HashiCorp · Vault-Associate
HashiCorp Certified: Vault Associate Practice Tests
Validates knowledge of HashiCorp Vault for secrets management and data protection, covering authentication methods, policies and tokens, lease management, static and dynamic secrets engines, encryption as a service, and Vault architecture including high availability.
Exam Details
Practice Questions
622
≈ 10 practice exams
Duration
60 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
HashiCorp Certified: Vault Associate Practice Exam Preparation
Use this Vault-Associate practice exam to prepare for HashiCorp Certified: Vault Associate with realistic questions, detailed explanations, and focused study modes. The practice bank includes 622 questions for HashiCorp Vault-Associate, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The HashiCorp Certified: Vault Associate (003) validates foundational knowledge and hands-on skills with HashiCorp Vault, the industry-standard platform for secrets management and data protection. The exam tests candidates on Vault's core mechanics: accessing Vault through the UI, CLI, and API; managing authentication methods, tokens, and policies; working with static and dynamic secrets engines including Key/Value, Database, and Identity engines; managing leases and renewals; and leveraging the Transit secrets engine for encryption as a service (EaaS). The current exam version tests against Vault 1.16 and covers both the open-source Community Edition and Enterprise features.
Candidates are also evaluated on Vault architecture, including high-availability deployment models, Vault Agent, the Vault Secrets Operator for Kubernetes, HCP Vault Dedicated on the cloud, and replication strategies. The certification is delivered through Certiverse, HashiCorp's online proctored testing platform, and is valid for two years. It serves as the foundation for advanced HashiCorp security certifications and is recognized across cloud-native and regulated enterprise environments.
Who Should Take This Exam
This certification is designed for Cloud Engineers with foundational Vault experience who specialize in security, development, or operations. It is well-suited for DevOps engineers, Site Reliability Engineers (SREs), platform engineers, security engineers, and developers who integrate secrets management into cloud-native applications and pipelines.
Candidates working in environments that use Kubernetes, cloud infrastructure (AWS, Azure, GCP), or CI/CD platforms where secrets must be securely injected and managed will find this certification most relevant. It is an associate-level credential, meaning it targets practitioners who understand Vault's core concepts and can operate it in a production or demo environment, rather than those with deep architectural design experience.
Prerequisites
There are no formal prerequisites required to sit for the exam. However, HashiCorp recommends that candidates have basic terminal competency, a foundational understanding of on-premises or cloud infrastructure, and a basic level of security knowledge before attempting the exam.
Practical experience using Vault in a production environment provides the strongest preparation, though candidates who have worked through all exam objectives in a personal or lab environment may also be ready. Familiarity with concepts such as authentication flows, PKI, database credential rotation, and Kubernetes secret injection will be advantageous, even if not explicitly required.
Exam Format
The Vault Associate (003) exam is a multiple-choice, online-proctored assessment delivered through Certiverse via HashiCorp's Certification Portal (GitHub login required). The exam duration is 1 hour, though candidates should budget approximately 90 minutes total to account for setup and identity verification. Question formats include standard multiple choice, true/false, scenario-based questions, and UI area-selection items.
HashiCorp does not publicly disclose the exact number of questions or a numerical passing score threshold — results are displayed as pass/fail immediately upon completion. A domain-level performance breakdown is typically made available within two business days. The exam costs $70.50 USD plus applicable taxes. Candidates who do not pass must wait 7 days before retaking and are limited to four attempts within a rolling year. Credentials are valid for 2 years, with recertification eligibility beginning at 18 months.
Skills Measured
- 1.Authentication Methods: Differentiate between human-centric and machine-oriented authentication methods (e.g., userpass, LDAP, AppRole, AWS, Kubernetes); manage entities and groups; choose the appropriate auth method for a given use case.
- 2.Vault Policies: Understand the deny-by-default model; write and apply HCL policy syntax; configure path-based access controls using capabilities (create, read, update, delete, list, sudo); manage policies via CLI and UI.
- 3.Vault Tokens: Distinguish between service tokens and batch tokens; understand root tokens and token accessors; configure TTL and max TTL; manage token hierarchies and orphan tokens.
- 4.Vault Leases: Understand the lease lifecycle for dynamic secrets; renew and revoke leases manually; configure default and max lease TTLs; understand the impact of lease expiration on downstream systems.
- 5.Secrets Engines: Enable, configure, and operate secrets engines including Key/Value (v1 and v2), Database (dynamic credentials), PKI, SSH, and Identity; differentiate between static and dynamic secrets; understand secret versioning and metadata in KV v2.
- 6.Encryption as a Service: Use the Transit secrets engine to encrypt and decrypt data without storing it in Vault; understand key rotation, convergent encryption, and the use of Transit for application-layer data protection.
- 7.Vault Architecture Fundamentals: Understand Vault's storage backends, barrier encryption, seal/unseal process (Shamir's Secret Sharing and auto-unseal), audit devices, and the difference between dev mode and production deployments.
- 8.Vault Deployment Architecture: Configure high-availability (HA) with integrated storage (Raft); understand replication types (performance and disaster recovery) available in Vault Enterprise; understand HCP Vault Dedicated as a managed offering.
- 9.Access Management Architecture: Understand Vault Agent for secret injection and token renewal; use the Vault Secrets Operator for Kubernetes-native secret synchronization; distinguish between Community Edition and Enterprise feature sets.
Study Tips
- Complete the official HashiCorp Developer learning path for Vault Associate (003) at developer.hashicorp.com/vault/tutorials/associate-cert-003, which maps directly to every exam objective and includes hands-on interactive labs.
- Stand up a local Vault dev server (vault server -dev) to practice CLI commands for enabling secrets engines, writing policies, creating tokens, and configuring auth methods — exam questions often test exact command syntax and flags.
- Use the official Vault Associate (003) sample questions published by HashiCorp to familiarize yourself with the question style, including scenario-based and UI area-selection formats that differ from standard multiple choice.
- Pay close attention to the differences between Vault Community Edition and Enterprise features (e.g., performance replication, DR replication, namespaces, HSM auto-unseal) — the exam explicitly tests your ability to distinguish between them.
- Practice writing HCL policies from scratch and understand the deny-by-default model deeply; know how capabilities like 'sudo' and 'deny' interact, and how wildcard path matching works in policy definitions.
- Review the Vault architecture documentation on seal/unseal mechanisms (Shamir's Secret Sharing vs. auto-unseal via cloud KMS), integrated Raft storage, and HA configuration — these architectural concepts appear consistently in exam scenarios.
- For dynamic secrets, practice the full lifecycle with the Database secrets engine: configure a connection, create a role, generate credentials, observe lease behavior, and manually revoke leases to reinforce the concepts tested in objectives 4 and 5.
Career Benefits
The Vault Associate certification signals verified competence in secrets lifecycle management, a skill set in high demand across DevOps, platform engineering, and security-focused roles. Organizations running cloud-native workloads on Kubernetes, AWS, Azure, or GCP routinely list Vault experience as a requirement in job postings for SRE, DevSecOps, and cloud security engineer roles. HashiCorp reports that 88% of exam takers agree that passing an Associate-level exam makes job candidates more desirable to employers. Vault has become the de facto standard for secrets management in enterprises operating in regulated industries (financial services, healthcare, government), making this certification particularly valuable for practitioners in those sectors.
Professionals specializing in HashiCorp tooling report average salaries in the range of $80,000 per year according to PayScale, with senior cloud security and platform engineering roles often commanding significantly more. The $70.50 exam fee and two-year validity period make it a high-ROI credential. It also serves as a stepping stone to the HashiCorp Vault Operations Professional certification, which targets advanced deployment and architectural design skills.
Sample Questions
5 sample questions with answers and explanations. The full bank has 622 questions, enough for 10 full-length practice exams.
Preview — answers shown1. A DevOps team configures Vault Agent for a microservice with the following auto-auth configuration using the Kubernetes auth method. The agent successfully authenticates and writes the token to a file sink. However, the application cannot read secrets from Vault. The agent logs show successful authentication but no subsequent activity. What is the most likely cause? (Select one!)
AThe sink file permissions are too restrictive for the application to read
BThe Kubernetes service account lacks RBAC permissions to read the token file
CThe agent configuration is missing the cache block to enable request proxying
DThe Kubernetes auth role has an incompatible token_type setting
Explanation
Vault Agent requires a cache block configuration to enable request proxying between the application and Vault. Without the cache block, the agent only performs authentication and writes the token to the sink but does not proxy requests from the application to Vault. The cache block with use_auto_auth_token enables the agent to automatically attach the authenticated token to proxied requests. Kubernetes RBAC permissions affect pod service account capabilities but do not prevent the agent from proxying requests. The token_type setting affects token characteristics but does not prevent request proxying if properly configured. Sink file permissions would prevent the application from reading the token file but would not explain the lack of agent activity for proxying.
2. A company stores application secrets in the KV v2 secrets engine at path secret/myapp. A developer accidentally overwrites production credentials with test data in version 5. The previous correct data was in version 4. Which command restores the correct credentials while preserving the version history? (Select one!)
Avault kv undelete -mount=secret -versions=4 myapp
Bvault kv destroy -mount=secret -versions=5 myapp && vault kv get -mount=secret -version=4 myapp
Cvault kv rollback -mount=secret -version=4 myapp
Dvault kv metadata put -mount=secret -current-version=4 myapp
Explanation
The rollback command creates a new version (version 6) that contains the data from version 4, preserving the complete version history while restoring the correct credentials. This is the proper way to undo an accidental overwrite. The undelete command only recovers soft-deleted versions and doesn't restore previous data to current. The metadata put command manages metadata properties, not version content. Destroying version 5 permanently deletes it but doesn't restore version 4 as the current version; you would need to manually write the data again.
3. A Vault operator performs a rekey operation on a production Vault cluster that was initialized with 5 key shares and a threshold of 3. The rekey operation generates 7 new key shares with a threshold of 4. What cryptographic keys are changed by this operation? (Select one!)
ABoth the unseal keys and the root key are regenerated
BOnly the root key is changed; the unseal keys remain the same
COnly the unseal keys are changed; the root key remains the same
DThe encryption key is changed but the root key remains the same
Explanation
The rekey operation changes only the unseal key shares and threshold through Shamir secret sharing, but does not change the root key itself. Rekey redistributes the existing root key across new unseal key shares with a new threshold. This allows changing the number of key holders or the quorum requirement without re-encrypting all data. To change the root key, a separate root key rotation operation is required. The encryption key in the keyring is encrypted by the root key and is not affected by rekey operations.
4. An application writes secrets to its cubbyhole at cubbyhole/db-credentials using a service token with a 2-hour TTL. After 1 hour, the application renews its token, extending the TTL by another 2 hours. What happens to the secrets stored in the cubbyhole? (Select one!)
AThe cubbyhole secrets are deleted and must be rewritten after renewal
BThe cubbyhole secrets remain accessible with the same token
CThe cubbyhole secrets expire after the original 2-hour TTL regardless of renewal
DThe cubbyhole secrets are moved to a new cubbyhole namespace
Explanation
Cubbyhole secrets are scoped to a token and persist as long as that token exists. When a token is renewed, it remains the same token with an extended TTL, so all cubbyhole data remains accessible. The cubbyhole is only destroyed when the token itself expires or is revoked. Renewal does not delete or reset cubbyhole contents. The cubbyhole namespace is tied to the specific token ID and does not change during renewal. Cubbyhole secrets do not have independent TTLs; their lifetime is bound to the token's lifetime.
5. A DevOps engineer creates a token using the command: vault token create -period=12h -policy=app-policy. The token is successfully created at 09:00 AM with an initial TTL of 12 hours. At 02:00 PM (5 hours later), the engineer renews the token without specifying an increment. What will be the token's new expiration time? (Select one!)
A09:00 AM next day (extends by original 12-hour period)
B09:00 PM (original expiration time remains unchanged)
CThe renewal fails because periodic tokens cannot be renewed without sudo capability
D02:00 AM next day (12 hours from renewal time)
Explanation
Periodic tokens reset their TTL to the configured period value upon each successful renewal. When renewed at 02:00 PM, the 12-hour period resets from the current time, making the new expiration 02:00 AM the next day. This is the key characteristic that distinguishes periodic tokens - they can be renewed indefinitely as long as renewal occurs within each period. The original expiration time does not remain unchanged for periodic tokens. The period does not extend from the original creation time. Periodic tokens can be renewed by the token holder without requiring sudo capability.
$17.99
One-time access to this exam
622 questions (10 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available