A. Correct.
The threshold value defines how many unseal key shares are required to reconstruct the unseal process.

B. Incorrect.
All shares are not required unless the threshold is configured to equal the total number of shares.

C. Incorrect.
One share is insufficient when the configured threshold is three.

D. Incorrect.
A manually sealed node must be unsealed again unless an auto-unseal mechanism is configured and functioning.

A. Incorrect.
Adding a Vault node does not by itself require rotating unseal key shares.

B. Correct.
Rekeying is appropriate when a keyholder should no longer possess a valid key share.

C. Incorrect.
LDAP password recovery is handled in the identity provider, not by Vault rekeying.

D. Correct.
Rekeying can satisfy operational or compliance requirements to rotate unseal key shares.

E. Incorrect.
Updating a secret does not require rotating the Vault unseal key shares.

A. Incorrect.
Audit logs help investigate activity but are not a full Vault data backup.

B. Incorrect.
A standby node helps availability during node failure, but it is not a point-in-time backup for accidental deletion or corruption.

C. Correct.
Integrated Storage supports snapshots, which are the right backup artifact for recovery planning.

D. Incorrect.
Server logs are not a reliable or complete source for reconstructing Vault storage data.

A. Incorrect.
Not every storage backend supports the coordination needed for Vault HA.

B. Correct.
Vault HA depends on a supported HA storage backend or an HA-capable deployment such as Integrated Storage.

C. Incorrect.
Each sealed Vault server must be unsealed or auto-unsealed individually; unsealing one node does not unseal all nodes.

D. Incorrect.
HA improves service availability, but access control still depends on tokens, auth methods, and policies.

A. Correct.
Vault Agent can use auto-auth methods to acquire and renew tokens for applications.

B. Incorrect.
Vault Agent runs near clients. It is not the mechanism used to auto-unseal the Vault server.

C. Correct.
Vault Agent can cache tokens and leases to reduce client-side request volume when caching is enabled.

D. Incorrect.
Transit keys remain managed by Vault; Vault Agent does not create a permanent local copy of every transit key.

E. Incorrect.
Vault Agent is a client helper and does not replace Vault's storage backend.

A. Correct.
Dynamic secret credentials are revoked by revoking their lease ID.

B. Incorrect.
vault token revoke revokes tokens, not the leased dynamic credential itself.

C. Incorrect.
KV delete applies to key/value secrets and does not revoke a dynamic AWS credential lease.

D. Incorrect.
Rekey rotates unseal key shares and has no relationship to an AWS dynamic secret lease.

A. Incorrect.
Vault rekeying rotates unseal key shares, not the transit encryption key versions used for application data.

B. Incorrect.
Disabling the engine can disrupt access and is not the normal key rotation workflow.

C. Incorrect.
Cubbyhole stores per-token secrets and does not rotate transit encryption keys.

D. Correct.
Transit key rotation creates a new key version for future encryption while retaining older versions for decrypting existing ciphertext.

A. Incorrect.
read permits retrieving data from a path, which is more access than listing names.

B. Correct.
list permits enumeration of keys or endpoints below a path when the backend supports listing.

C. Incorrect.
sudo is for privileged system endpoints and is not the normal capability for listing secret names.

D. Incorrect.
delete removes data and does not allow listing child paths.

A. Correct.
Performance Replication supports secondary clusters for scaling read-heavy and geographically distributed workloads.

B. Correct.
Disaster Recovery Replication supports recovery of a primary cluster by maintaining a DR secondary.

C. Incorrect.
Seal wrap protects stored values with an additional encryption layer; it is not a replication mode.

D. Incorrect.
Namespaces are an Enterprise multi-tenancy feature, not a replication mode called namespace sharding.

E. Incorrect.
Audit devices can send audit records to configured destinations, but this is not a Vault Enterprise replication mode.

A. Incorrect.
The initial root token is created during initialization, so this does create a root token.

B. Incorrect.
generate-root can create a new root token when the required key holder approval process is completed.

C. Correct.
Batch tokens are lightweight client tokens; creating one is not a root token generation mechanism.

D. Incorrect.
A current root token has broad privileges and can be used to create another token with root-level policy if permitted.