Deploy a single Vault server using Integrated Storage (Raft) because Raft replication alone provides node-failure tolerance without clustering
Show answer and explanation
Correct answer: B
Explanation
For production deployments, Vault should be run in an HA architecture rather than as standalone or dev-mode instances. HashiCorp recommends Integrated Storage using Raft for many deployments because it removes the need for a separate storage backend like Consul while still supporting HA clustering. In this model, Vault uses an active/standby architecture: one active node services requests that require leadership, while standby nodes are available to take over if the active node fails. This aligns directly with the scenario requirements. Vault also encrypts data before writing it to storage, which addresses the encryption-at-rest requirement from Vault's perspective. The key misconception in the wrong answers is confusing multiple independent Vault servers with a real HA cluster, or assuming Raft benefits apply without multiple clustered nodes. See the Vault documentation on deployment architecture, high availability, and Integrated Storage (Raft) for the recommended production patterns.
- A. Incorrect.
This is incorrect. Dev mode is intended only for local testing and learning, not production. It runs with insecure defaults, is automatically initialized and unsealed, and does not provide the production-grade availability or operational controls required for a real deployment.
- B. Correct.
This is correct. A Vault cluster using Integrated Storage (Raft) is a common production architecture when the team does not want to operate external storage such as Consul. In an HA cluster, one node is active and the others are standby nodes, which satisfies the requirement that only one node actively handle writes at a time. Raft also replicates the storage data across the cluster, improving availability if one node fails. Vault encrypts data at rest in storage, and Integrated Storage is explicitly designed for this kind of production deployment.
- C. Incorrect.
This is incorrect. Three standalone Vault servers with separate local file storage do not form a single HA Vault cluster. Each server would have its own independent data, tokens, leases, and configuration state. Round-robin DNS would just distribute clients across unrelated Vault instances, causing inconsistent behavior and failing to meet the availability and shared-state requirements.
- D. Incorrect.
This is incorrect. A single Vault server, even if configured with Integrated Storage, is still a single point of failure. Raft provides replicated storage only when there are multiple clustered nodes participating. One node cannot provide high availability for node failure tolerance.