HashiCorp Vault Associate (003) Question 211
Single answer8b Explain the uses of storage backendsA company is deploying Vault for a production application that requires high availability and durable persistence of Vault data such as encrypted secrets, leases, and auth information. The security team also wants to avoid using the Integrated Storage Raft backend for this environment because they already operate a managed relational database platform. Which storage backend is the best fit for this requirement?
- A
file, because it is recommended for production HA deployments when shared across Vault nodes
- B
mysql, because it can provide durable persistent storage for Vault data and supports HA deployments
- C
dev, because it stores data in memory and simplifies failover between production nodes
- D
transit, because it stores Vault's encrypted data in another Vault cluster while providing HA
Show answer and explanation
Correct answer: B
Explanation
Storage backends are used by Vault to persist its core data, including encrypted secret data, leases, tokens, and configuration state needed for operation. In production, the backend must provide durable persistence, and for HA deployments it must support the operational model required by multiple Vault nodes. In this scenario, MySQL is the best fit because it is a supported storage backend that provides persistent storage and can be used for HA, while also matching the organization's existing managed database capabilities. The file backend is persistent but not appropriate here as an HA solution. The dev mode is explicitly non-production. Transit is not a storage backend at all; it is a secrets engine. HashiCorp documentation distinguishes clearly between storage backends, which persist Vault data, and features like secrets engines or auto-unseal mechanisms, which serve different purposes.
- A. Incorrect.
Incorrect. The file storage backend persists Vault data locally on disk, but it is not the recommended choice for a production HA deployment across multiple nodes. Simply sharing a filesystem does not make it an appropriate HA backend for Vault, and this option reflects a common misunderstanding that any persistent disk-based storage is sufficient for clustered production use.
- B. Correct.
Correct. The mysql storage backend is a supported persistent storage backend for Vault and can be used in production environments. It stores Vault's durable data, including encrypted secrets metadata and other core state, in MySQL. This aligns with the scenario because the company already operates a managed relational database platform and wants a durable non-Raft backend that can support HA.
- C. Incorrect.
Incorrect. The dev server mode is for testing and learning, not production. It is in-memory, ephemeral, and not suitable for durable persistence or high availability. This option targets the misconception that simpler setup modes can be adapted for production workloads.
- D. Incorrect.
Incorrect. Transit is a secrets engine, not a storage backend. It provides encryption-as-a-service and can be used for auto-unseal in some architectures, but it does not store Vault's primary persisted data. This distractor addresses the common confusion between Vault storage backends and Vault secrets engines.