HCVA0-003 HashiCorp Certified: Vault Associate (003) Exam Free Practice Exam Questions (2026 Updated)

The statement is false. HCP Vault Dedicated supports cross-region disaster recovery, but it is not automatically enabled by default for every cluster. It must be enabled and configured as part of the HCP Vault Dedicated cluster architecture. HashiCorp documentation describes a setup process for enabling cross-region DR, including creating a cross-region HVN and enabling DR for new or existing clusters. That wording matters: a supported feature is not the same as an automatically enabled feature. Disaster recovery replication is an Enterprise/HCP capability used to protect against catastrophic failure and maintain continuity, but operators must deliberately configure it. Therefore, the correct answer is False. HashiCorp’s HCP cluster management documentation explicitly refers to enabling cross-region DR rather than it being automatic.

================

The requirement is to enable a versioned Key/Value secrets engine at a custom mount path named my-secrets. KV version 2 can be enabled either by specifying kv-v2 as the plugin type or by enabling kv with the -version=2 flag and a path. Among the provided options, only vault secrets enable -path= " my-secrets " kv-v2 both enables the correct versioned KV engine and places it at the requested path. Option A enables an authentication method, not a secrets engine. Option C enables the KV engine but does not explicitly select KV version 2. Option D selects version 2 but does not set the required custom path. HashiCorp’s KV v2 setup documentation confirms that kv-v2 can be used directly with vault secrets enable -path < mount_path > .

================

When unsealing Vault, each Shamir unseal key should be entered by different administrators each connecting from different computers. This is because the Shamir unseal keys are split into shares that are distributed to trusted operators, and no single operator should have access to more than one share. This way, the unseal process requires the cooperation of a quorum of key holders, and enhances the security and availability of Vault. The unseal keys can be entered via multiple mechanisms from multiple client machines, and the process is stateful. The order of the keys does not matter, as long as the threshold number of keys is reached. The unseal keys should not be entered at the command line in one single command, as this would expose them to the history and compromise the security.  The unseal keys should not be encrypted with each administrator’s PGP key, as this would prevent Vault from decrypting them and reconstructing the master key.  References: https://developer.hashicorp.com/vault/docs/concepts/seal 3 , https://developer.hashicorp.com/vault/docs/commands/operator/unseal

These three policies separate Transit engine duties by endpoint. The app.hcl policy allows use of transit/encrypt/my_app_key, so an application can encrypt data. The callcenter.hcl policy allows transit/decrypt/my_app_key, so a different group can decrypt data. The rewrap.hcl policy allows reading key metadata and using the rewrap endpoint, so encrypted data can be upgraded after key rotation without exposing plaintext. This is not one combined policy; it is a separation-of-duties design. It also does not create a Transit key, because key creation would require access to the appropriate key-management endpoint, not just encrypt, decrypt, read, and rewrap paths. HashiCorp documents Transit as cryptography as a service and confirms that policies can restrict specific Transit operations by endpoint.

================

Vault authentication methods are enabled with the vault auth enable command. Since the required authentication method is AppRole, the correct command is vault auth enable approle. AppRole is designed for machine and application authentication, where a workload authenticates using a RoleID and SecretID pattern. Option B is invalid modern Vault syntax; vault mount is not the command used to enable auth methods. Option C is also incorrect because mount enable is not the proper command structure. Option D is incomplete and does not specify the auth command group. HashiCorp’s AppRole and operations quick-start documentation show AppRole being enabled with vault auth enable approle, which directly matches option A.

================

Vault supports CIDR-bound tokens, which are tokens that can only be used from a specific set of IP addresses or network ranges. This is a way to limit the scope and exposure of a token in case it is compromised or leaked. CIDR-bound tokens can be created by specifying the bound_cidr_list parameter when creating or updating a token role, or by using the -bound-cidr option when creating a token using the vault token create command. CIDR-bound tokens can also be created by some auth methods, such as AWS or Kubernetes, that can automatically bind the tokens to the source IP or network of the client. References:  Token - Auth Methods | Vault | HashiCorp Developer ,  vault token create - Command | Vault | HashiCorp Developer

Running the second command in the GUI CLI will fail. The second command is vault kv put secret/creds passcode=my-long-passcode. This command attempts to write a secret named creds with the value passcode=my-long-passcode to the secret path, which is the default path for the kv secrets engine. However, the kv secrets engine is not enabled at the secret path, as shown by the first command vault secrets list, which lists the enabled secrets engines and their paths. The only enabled secrets engine is the transit secrets engine at the transit path. Therefore, the second command will fail with an error message saying that no secrets engine is mounted at the path secret/. To make the second command succeed, the kv secrets engine must be enabled at the secret path or another path, using the vault secrets enable command. For example, vault secrets enable -path=secret kv would enable the kv secrets engine at the secret path. References:  kv - Command | Vault | HashiCorp Developer ,  vault secrets enable - Command | Vault | HashiCorp Developer

This policy would allow read permissions for all secrets at path secret/bar, as well as list permissions for the secret/bar/ path.  The list permission is required to be able to see the names of the secrets under a given path 1 . The wildcard ( ) character matches any number of characters within a single path segment, while the slash (/) character matches the end of the path 2 . Therefore, the policy would grant read access to any secret that starts with secret/bar/, such as secret/bar/foo or secret/bar/baz, but not to secret/bar itself. To grant list access to secret/bar, the policy needs to specify the exact path with a slash at the end.  This policy follows the principle of least privilege, which means that it only grants the minimum permissions necessary for the users to perform their tasks 3 .

The other options are not correct because they either grant too much or too little permissions. Option A would grant both read and list permissions to all secrets under secret/bar, which is more than what is required. Option B would grant list permissions to all secrets under secret/bar, but only read permissions to secret/bar itself, which is not what is required. Option D would use an invalid character (+) in the policy, which would cause an error.

The Identity secrets engine is the correct solution because it lets Vault consolidate multiple authentication aliases into one entity. A user may authenticate through GitHub, LDAP, Active Directory, or another auth method, but Vault can map those accounts to the same entity. Policies can then be attached to the entity or inherited through identity groups, allowing one consistent access model regardless of which identity provider the user used to log in. OIDC and LDAP are individual authentication methods; they do not, by themselves, unify multiple identity-provider accounts into one Vault identity. Tokens are issued after authentication and carry policies, but they are not the identity-mapping mechanism. HashiCorp documents that Vault Identity ties authentications from different auth methods into one entity with aliases.

================

A Vault lease is revoked by referencing the lease ID. When Vault returns a dynamic secret, such as database credentials, it includes a lease_id. That lease ID is the handle used by lease management commands, including vault lease renew and vault lease revoke. A Secret ID is associated with AppRole authentication and is not the identifier used to revoke a dynamic secret lease. A user ID is not used for lease revocation. A token ID may be used for token operations, but Vault leases for dynamic secrets are managed through lease-specific commands and lease IDs. The exam point is direct: if the task is to revoke leased dynamic credentials, the operator needs the lease ID returned with those credentials. HashiCorp’s lease documentation states that clients use the lease ID to renew or revoke a secret.

================

Vault Agent is a client daemon that provides the following features:

Auto-Auth - Automatically authenticate to Vault and manage the token renewal process for locally-retrieved dynamic secrets.

API Proxy - Allows Vault Agent to act as a proxy for Vault’s API, optionally using (or forcing the use of) the Auto-Auth token.

Caching - Allows client-side caching of responses containing newly created tokens and responses containing leased secrets generated off of these newly created tokens. The agent also manages the renewals of the cached tokens and leases.

Templating - Allows rendering of user-supplied templates by Vault Agent, using the token generated by the Auto-Auth step.

Process Supervisor Mode - Runs a child process with Vault secrets injected as environment variables.

One of the benefits of using the Vault Agent is that it will manage the lifecycle of cached tokens and leases automatically. This means that the agent will handle the token renewal and revocation logic, as well as the lease renewal and revocation logic for the secrets that are cached by the agent. This reduces the burden on the application developers and operators, and ensures that the tokens and secrets are always valid and up-to-date.  References :  Vault Agent | Vault | HashiCorp Developer ,  Caching - Vault Agent | Vault | HashiCorp Developer

To give a role the ability to display or output all of the end points under the /secrets/apps/* end point, it would need to have the list capability set. The list capability allows a role to perform any operation on any path in Vault, including reading, writing, deleting, and listing. The list capability is required for roles that need to access sensitive data or perform administrative tasks in Vault. The other capabilities are not relevant for this scenario, as they only allow specific operations on specific paths or secrets engines. References:  Policies | Vault | HashiCorp Developer ,  token capabilities - Command | Vault | HashiCorp Developer

Vault Agent Caching improves client-side performance by caching eligible responses, including newly created tokens and leased dynamic secrets generated from those tokens. This can reduce latency because the client may receive a response from the local cache instead of waiting for a round trip to the Vault server. It can also reduce load on Vault servers because repeated eligible requests do not always need to be forwarded upstream. It does not reduce the number of secrets engines that must be mounted; secrets engines are still configured based on use case. Rendering secrets with Consul Template markup is a Vault Agent templating feature, not specifically a caching benefit. Caching also does not replace disaster recovery replication, which solves a different availability problem. HashiCorp documents that Vault Agent caching stores token and leased-secret responses and manages renewals.

The statement is false. An organization can authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret using more than one authentication method. The AWS auth method is one of the options, but not the only one. The AWS auth method supports two types of authentication: ec2 and iam. The ec2 type uses the signed EC2 instance identity document to authenticate the EC2 instance. The iam type uses the AWS Signature v4 algorithm to sign a request to the sts:GetCallerIdentity API and authenticate the IAM principal. However, the organization can also use other auth methods that are compatible with EC2 instances, such as AppRole, JWT/OIDC, or Kubernetes. These methods require the EC2 instance to have some sort of identity material, such as a role ID, a secret ID, a JWT token, or a service account token, that can be used to authenticate to Vault. The identity material can be provisioned to the EC2 instance using various mechanisms, such as user data, metadata service, or cloud-init scripts. The choice of the auth method depends on the use case, the security requirements, and the trade-offs between convenience and control. References:  AWS - Auth Methods | Vault | HashiCorp Developer ,  AppRole - Auth Methods | Vault | HashiCorp Developer ,  JWT/OIDC - Auth Methods | Vault | HashiCorp Developer ,  Kubernetes - Auth Methods | Vault | HashiCorp Developer

The environment variable VAULT_ADDR overrides the CLI’s default Vault server address. The VAULT_ADDR environment variable specifies the address of the Vault server that is used to communicate with Vault from other applications or processes. By setting this variable, you can avoid hard-coding the Vault server address in your code or configuration files, and you can also use different addresses for different environments or scenarios. For example, you can use a local development server for testing purposes, and a production server for deploying your application. References:  Commands (CLI) | Vault | HashiCorp Developer ,  Vault Agent - secrets as environment variables | Vault | HashiCorp Developer

The correct flag is -period=24h because it creates a periodic token. A periodic token receives a fixed renewal period, and every renewal uses that period. As long as the token is actively renewed and no explicit maximum TTL is imposed, it can continue to be renewed indefinitely. The -ttl=24h flag only sets the initial TTL; normal token renewal is still constrained by maximum TTL values from the token, mount, auth method, parent token, or system configuration. The -explicit-max-ttl=0 option alone does not create a periodic token. The -orphan flag removes the parent relationship but does not make the token indefinitely renewable. HashiCorp’s token create command documentation shows -period as the periodic-token flag.

================

Batch tokens are a type of tokens that are not persisted in Vault’s storage backend, but are encrypted blobs that carry enough information to perform Vault actions. Batch tokens are extremely lightweight and scalable, and can improve the throughput for token generation. Batch tokens are suitable for high-volume and ephemeral workloads, such as containers or serverless functions, that require short-lived and non-renewable tokens. Batch tokens can be created by using the -type=batch flag in the vault token create command, or by configuring the token_type parameter in the auth method’s role or mount options. Batch tokens have some limitations compared to service tokens, such as the lack of renewal, revocation, listing, accessor, and cubbyhole features.  Therefore, batch tokens should be used with caution and only when the trade-offs are acceptable. References: https://developer.hashicorp.com/vault/tutorials/tokens/batch-tokens 1 , https://developer.hashicorp.com/vault/docs/commands/token/create 2 , https://developer.hashicorp.com/vault/docs/concepts/tokens#token-types 3

The root token is the initial token created when initializing Vault. It has unlimited privileges and can perform any operation in Vault. As a best practice, the root token should be revoked and never stored after initial setup. This is because the root token is a single point of failure and a potential security risk if it is compromised or leaked. Instead of using the root token, Vault operators should create other tokens with appropriate policies and roles that allow them to perform their tasks. If a new root token is needed in an emergency, the vault operator generate-root command can be used to create one on-the-fly with the consent of a quorum of unseal key holders. References:  Tokens | Vault | HashiCorp Developer ,  Generate root tokens using unseal keys | Vault | HashiCorp Developer

Integrated Storage is a Raft-based storage backend that allows Vault to store its data internally without relying on an external storage system. It also enables Vault to run in high availability mode with automatic leader election and failover. However, Integrated Storage is not immune to data loss or corruption due to hardware failures, network partitions, or human errors. Therefore, it is recommended to use the snapshot feature to backup and restore the Vault data periodically or on demand. A snapshot is a point-in-time capture of the entire Vault data, including the encrypted secrets, the configuration, and the metadata. Snapshots can be taken and restored using the vault operator raft snapshot command or the sys/storage/raft/snapshot API endpoint. Snapshots are encrypted and can only be restored with a quorum of unseal keys or recovery keys.  Snapshots are also portable and can be used to migrate data between different Vault clusters or storage backends. References: https://developer.hashicorp.com/vault/docs/concepts/integrated-storage 1 , https://developer.hashicorp.com/vault/docs/commands/operator/raft/snapshot 2 , https://developer.hashicorp.com/vault/api-docs/system/storage/raft/snapshot 3