HashiCorp Vault Associate (003) Question 203
Single answer8 Vault deployment architectureA company is deploying Vault for a production application that must remain available if a single Vault node fails. The security team also wants to minimize operational overhead and avoid managing an external storage system such as Consul. Which deployment architecture best meets these requirements?
- A
Deploy a single Vault server using integrated storage (Raft) so there is no external dependency
- B
Deploy a Vault cluster with integrated storage (Raft) using multiple nodes and configure one active node with standby nodes
- C
Deploy multiple standalone Vault servers, each with its own local file storage, behind a load balancer
- D
Deploy a Vault cluster using in-memory storage on multiple nodes because the data is replicated automatically between active and standby nodes
Show answer and explanation
Correct answer: B
Explanation
For production Vault deployments, high availability requires multiple Vault nodes sharing a supported storage backend. Integrated storage using Raft is a common best practice because it provides built-in durable storage and HA without introducing an external dependency such as Consul. In an HA cluster, one node is active and others are standby; if the active node fails, another node can be promoted. By contrast, a single node cannot meet availability goals, separate standalone nodes do not create a real cluster, and in-memory storage is only suitable for non-production use. This aligns with HashiCorp Vault documentation on deployment architecture, HA, and integrated storage (Raft).
- A. Incorrect.
This is incorrect because a single Vault server is a single point of failure. While integrated storage (Raft) does remove the need for an external storage backend, one node cannot provide high availability if that node goes down.
- B. Correct.
This is correct. Vault Enterprise and OSS support high availability with integrated storage (Raft), which allows Vault to use its own built-in storage backend rather than relying on an external system like Consul. In a clustered deployment, Vault provides an active node and standby nodes, so the service can continue operating if one node fails. This architecture meets both the availability and reduced operational overhead requirements.
- C. Incorrect.
This is incorrect because multiple standalone Vault servers with separate local file storage do not form a single HA cluster. Each server would have its own independent data set, seals, and state. Putting them behind a load balancer would not create shared storage or coordinated failover, and clients could receive inconsistent behavior depending on which server they reach.
- D. Incorrect.
This is incorrect because in-memory storage is intended only for development or testing, not production. It is non-persistent, so data is lost on restart, and it does not provide the durable shared storage required for a production HA Vault deployment. Vault standbys also do not automatically replicate state when using unsupported storage choices like this.