HashiCorp Certified - Vault Associate Course - Audit Devices

The video tutorial discusses the role and configuration of audit devices in Vault clusters. It explains how audit devices log authenticated requests and responses, and the importance of sending this data to a SIM or log aggregation tool. The tutorial covers enabling audit devices via CLI, setting file paths, and ensuring proper permissions. It describes three types of audit devices: file, syslog, and socket, highlighting their features and limitations. The video emphasizes the need for multiple audit devices to ensure safety and availability, and provides best practices for managing logs.

What is the primary function of an audit device in Vault?

• To store user credentials

• To encrypt data

• To log authenticated requests and responses

• To manage user permissions

Why is it important to send log data to a SIM or log aggregation tool?

• To reduce storage costs

• To alert on different activities

• To encrypt the logs

• To improve system performance

What command is used to enable a file audit device in Vault?

• vault log enable

• vault audit enable

• vault log start

• vault audit start

Which audit device type is considered unreliable due to the underlying protocol?

• File

• Syslog

• Socket

• Cloudwatch

What happens if Vault cannot write to a persistent log?

• It continues to operate normally

• It switches to a backup log

• It stops responding to client requests

• It deletes old logs