HCVA0-003 HashiCorp Certified: Vault Associate (003)Exam Free Practice Exam Questions (2025 Updated)

Comprehensive and Detailed in Depth Explanation:

A:Matches dev policy and num_uses=5. TTL is system default (768h). Correct.

B:Missing num_uses. Incorrect.

C:Adds default policy explicitly, not needed as it’s implicit. Incorrect.

D:Missing num_uses. Incorrect.

Overall Explanation from Vault Docs:

“vault token create with -policy and -use-limit sets specific attributes… default policy is included implicitly.”

Comprehensive and Detailed in Depth Explanation:

KV v2 supports versioning. Let’s evaluate:

A:destroy removes a specific version permanently. Correct.

B:destroy targets specified versions, not all. Incorrect.

C:delete soft-deletes the current version. Correct.

D:metadata delete removes all versions and metadata. Correct.

Overall Explanation from Vault Docs:

“kv delete soft-deletes… kv destroy permanently removes versions… kv metadata delete wipes everything.”

Comprehensive and Detailed in Depth Explanation:

A:Dev mode is faster to deploy; incorrect.

B:Production uses persistent storage vs. dev’s in-memory. Correct.

C:Auth methods work in both modes. Incorrect.

D:Production enables TLS; dev uses plaintext. Correct.

Overall Explanation from Vault Docs:

“Dev server mode stores data in memory… Production mode supports persistent storage and TLS encryption.”

Comprehensive and Detailed in Depth Explanation:

A:Incorrect. min_decryption_version sets the minimum key version, not length.

B:Correct. It controls versioning, not key size.

Overall Explanation from Vault Docs:

“min_decryption_version specifies the minimum key version for decryption… Key length is a separate configuration.”

Comprehensive and Detailed in Depth Explanation:

Vault can generate time-based one-time passwords (TOTP) for multi-factor authentication (MFA), mimicking apps like Google Authenticator. Let’s evaluate:

Option A: CubbyholeCubbyhole is a per-token secret store, not a TOTP generator. It’s for temporary secretstorage, not MFA code generation. Incorrect.Vault Docs Insight:“Cubbyhole stores secrets tied to a token… no TOTP functionality.” (Different purpose.)

Option B: The random byte generatorVault’s /sys/tools/random endpoint generates random bytes, not time-based codes synced with a clock (TOTP requirement). It’s for generic randomness, not MFA. Incorrect.Vault Docs Insight:“Random bytes are not time-based… unsuitable for TOTP.” (Unrelated feature.)

Option C: TOTP secrets engineThe TOTP engine generates and validates TOTP codes (e.g., 6-digit codes every 30s) using a shared secret, just like Google Authenticator. You create a key (vault write totp/keys/my-key) and fetch codes (vault read totp/code/my-key). Perfect for programmatic MFA. Correct.Vault Docs Insight:“The TOTP secrets engine can act as a TOTP code generator… replacing traditional generators like Google Authenticator.” (Exact match.)

Option D: The identity secrets engineThe Identity engine manages user/entity identities and policies, not TOTP codes. It’s for identity management, not MFA generation. Incorrect.Vault Docs Insight:“Identity engine handles identity data… no TOTP generation.” (Different scope.)

Detailed Mechanics:

Enable: vault secrets enable totp. Create key: vault write totp/keys/my-key issuer=Vault. Get code: vault read totp/code/my-key returns {"data":{"code":"123456"}}. Codes sync with time (RFC 6238), usable in APIs or apps.

Overall Explanation from Vault Docs:

“The TOTP secrets engine can act as a TOTP code generator… It provides an added layer of security since the ability to generate codes is guarded by policies and audited.”

Comprehensive and Detailed in Depth Explanation:

A:period indicates a renewable periodic token. Correct.

Overall Explanation from Vault Docs:

“A periodic token has a period… renewable without a max TTL.”

Comprehensive and Detailed in Depth Explanation:

In HashiCorp Vault, authentication methods (auth methods) are mechanisms that allow users or machines to authenticate and obtain a token. When an auth method like userpass is enabled, it is mounted at a specific path in Vault’s namespace, and this path determines where operators interact with it—e.g., to log in, configure, or manage it.

The userpass auth method is enabled with the command vault auth enable -path=users userpass, meaning it’s explicitly mounted at the users/ path. However, Vault’s authentication system has a standard convention: all auth methods are accessed under the auth/ prefix, followed by the mount path. This prefix is a logical namespace separating authentication endpoints from secrets engines or system endpoints.

Option A: users/auth/This reverses the expected order. The auth/ prefix comes first, followed by the mount path (users/), not the other way around. This path would not correspond to any valid Vault endpoint for interacting with the userpass auth method. Incorrect.

Option B: authentication/usersVault does not use authentication/ as a prefix; it uses auth/. The term “authentication” is not part of Vault’s path structure—it’s a conceptual term, not a literal endpoint. This makes the path invalid and unusable in Vault’s API or CLI. Incorrect.

Option C: auth/usersThis follows Vault’s standard convention: auth/ (the authentication namespace) followed by users (the custom mount path specified when enabling the auth method). For example, to log in using the userpass method mounted at users/, the command would be vault login -method=userpass -path=users username=. The API endpoint would be /v1/auth/users/login. This is the correct path for operators to interact with the auth method, whether via CLI, UI, or API. Correct.

Option D: users/While users/ is the mount path, omitting the auth/ prefix breaks Vault’s structure. Directly accessing users/ would imply it’s a secrets engine or other mount type, not an auth method. Auth methods always require the auth/ prefix for interaction. Incorrect.

Detailed Mechanics:

When an auth method is enabled, Vault creates a backend at the specified path under auth/. The userpass method, for instance, supports endpoints like /login (for authentication) and /users/ (for managing users). If mounted at users/, these become auth/users/login and auth/users/users/. This structure ensures isolation and clarity in Vault’s routing system. The ability to customize the path (e.g., users/ instead of the default userpass/) allows flexibility for organizations with multiple auth instances, but the auth/ prefix remains mandatory.

Overall Explanation from Vault Docs:

“When enabled, auth methods are mounted within the Vault mount table under the auth/ prefix… For example, enabling userpass at users/ allows interaction at auth/users.” This convention ensures operators can consistently locate and manage auth methods, regardless of custom paths.

Running the second command in the GUI CLI will fail. The second command is vault kv put secret/creds passcode=my-long-passcode. This command attempts to write a secret named creds with the value passcode=my-long-passcode to the secret path, which is the default path for the kv secrets engine. However, the kv secrets engine is not enabled at the secret path, as shown by the first command vault secrets list, which lists the enabled secrets engines and their paths. The only enabled secrets engine is the transit secrets engine at the transit path. Therefore, the second command will fail with an error message saying that no secrets engine is mounted at the path secret/. To make the second command succeed, the kv secrets engine must be enabled at the secret path or another path, using the vault secrets enable command. For example, vault secrets enable -path=secret kv would enable the kv secrets engine at the secret path. References: kv - Command | Vault | HashiCorp Developer, vault secrets enable - Command | Vault | HashiCorp Developer

The PKI secrets engine is designed to support the use case of reducing and ultimately removing the use of long lived X.509 certificates. The PKI secrets engine can generate dynamic X.509 certificates on demand, with short time-to-live (TTL) and automatic revocation. This eliminates the need for manual processes of generating, signing, and rotating certificates, and reduces the risk of certificate compromise or misuse. The PKI secrets engine can also act as a certificate authority (CA) or an intermediate CA, and can integrate with external CAs or CRLs. The PKI secrets engine can issue certificates for various purposes, such as TLS, SSH, code signing, email encryption, etc. References: https://developer.hashicorp.com/vault/docs/secrets/pki 1, https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-dynamic- secrets

Integrated Storage is a Raft-based storage backend that allows Vault to store its data internally without relying on an external storage system. It also enables Vault to run in high availability mode with automatic leader election and failover. However, Integrated Storage is not immune to data loss or corruption due to hardware failures, network partitions, or human errors. Therefore, it is recommended to use the snapshot feature to backup and restore the Vault data periodically or on demand. A snapshot is a point-in-time capture of the entire Vault data, including the encrypted secrets, the configuration, and the metadata. Snapshots can be taken and restored using the vault operator raft snapshot command or the sys/storage/raft/snapshot API endpoint. Snapshots are encrypted and can only be restored with a quorum of unseal keys or recovery keys. Snapshots are also portable and can be used to migrate data between different Vault clusters or storage backends. References: https://developer.hashicorp.com/vault/docs/concepts/integrated-storage 1, https://developer.hashicorp.com/vault/docs/commands/operator/raft/snapshot 2, https://developer.hashicorp.com/vault/api-docs/system/storage/raft/snapshot 3

The Vault’s auth method component is the component that performs authentication and assigns identity and policies to a client. It verifies a client against an internal or external system, and generates a token with the appropriate policies attached. The token can then be used to access the secrets and resources that are authorized by the policies. Vault supports various auth methods, such as userpass, ldap, aws, kubernetes, etc., that can integrate with different identity providers and systems. The auth method component can also handle token renewal and revocation, as well as identity grouping and aliasing. References: Auth Methods | Vault | HashiCorp Developer, Authentication - Concepts | Vault | HashiCorp Developer

This screenshot is shown when you are enabling authentication methods in the GUI. Authentication methods are the ways users and applications authenticate with Vault. Vault supports many different authentication methods, including username and password, GitHub, and more. You can enable one or more authentication methods from the grid of options, which are divided into three categories: Generic, Cloud, and Infra. Each option has a name, a description, and a logo. You can also enable authentication methods using the Vault CLI or API.

Enabling policies, authentication engines, and secret engines are different tasks that are not related to this screenshot. Policies are rules that govern the access to Vault resources, such as secrets, authentication methods, and audit devices. Authentication engines are components of Vault that perform authentication and assign policies to authenticated entities. Secret engines are components of Vault that store, generate, or encrypt data. These tasks have different GUI pages and options than the screenshot.

The statement is false. The Vault encryption key is not stored in Vault’s backend storage, but rather in Vault’s memory. The Vault encryption key is the key that is used to encrypt and decrypt the data that is stored in Vault’s backend storage, such as secrets, tokens, policies, etc. The Vault encryption key is derived from the master key, which is generated when Vault is initialized. The master key is split into unseal keys using Shamir’s secret sharing algorithm, and the unseal keys are distributed to trusted operators. To start Vault, a quorum of unseal keys is required to reconstruct the master key and derive theencryption key. The encryption key is then kept in memory and used to protect the data in Vault’s backend storage. The encryption key is never written to disk or exposed via the API. References: Seal/Unseal | Vault | HashiCorp Developer, Key Rotation | Vault | HashiCorp Developer

The statement is false. An organization can authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret using more than one authentication method. The AWS auth method is one of the options, but not the only one. The AWS auth method supports two types of authentication: ec2 and iam. The ec2 type uses the signed EC2 instance identity document to authenticate the EC2 instance. The iam type uses the AWS Signature v4 algorithm to sign a request to the sts:GetCallerIdentity API and authenticate the IAM principal. However, the organization can also use other auth methods that are compatible with EC2 instances, such as AppRole, JWT/OIDC, or Kubernetes. These methods require the EC2 instance to have some sort of identity material, such as a role ID, a secret ID, a JWT token, or a service account token, that can be used to authenticate to Vault. The identity material can be provisioned to the EC2 instance using various mechanisms, such as user data, metadata service, or cloud-init scripts. The choice of the auth method depends on the use case, the security requirements, and the trade-offs between convenience and control. References: AWS - Auth Methods | Vault | HashiCorp Developer, AppRole - Auth Methods | Vault | HashiCorp Developer, JWT/OIDC - Auth Methods | Vault | HashiCorp Developer, Kubernetes - Auth Methods | Vault | HashiCorp Developer

The CLI command vault login -method ldap username=mitchellh generates a token that is response wrapped. This means that the token contains a base64-encoded response wrapper, which is a JSON object that contains information about the token, such as its policies, metadata, and expiration time. The response wrapper is used to verify the authenticity and integrity of the token, and to prevent replay attacks. The response wrapper also allows Vault to automatically renew the token when it expires, or to revoke it if it is compromised. The -method ldap option specifies that the authentication method is LDAP, which requires a username and password to be provided. The username mitchellh is an example of an LDAP user name, and the password will be hidden when entered. References: Vault CLI Reference | Vault | HashiCorp Developer, Vault CLI Reference | Vault | HashiCorp Developer

The three policies that exist in Vault are:

admins: This policy grants full access to all secrets and operations in Vault. It can be used by administrators or operators who need to manage all aspects of Vault.

default: This policy grants access to all secrets and operations in Vault except for those that require specific policies. It can be used as a fallback policy when no other policy matches.

transit: This policy grants access only to the transit secrets engine, which handles cryptographic functions on data in-transit. It can be used by applications or services that need to encrypt or decrypt data using Vault.

These policies allow an organization to perform useful tasks such as:

Encrypting, decrypting, and rewrapping data using the transit engine all in one policy: This policy grants access to both the transit secrets engine and the default policy, which allows performing any operation on any secret in Vault.

Creating a transit encryption key for encrypting, decrypting, and rewrapping encrypted data: This policy grants access only to the transit secrets engine and its associated keys, which are used for encrypting and decrypting data in transit using AES-GCM with a 256-bit AES key or other supported key types.

Separating permissions allowed on actions associated with the transit secret engine: This policy grants access only to specific actions related to the transit secrets engine, such as creating keys or wrapping requests. It does not grant access to other operations or secrets in Vault.

The environment variable VAULT_ADDR overrides the CLI’s default Vault server address. The VAULT_ADDR environment variable specifies the address of the Vault server that is used to communicate with Vault from other applications or processes. By setting this variable, you can avoid hard-coding the Vault server address in your code or configuration files, and you can also use different addresses for different environments or scenarios. For example, you can use a local development server for testing purposes, and a production server for deploying your application. References: Commands (CLI) | Vault | HashiCorp Developer, Vault Agent - secrets as environment variables | Vault | HashiCorp Developer

In the HashiCorp Vault UI, secrets are organized in a tree-like structure. To view a secret located at secret/my-secret, you would click on the “secret/” folder in the tree, then click on the “my-secret” file. In this screenshot, the “secret/” folder is located at option C. This folder contains the secrets that are stored in the key/value secrets engine, which is the default secrets engine in Vault. The key/value secrets engine allows you to store arbitrary secrets as key/value pairs. The key is the path of the secret, and the value is the data of the secret. For example, the secret located at secret/my-secret has a key of “my-secret” and a value of whatever data you stored there.

The payload.json file that has the correct contents is C. This file contains a JSON object with a single key, “plaintext”, and a value that is the base64-encoded string of the data to be encrypted. This is the format that the Vault API expects for the transit encrypt endpoint1. The other files are not correct because they either have the wrong key name, the wrong value format, or the wrong JSON syntax.