HashiCorp Vault Associate (003) Question 210
Single answer8b Explain the uses of storage backendsA company is deploying Vault for production across three nodes and wants the service to remain available if one node fails. The security team also wants to avoid running and maintaining a separate external database or coordination system just to store Vault data. Which storage backend best fits this requirement?
- A
Integrated Storage, because it uses Vault's built-in Raft storage to store data and support HA without requiring a separate external storage system
- B
In-memory storage, because it keeps secrets only in RAM and automatically provides HA across multiple Vault nodes
- C
File storage, because placing the same file path on each node lets Vault coordinate leadership and replicate data between nodes
- D
Transit secrets engine, because it can encrypt the storage backend and therefore acts as the backend for HA data storage
Show answer and explanation
Correct answer: A
Explanation
Storage backends in Vault are used to persist Vault's core data, including encrypted secrets, configuration state, leases, and other metadata. In production, the choice of backend affects durability, operational complexity, and high-availability design. Integrated Storage uses the Raft consensus protocol and is specifically intended to let Vault persist and replicate data across cluster members without requiring an external storage service. By contrast, in-memory storage is non-persistent and intended for testing, file storage is local and not a multi-node HA coordination mechanism, and transit is a secrets engine rather than a storage backend. HashiCorp documentation and best practices commonly position Integrated Storage as the built-in option for production deployments that want HA and simpler operations.
- A. Correct.
Correct. Integrated Storage is Vault's built-in Raft-based storage backend. It is commonly used in production because it stores Vault data directly in Vault and supports high availability through Raft clustering, eliminating the need for a separate external storage system such as Consul. This matches the scenario's requirement for HA with reduced operational overhead.
- B. Incorrect.
Incorrect. In-memory storage is primarily for development or testing because data is not persisted across restarts. It does not provide durable shared storage for a production HA cluster. A candidate might choose this option by focusing on speed or security benefits of RAM, but it does not meet the durability and availability requirements described.
- C. Incorrect.
Incorrect. File storage writes data to the local filesystem and is not suitable for coordinating a multi-node HA cluster by simply pointing nodes at similar paths. Separate nodes do not automatically replicate data or elect a leader through file storage alone. This distractor reflects a common misconception that local disk storage can be treated like a shared HA backend without a clustering mechanism.
- D. Incorrect.
Incorrect. Transit is a secrets engine used for encryption-as-a-service; it is not a storage backend. While transit can be used in features such as auto-unseal workflows with another Vault cluster, it does not store Vault's core data as the primary backend. Someone might pick it because it involves protecting data, but it does not fulfill the role of Vault storage.