HashiCorp • Vault-Associate

HashiCorp Certified: Vault Associate Practice Test

Validates knowledge of HashiCorp Vault for secrets management and data protection, covering authentication methods, policies and tokens, lease management, static and dynamic secrets engines, encryption as a service, and Vault architecture including high availability.

Exam Details

Questions

622

Duration

60 minutes

Passing Score

70%

Difficulty

Associate

Last Updated

Feb 2026

Exam Overview

The HashiCorp Certified: Vault Associate (003) validates foundational knowledge and hands-on skills with HashiCorp Vault, the industry-standard platform for secrets management and data protection. The exam tests candidates on Vault's core mechanics: accessing Vault through the UI, CLI, and API; managing authentication methods, tokens, and policies; working with static and dynamic secrets engines including Key/Value, Database, and Identity engines; managing leases and renewals; and leveraging the Transit secrets engine for encryption as a service (EaaS). The current exam version tests against Vault 1.16 and covers both the open-source Community Edition and Enterprise features.

Candidates are also evaluated on Vault architecture, including high-availability deployment models, Vault Agent, the Vault Secrets Operator for Kubernetes, HCP Vault Dedicated on the cloud, and replication strategies. The certification is delivered through Certiverse, HashiCorp's online proctored testing platform, and is valid for two years. It serves as the foundation for advanced HashiCorp security certifications and is recognized across cloud-native and regulated enterprise environments.

Official exam page

Who Should Take This Exam

This certification is designed for Cloud Engineers with foundational Vault experience who specialize in security, development, or operations. It is well-suited for DevOps engineers, Site Reliability Engineers (SREs), platform engineers, security engineers, and developers who integrate secrets management into cloud-native applications and pipelines.

Candidates working in environments that use Kubernetes, cloud infrastructure (AWS, Azure, GCP), or CI/CD platforms where secrets must be securely injected and managed will find this certification most relevant. It is an associate-level credential, meaning it targets practitioners who understand Vault's core concepts and can operate it in a production or demo environment, rather than those with deep architectural design experience.

Prerequisites

There are no formal prerequisites required to sit for the exam. However, HashiCorp recommends that candidates have basic terminal competency, a foundational understanding of on-premises or cloud infrastructure, and a basic level of security knowledge before attempting the exam.

Practical experience using Vault in a production environment provides the strongest preparation, though candidates who have worked through all exam objectives in a personal or lab environment may also be ready. Familiarity with concepts such as authentication flows, PKI, database credential rotation, and Kubernetes secret injection will be advantageous, even if not explicitly required.

Exam Format

The Vault Associate (003) exam is a multiple-choice, online-proctored assessment delivered through Certiverse via HashiCorp's Certification Portal (GitHub login required). The exam duration is 1 hour, though candidates should budget approximately 90 minutes total to account for setup and identity verification. Question formats include standard multiple choice, true/false, scenario-based questions, and UI area-selection items.

HashiCorp does not publicly disclose the exact number of questions or a numerical passing score threshold — results are displayed as pass/fail immediately upon completion. A domain-level performance breakdown is typically made available within two business days. The exam costs $70.50 USD plus applicable taxes. Candidates who do not pass must wait 7 days before retaking and are limited to four attempts within a rolling year. Credentials are valid for 2 years, with recertification eligibility beginning at 18 months.

Skills Measured

1.Authentication Methods: Differentiate between human-centric and machine-oriented authentication methods (e.g., userpass, LDAP, AppRole, AWS, Kubernetes); manage entities and groups; choose the appropriate auth method for a given use case.
2.Vault Policies: Understand the deny-by-default model; write and apply HCL policy syntax; configure path-based access controls using capabilities (create, read, update, delete, list, sudo); manage policies via CLI and UI.
3.Vault Tokens: Distinguish between service tokens and batch tokens; understand root tokens and token accessors; configure TTL and max TTL; manage token hierarchies and orphan tokens.
4.Vault Leases: Understand the lease lifecycle for dynamic secrets; renew and revoke leases manually; configure default and max lease TTLs; understand the impact of lease expiration on downstream systems.
5.Secrets Engines: Enable, configure, and operate secrets engines including Key/Value (v1 and v2), Database (dynamic credentials), PKI, SSH, and Identity; differentiate between static and dynamic secrets; understand secret versioning and metadata in KV v2.
6.Encryption as a Service: Use the Transit secrets engine to encrypt and decrypt data without storing it in Vault; understand key rotation, convergent encryption, and the use of Transit for application-layer data protection.
7.Vault Architecture Fundamentals: Understand Vault's storage backends, barrier encryption, seal/unseal process (Shamir's Secret Sharing and auto-unseal), audit devices, and the difference between dev mode and production deployments.
8.Vault Deployment Architecture: Configure high-availability (HA) with integrated storage (Raft); understand replication types (performance and disaster recovery) available in Vault Enterprise; understand HCP Vault Dedicated as a managed offering.
9.Access Management Architecture: Understand Vault Agent for secret injection and token renewal; use the Vault Secrets Operator for Kubernetes-native secret synchronization; distinguish between Community Edition and Enterprise feature sets.

Study Tips

Complete the official HashiCorp Developer learning path for Vault Associate (003) at developer.hashicorp.com/vault/tutorials/associate-cert-003, which maps directly to every exam objective and includes hands-on interactive labs.
Stand up a local Vault dev server (vault server -dev) to practice CLI commands for enabling secrets engines, writing policies, creating tokens, and configuring auth methods — exam questions often test exact command syntax and flags.
Use the official Vault Associate (003) sample questions published by HashiCorp to familiarize yourself with the question style, including scenario-based and UI area-selection formats that differ from standard multiple choice.
Pay close attention to the differences between Vault Community Edition and Enterprise features (e.g., performance replication, DR replication, namespaces, HSM auto-unseal) — the exam explicitly tests your ability to distinguish between them.
Practice writing HCL policies from scratch and understand the deny-by-default model deeply; know how capabilities like 'sudo' and 'deny' interact, and how wildcard path matching works in policy definitions.
Review the Vault architecture documentation on seal/unseal mechanisms (Shamir's Secret Sharing vs. auto-unseal via cloud KMS), integrated Raft storage, and HA configuration — these architectural concepts appear consistently in exam scenarios.
For dynamic secrets, practice the full lifecycle with the Database secrets engine: configure a connection, create a role, generate credentials, observe lease behavior, and manually revoke leases to reinforce the concepts tested in objectives 4 and 5.

Career Benefits

The Vault Associate certification signals verified competence in secrets lifecycle management, a skill set in high demand across DevOps, platform engineering, and security-focused roles. Organizations running cloud-native workloads on Kubernetes, AWS, Azure, or GCP routinely list Vault experience as a requirement in job postings for SRE, DevSecOps, and cloud security engineer roles. HashiCorp reports that 88% of exam takers agree that passing an Associate-level exam makes job candidates more desirable to employers. Vault has become the de facto standard for secrets management in enterprises operating in regulated industries (financial services, healthcare, government), making this certification particularly valuable for practitioners in those sectors.

Professionals specializing in HashiCorp tooling report average salaries in the range of $80,000 per year according to PayScale, with senior cloud security and platform engineering roles often commanding significantly more. The $70.50 exam fee and two-year validity period make it a high-ROI credential. It also serves as a stepping stone to the HashiCorp Vault Operations Professional certification, which targets advanced deployment and architectural design skills.

Sample Questions

Preview — answers shown

5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 622 questions.

1. An application team uses the Transit secrets engine to encrypt 5GB data files. Vault returns an error indicating the request payload is too large. Which approach should the team implement to encrypt large files using Vault? (Select one!)

ASplit the file into smaller chunks and encrypt each chunk separately with Transit

BUse the Transit batch encryption endpoint to process large files

CIncrease the max_request_size parameter in Vault's listener configuration

DUse Transit to generate a datakey, encrypt the file locally with the datakey, and store the encrypted datakey with the file

Explanation

Envelope encryption is the correct pattern for large files. The application requests a datakey from Transit, uses that high-entropy key to encrypt the file locally, then stores the Transit-encrypted datakey alongside the encrypted file. This avoids transmitting large payloads to Vault while maintaining key security. Splitting files into chunks creates operational complexity and performance issues. Increasing max_request_size does not address the fundamental architectural limitation for very large payloads. Batch encryption processes multiple small plaintexts in one request, not single large files.

2. A startup uses Vault tokens for application authentication. The security team identifies performance degradation due to high token creation rates exceeding 50,000 tokens per hour for short-lived CI/CD pipeline jobs. Each pipeline job authenticates, retrieves a single secret, and completes within 5 minutes. The team needs a solution that maintains security while improving token creation throughput. Which token configuration should they implement? (Select one!)

AUse orphan service tokens to reduce parent-child tracking overhead

BConfigure service tokens with explicit-max-ttl set to 5 minutes to limit token lifetime

CCreate periodic tokens with 5-minute renewal periods for each pipeline job

DImplement batch tokens with TTL set to 5 minutes for CI/CD authentication

Explanation

Batch tokens are specifically designed for high-volume, short-lived scenarios like CI/CD pipelines. They are lightweight encrypted blobs that require no storage persistence, significantly reducing overhead compared to service tokens. Since the jobs only need 5 minutes of access and don't require renewal or child token creation, batch tokens are ideal. Service tokens with explicit-max-ttl would still incur full storage overhead. Periodic tokens require renewal capability which batch tokens don't support and adds unnecessary complexity. Orphan service tokens reduce some overhead but still require full storage persistence and tracking unlike batch tokens.

3. A Vault administrator notices extremely slow write performance when creating thousands of service tokens for a batch processing system. The tokens need 20-minute lifetimes and do not require renewal or child token creation. Which change improves performance while meeting functional requirements? (Select one!)

ASwitch from service tokens to batch tokens using vault token create -type=batch

BImplement periodic tokens with 20-minute periods to reduce storage overhead

CConfigure token roles with orphan=true to eliminate parent-child tracking

DEnable token caching with vault agent cache for faster token retrieval

Explanation

Batch tokens are extremely lightweight encrypted blobs that require no storage persistence, making them ideal for high-volume scenarios. Since the requirements don't need renewal or child tokens (both unavailable with batch tokens), switching to batch tokens eliminates storage overhead and dramatically improves performance. Token caching helps with token reuse but doesn't address the creation performance bottleneck. Periodic tokens must be service tokens and still require storage, so they don't improve write performance. Orphan tokens eliminate parent-child relationships but service tokens still require storage tracking regardless of orphan status.

4. A development team configures path templating in a policy to provide user-specific secret access: path "secret/data/{{identity.entity.name}}/*" { capabilities = ["create", "read", "update", "delete", "list"] } A user authenticates via the userpass auth method with username alice. The entity associated with this authentication has entity name alice-entity and entity ID ent_abc123. Which path will the user be able to access? (Select one!)

Asecret/data/alice-entity/*

Bsecret/data/{{identity.entity.name}}/*

Csecret/data/alice/*

Dsecret/data/ent_abc123/*

Explanation

The template {{identity.entity.name}} is replaced with the entity name, not the username from the auth method. In this case, the entity name is alice-entity, so the resolved path becomes secret/data/alice-entity/*. The username alice from userpass is stored in the entity alias but does not directly populate the entity name template variable. The entity ID ent_abc123 would be used if the template specified {{identity.entity.id}}. The literal template string is not used as the path - Vault resolves the template at policy evaluation time.

5. A security architect designs a policy where most users can read secrets at path secret/data/apps/*, but a specific path secret/data/apps/admin/* must be completely inaccessible to these users even if other policies grant access. Which capability ensures complete blocking regardless of other policy grants? (Select one!)

AUse deny capability on the admin path

BSet read capability to false on the admin path

CRemove all capabilities from the path

DUse sudo capability to restrict access to privileged users only

Explanation

The deny capability takes absolute precedence over all other capabilities regardless of what other policies grant. When deny is present on a path, access is completely blocked even if other policies attached to the token grant read, write, or other permissions. This provides an explicit override mechanism for security-critical paths. Removing all capabilities from a path in one policy does not prevent other policies from granting access. Setting capabilities to false is invalid syntax. The sudo capability is for accessing root-protected paths and does not restrict access; it enables access to privileged operations.

One-time access to this exam

Full access to all 622 questions

Or $15/mo for all 201 exams

Detailed explanations

Free preview stays available