HashiCorp Vault Associate (003) Question 214
Single answer8b Explain the uses of storage backendsA company is deploying Vault for a production web application across three servers. The security team wants Vault data such as encrypted secrets, policies, and auth configuration to survive service restarts and node failures. They also want the Vault servers to coordinate as a single cluster rather than each node keeping its own independent state. Which action best meets these requirements?
- A
Configure the same supported durable storage backend for all Vault nodes so they share persisted cluster data
- B
Use the file storage backend on each server separately, because Vault automatically synchronizes file storage between nodes
- C
Rely on the secrets engines to persist and replicate Vault's core data, since storage backends are only for audit logs
- D
Configure only a listener on each node, because listeners provide both network access and persistent cluster state
Show answer and explanation
Correct answer: A
Explanation
Storage backends are a foundational part of Vault because they persist Vault's internal data and enable Vault to recover state after restarts. In practical deployments, the storage backend is what keeps encrypted secrets, policies, auth configuration, leases, and other metadata durable. For clustered deployments, the backend choice also affects how nodes coordinate and share state. A key exam takeaway is that listeners handle network access, secrets engines handle secret workflows, and audit devices handle audit logging, while storage backends are responsible for durable persistence of Vault's core data. HashiCorp documentation describes storage as the location where Vault persists and reads its data, and production guidance emphasizes using a supported durable backend appropriate for HA and operational requirements.
- A. Correct.
Correct. Vault storage backends are used to persist Vault's core data, including encrypted secrets, policies, auth methods, leases, and other internal state. In a multi-node deployment, Vault needs a supported shared or coordinated storage strategy so nodes participate in the same cluster state rather than acting independently. This directly addresses durability across restarts and coordination across nodes.
- B. Incorrect.
Incorrect. The file storage backend stores data locally on disk for a single Vault instance. It does not automatically synchronize data between different servers. If each node uses its own separate file backend, each node will have different state, which breaks the goal of a coordinated production cluster.
- C. Incorrect.
Incorrect. Secrets engines are not a replacement for Vault's storage backend. They provide interfaces for storing or generating secrets, but Vault's core data persistence is handled by the storage backend. Audit logs are configured through audit devices, not through the storage backend alone. This option reflects a common misunderstanding about the role of secrets engines versus storage backends.
- D. Incorrect.
Incorrect. A listener defines how Vault accepts API traffic, such as TCP network connections and TLS settings. It does not provide durable storage or cluster persistence. A Vault server still requires a storage backend to save its state.