HashiCorp Vault Associate (003) Question 202
Single answer8 Vault deployment architectureA company is deploying Vault for a production application used across two data centers. The security team requires that Vault remain available if a single Vault node fails, and they want to avoid relying on an external storage system such as Consul. They also want a design that supports leader election and replicated storage managed by Vault itself. Which deployment architecture best meets these requirements?
- A
Deploy Vault in HA mode using integrated storage (Raft) with multiple Vault nodes
- B
Deploy a single Vault server using the file storage backend and enable TLS
- C
Deploy multiple Vault nodes with local file storage on each node and place them behind a load balancer
- D
Deploy Vault with integrated storage disabled and use standalone mode on each node for simplicity
Show answer and explanation
Correct answer: A
Explanation
For Vault production deployments, high availability requires multiple Vault nodes and a storage architecture that supports shared state and coordination. Integrated storage, based on the Raft protocol, is designed specifically for this purpose and is widely recommended because it removes the need for an external backend such as Consul while still providing replicated storage and leader election. In an HA Raft cluster, one node is active and others are standby/replica nodes, allowing Vault to continue operating if a single node fails. By contrast, file storage is local to a single node and is not appropriate for HA clustering. This aligns with HashiCorp guidance on Vault deployment architecture and integrated storage best practices.
- A. Correct.
Correct. Vault's integrated storage uses the Raft consensus protocol and is a recommended architecture for production deployments that need high availability without an external storage backend. Multiple Vault nodes can participate in the Raft cluster, with one active leader handling writes and followers replicating data. This directly satisfies the requirements for HA, leader election, and Vault-managed replicated storage.
- B. Incorrect.
Incorrect. A single Vault server with file storage may be suitable for development or small non-HA use cases, but it does not provide high availability. If that one node fails, Vault becomes unavailable. Enabling TLS is important for securing communications, but it does not address the architectural requirement for resilience and clustered storage.
- C. Incorrect.
Incorrect. Running multiple Vault nodes with separate local file storage does not create a shared or replicated storage system. Vault HA requires a storage backend that supports coordination and shared state, or integrated storage via Raft. Simply placing independently stored Vault nodes behind a load balancer can lead to inconsistent data and is a common misconception about how Vault clustering works.
- D. Incorrect.
Incorrect. Standalone Vault nodes operate independently and do not participate in HA coordination, leader election, or data replication. Disabling integrated storage and running separate standalone nodes increases operational risk and does not meet the production requirement for continuous availability across node failures.