Vault Associate · Domain 8 of 9

Vault Associate Domain 8: Vault deployment architecture

How Vault is deployed and kept available: cluster strategy for self-managed and HashiCorp-managed Vault, storage backends, Shamir secret sharing, disaster recovery and performance replication, and the trade-offs between running Vault yourself and using HCP.

Exam weight estimate
Not published
Official objectives
5
Estimated questions estimate
~7
Suggested study time estimate
5–7 hrs

About 11 min read Reviewed October 2026

Overview

Deployment architecture covers how Vault clusters are built, stored, protected and replicated. HashiCorp lists five objectives: cluster strategy for self-managed and HashiCorp-managed clusters, the uses of storage backends, the uses of Shamir secret sharing and unsealing, the uses of disaster recovery and performance replication, and differentiating self-managed from HashiCorp-managed clusters. Self-managed Vault typically runs three or five nodes with integrated storage based on Raft, with one active node and standbys.

HCP Vault Dedicated is the HashiCorp-managed option, where HashiCorp operates the infrastructure, storage, unsealing and upgrades while you configure auth methods, policies and secrets in your namespaces. Replication is an Enterprise and HCP capability: disaster recovery secondaries stand by to take over, while performance secondaries serve local client traffic.

How it's tested

Deployment questions are mostly conceptual. A requirement is described, such as high availability, regional failover, lower read latency or reduced operational effort, and you choose the storage, replication or hosting option that meets it. Some items ask about Shamir parameters during initialization.

  • Pick the replication type

    A failover or latency requirement is given, and you choose disaster recovery or performance replication.

  • Self-managed or HCP

    Operational responsibilities are described, and you decide whether HashiCorp or the customer owns them.

  • Storage and initialization

    You choose a storage backend or interpret key-shares and key-threshold settings during vault operator init.

Reasoning it through

A company runs its primary Vault cluster in Europe and wants applications in Asia to read secrets with low latency. A disaster recovery secondary sounds suitable because it is a full copy, but it does not serve client requests until promoted. A performance replication secondary handles reads and its own tokens locally while forwarding writes to the primary, which matches the latency goal.

Objectives 5

Official objectives from the HashiCorp outline, in outline order.

8a Explain cluster strategy for self-managed and HashiCorp-managed Vault clustersSizing, availability and placement of Vault clusters.
What it means
Cluster strategy covers how many nodes to run, where to place them and how to keep Vault available, both when you operate Vault yourself and when HashiCorp operates it in HCP.
What to understand
A self-managed cluster usually runs three or five nodes with integrated storage, spread across availability zones so Raft keeps quorum if one fails. One node is active and the others are standbys that forward or redirect requests; performance standbys that serve reads are an Enterprise feature. Additional clusters in other regions are connected with replication. With HCP Vault Dedicated you choose a tier, size and cloud region, and HashiCorp runs the nodes and their availability.
How it shows up
Expect questions on node counts, quorum, active and standby roles, and multi-region design.
Common confusion
Choosing an even number of nodes or a single node for production availability.
8b Explain the uses of storage backendsWhere Vault keeps encrypted data and why integrated storage is preferred.
What it means
A storage backend is where Vault persists its encrypted data. Vault supports several, but HashiCorp recommends integrated storage, a built-in Raft implementation, for most deployments.
What to understand
Integrated storage keeps data on each Vault node and replicates it with Raft, removing the need to run a separate system and supporting HA natively. Consul is the other HashiCorp-supported HA backend and requires a separate Consul cluster. Some community backends, such as file or cloud databases, may lack HA support. Because data is encrypted at the barrier, the backend is untrusted and stores only ciphertext. vault operator raft snapshot save provides backups for integrated storage.
How it shows up
Questions ask which backend is recommended, which supports HA, or how to back up integrated storage.
Common confusion
Thinking the storage backend needs its own encryption to keep Vault secrets safe.
8c Explain the uses of Shamir secret sharing and unsealingSplitting the root key protection among trusted people.
What it means
Shamir secret sharing splits the key that protects the root key into several shares, and a configurable threshold of them is needed to rebuild it, so no single person can unseal Vault alone.
What to understand
vault operator init defaults to five key shares with a threshold of three, adjustable with -key-shares and -key-threshold. Shares can be encrypted to individual PGP keys at init. The same quorum is used for vault operator generate-root and for rekeying with vault operator rekey, which changes the shares or threshold without changing the root key's protected data. With auto-unseal, Shamir sharing applies to recovery keys instead of unseal keys.
How it shows up
Expect questions on default share and threshold values, or how to change them after initialization.
Common confusion
Confusing rekey, which changes unseal shares, with rotate, which adds a new encryption key.
8d Explain the uses of disaster recovery and performance replicationTwo replication modes and the problems each solves.
What it means
Vault Enterprise and HCP Vault Dedicated support replication between clusters. Disaster recovery replication keeps a warm standby cluster ready to promote; performance replication creates secondaries that actively serve clients.
What to understand
A DR secondary replicates all data, including tokens and leases, but does not handle client requests until promoted, so applications keep their tokens after failover. A performance secondary serves reads locally and issues its own tokens and leases, which are not replicated back, while writes to shared configuration are forwarded to the primary. Paths filters can limit what a performance secondary receives. A performance secondary can have its own DR secondary for complete coverage.
How it shows up
A scenario describes regional failover or latency, and you select DR or performance replication.
Common confusion
Assuming tokens issued on a performance secondary remain valid after switching to another cluster.
8e Differentiate between self-managed and HashiCorp-managed Vault clustersShared responsibility for running Vault yourself versus HCP.
What it means
This objective compares running Vault on your own infrastructure with using HCP Vault Dedicated, where HashiCorp operates the clusters in its cloud and you consume Vault as a managed service.
What to understand
Self-managed Vault gives full control over versions, plugins, network placement, storage, seal and audit devices, but you handle patching, scaling, backups, unsealing and monitoring. HCP Vault Dedicated handles infrastructure, upgrades, automatic unsealing, snapshots and availability, while you manage namespaces, auth methods, policies and secrets. HCP clusters start with an admin namespace and connect to your cloud networks through peering or similar private connectivity. Some features and plugins differ by tier.
How it shows up
Responsibilities are listed, and you assign each to HashiCorp or the customer, or choose an offering.
Common confusion
Assuming HCP customers must still unseal or upgrade their own clusters.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Integrated storage (Raft)

    Built-in storage replicated across Vault nodes.

    Remember
    Recommended default; supports HA.
    Tested as
    Storage choice questions.
    Trap
    Adding Consul without need.

  • Quorum

    Majority of Raft voters needed to operate.

    Remember
    Use three or five nodes.
    Tested as
    Cluster sizing questions.
    Trap
    Picking even node counts.

  • Active and standby nodes

    One node serves; others wait or forward.

    Remember
    Performance standbys need Enterprise.
    Tested as
    HA questions.
    Trap
    Expecting all nodes to serve writes.

  • Raft snapshots

    Backups of integrated storage.

    Remember
    vault operator raft snapshot save.
    Tested as
    Backup questions.
    Trap
    Copying data directories instead.

  • Key shares and threshold

    Shamir split of root key protection.

    Remember
    Defaults are five shares, threshold three.
    Tested as
    Initialization questions.
    Trap
    Mixing up the two values.

  • vault operator rekey

    Changes unseal or recovery key shares.

    Remember
    Requires the current quorum.
    Tested as
    Key management questions.
    Trap
    Confusing it with rotate.

  • DR replication

    Warm standby cluster.

    Remember
    Replicates tokens and leases; no client traffic.
    Tested as
    Failover questions.
    Trap
    Expecting it to serve reads.

  • Performance replication

    Active secondaries serving clients.

    Remember
    Own tokens and leases; writes forwarded.
    Tested as
    Latency questions.
    Trap
    Expecting tokens to replicate.

  • HCP Vault Dedicated

    HashiCorp-managed Vault clusters.

    Remember
    HashiCorp runs infrastructure, unseal and upgrades.
    Tested as
    Managed vs. self-managed questions.
    Trap
    Assuming customer-run upgrades.

  • admin namespace

    Top-level namespace in HCP Vault Dedicated.

    Remember
    Customer configuration lives under it.
    Tested as
    HCP questions.
    Trap
    Expecting root namespace access.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

DR vs. performance replication

ConceptMeaningKey differenceCommon trap
DR secondary Full standby copy of the primary No client requests until promoted Using it to cut latency
Performance secondary Serves clients in another region Local tokens and leases Expecting tokens to replicate

Self-managed vs. HCP Vault Dedicated

ConceptMeaningKey differenceCommon trap
Self-managed You run nodes, storage and seal Full control and full responsibility Underestimating operations work
HCP Vault Dedicated HashiCorp runs the platform You configure namespaces, auth, policies Thinking you must unseal or patch

Storage backend options

ConceptMeaningKey differenceCommon trap
Integrated storage Raft inside Vault nodes No external dependency, HA Overlooking it as the default
Consul Separate Consul cluster HA, extra system to run Choosing it by habit
Non-HA backends Such as local file Single node only Using them in production HA

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. DR for latency

    What candidates pick
    Add a DR secondary near remote users.
    Why it looks right
    It holds a full copy of the data.
    Why it's wrong
    DR secondaries do not serve client requests until promoted; performance secondaries do.

    Clue to watch for The goal is faster reads elsewhere.

  2. Tokens follow you

    What candidates pick
    Expect a performance secondary token to work on the primary.
    Why it looks right
    Data seems shared between clusters.
    Why it's wrong
    Performance secondaries issue local tokens and leases that are not replicated.

    Clue to watch for Clients switch between clusters.

  3. HCP needs unsealing

    What candidates pick
    Plan an unseal procedure for HCP Vault Dedicated.
    Why it looks right
    Self-managed Vault needs one.
    Why it's wrong
    HashiCorp handles unsealing and infrastructure operations for HCP Vault Dedicated clusters.

    Clue to watch for The question lists HCP responsibilities.

  4. Even node counts

    What candidates pick
    Deploy four nodes for extra resilience.
    Why it looks right
    More nodes seem safer.
    Why it's wrong
    Raft quorum tolerates the same failures with three or five, so even counts add cost without benefit.

    Clue to watch for Cluster sizing question.

  5. Rekey equals rotate

    What candidates pick
    Run vault operator rotate to issue new unseal shares.
    Why it looks right
    Both sound like key changes.
    Why it's wrong
    Rotate adds a new barrier encryption key; rekey changes unseal or recovery shares.

    Clue to watch for Key holders have changed.

  6. Encrypt the backend

    What candidates pick
    Require storage-level encryption to protect secrets.
    Why it looks right
    Defense in depth sounds right.
    Why it's wrong
    Vault already encrypts data at the barrier, so the backend only ever stores ciphertext.

    Clue to watch for Question asks why the backend is untrusted.

Answer framework

Apply these steps to Domain 8 design, replication and hosting scenarios.

  1. Clarify the goal: high availability within a region, regional failover, lower latency elsewhere, or less operational effort.
  2. For availability inside a region, choose three or five nodes with integrated storage across zones so Raft keeps quorum after losing one zone.
  3. For failover, choose disaster recovery replication; for serving distant clients, choose performance replication and remember tokens stay local.
  4. If reducing operations work is the priority, prefer HCP Vault Dedicated and assign infrastructure tasks to HashiCorp.
  5. For key custody, apply Shamir shares and threshold at init, and use rekey to change holders later; use rotate only when the barrier encryption key itself should change.

Practice question

A regulated bank wants a second Vault cluster that can take over if its primary region fails, with applications keeping their existing tokens after failover. The second cluster should not serve client traffic during normal operation. Which design meets these requirements?

Want more like this? The Vault Associate practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Much of this group is conceptual because replication needs Enterprise or HCP, so combine reading with a small lab. Build a three-node integrated storage cluster with containers or local processes, initialise it with custom -key-shares and -key-threshold values, join the nodes and check vault operator raft list-peers. Stop one node and confirm the cluster keeps working, then stop a second and observe loss of quorum. Save and inspect a Raft snapshot.

Next, read the replication documentation and draw both modes side by side: what data each secondary holds, whether it serves clients, and what happens to tokens on failover. Add a third column for HCP Vault Dedicated responsibilities, using the HCP Vault Dedicated overview pages.

Finally, practise mapping requirements to designs. Write one-line scenarios such as faster reads in Asia or survive a region loss, and answer each in a sentence. Review practice questions on this group, paying attention to self-managed versus HashiCorp-managed wording that the 003 version introduced.

FAQ

How much of the Vault Associate exam is Vault deployment architecture?

HashiCorp publishes no weight for Vault deployment architecture. It has five objectives, including HCP comparisons added in the 003 version, so we estimate about seven questions.

Which storage backend should I know best?

Integrated storage, which uses Raft inside Vault itself. HashiCorp recommends it for most deployments, and it supports high availability without an external system.

What are the default Shamir settings?

vault operator init creates five key shares with a threshold of three by default. You can change both with -key-shares and -key-threshold.

When do I use DR instead of performance replication?

Use DR replication for a passive standby that takes over after a failure. Use performance replication to serve clients in other regions with lower latency.

What does HashiCorp manage in HCP Vault Dedicated?

The infrastructure, availability, upgrades, unsealing and snapshots. Customers configure namespaces, auth methods, secrets engines and policies.

Is replication available in open source Vault?

No. Disaster recovery and performance replication are Vault Enterprise features and are also available in HCP Vault Dedicated tiers.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 8 knowledge

You have covered cluster strategy, storage, Shamir sharing, replication and self-managed versus HCP Vault. Check that you can match designs to requirements under exam conditions.

Take the Vault Associate practice test Check your Vault Associate readiness

Keep going