HashiCorp Vault Associate (003) Practice Exam

What the HashiCorp Vault Associate (003) exam covers

• Vault Architecture and Fundamentals167 questions
• Authentication Methods136 questions
• Policies114 questions
• Tokens and Leases122 questions
• Secrets Engines129 questions
• Encryption as a Service91 questions

Free HashiCorp Vault Associate (003) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 759.

1. Question 1Vault Architecture and Fundamentals

   In secrets management, what does the term 'secret sprawl' describe?

   • AEncrypting secrets with layered ciphers for defense in depth
   • BRotating one master key across every environment on a schedule
   • CCredentials scattered across code, configs, CI logs, and wikisCorrect
   • DOne secret safely shared among many trusted microservices
   ✓ Correct answer: C

   Secret sprawl is the uncontrolled spread of credentials across source code, configuration files, CI/CD pipelines, chat, and wikis. Because no one owns or tracks these copies, they are rarely rotated, hard to revoke, and impossible to audit. Vault addresses sprawl by centralizing secrets behind authenticated, policy-controlled access.

   Why the other options are wrong

   • ALayered encryption is a cryptographic technique, not the scattering of credentials that defines sprawl.
   • BRotating a master key is a mitigation practice, not the problem of credentials spread everywhere.
   • DSafely sharing a single secret is the opposite of sprawl, which is about uncontrolled, duplicated copies.
2. Question 2Vault Architecture and Fundamentals

   After a restart, `vault status` on a Shamir-sealed cluster shows `Sealed true`. What does this mean?

   • AVault is running normally but only serves read requests
   • BVault is reachable but has not been initialized yet
   • CThe active node has failed over to a standby node
   • DVault cannot decrypt its storage and must be unsealed firstCorrect
   ✓ Correct answer: D

   A `Sealed true` result means Vault holds its data encrypted and has no access to the barrier key, so it cannot service any read or write requests until it is unsealed. On a Shamir cluster this requires a threshold of unseal keys via `vault operator unseal`. The separate `Initialized` field distinguishes a sealed-but-initialized cluster from one that was never initialized.

   Why the other options are wrong

   • AA sealed Vault serves no data requests at all, not read-only access.
   • BInitialization state is reported by the separate `Initialized` field, not by `Sealed`.
   • CLeadership is HA state; the `Sealed` field reflects the barrier, not failover.
3. Question 3Vault Architecture and Fundamentals

   A team running Vault Community edition wants to enable namespaces for tenant isolation. What should you tell them?

   • ANamespaces are enabled with `vault namespace create`
   • BNamespaces require the Integrated Storage backend first
   • CNamespaces are on by default under the `root` namespace
   • DNamespaces are an Enterprise/HCP feature, not in CommunityCorrect
   ✓ Correct answer: D

   Namespaces are a Vault Enterprise (and HCP Vault) capability; the Community/open-source binary does not support them, and vault namespace commands fail there. Community users must rely on mount paths and policies for separation. On Enterprise everything still lives under an implicit root namespace by default.

   Why the other options are wrong

   • Avault namespace create works only on Enterprise/HCP; the command is unavailable in Community.
   • BStorage backend choice does not unlock namespaces; the feature is licensing-gated.
   • CThe implicit root namespace exists only on Enterprise; Community has no namespace feature at all.
4. Question 4Authentication Methods

   Using the azure auth method, where does a virtual machine obtain the token it presents to Vault at login?

   • AFrom a service account JWT projected by the container runtime
   • BFrom the Azure Instance Metadata Service via managed identityCorrect
   • CFrom AWS STS through a signed sts:GetCallerIdentity call
   • DFrom a client TLS certificate issued by Vault's PKI engine
   ✓ Correct answer: B

   The azure method relies on Azure Managed Service Identity. The VM queries the Instance Metadata Service (IMDS) for an access token scoped to a resource such as https://management.azure.com/. It sends that JWT to Vault along with subscription, resource group, and VM name, and Vault validates the token with Azure AD before matching the role's bound_* constraints.

   Why the other options are wrong

   • AA projected service account JWT is the Kubernetes model, not Azure.
   • CSTS GetCallerIdentity is the aws method's mechanism.
   • DPKI-issued certificates back the cert method, not azure login.
5. Question 5Policies

   In HashiCorp Vault, what does an ACL policy define?

   • ANamed path rules that each grant a set of capabilitiesCorrect
   • BThe unseal key shares needed to reconstruct the root key
   • CFirewall rules controlling network access to the listener
   • DThe default and maximum lease TTLs for dynamic secrets
   ✓ Correct answer: A

   ACL policies are collections of path rules, and each path stanza lists the capabilities (create, read, update, delete, list, sudo, deny) that apply to requests against matching paths. Policies are deny by default, so a request is only permitted when a matching path grants the required capability. They are authored in HCL or JSON and attached to tokens by name.

   Why the other options are wrong

   • BShamir key shares reconstruct the root/master key during unseal; that is unrelated to ACL rules.
   • CNetwork firewall rules live outside Vault and are not expressed in the policy system.
   • DLease TTLs are set by mount tuning or roles, not by ACL path capabilities.
6. Question 6Policies

   A policy grants ["read"] on secret/data/app/* but a user still cannot permanently destroy a KV v2 secret version. Which rule must be added?

   • Asecret/data/app/* with delete
   • Bsecret/metadata/app/* with read
   • Csecret/destroy/app/* with updateCorrect
   • Dsecret/erase/app/* with sudo
   ✓ Correct answer: C

   Permanently destroying KV v2 versions requires the update capability on the secret/destroy/<path> API endpoint. A soft delete uses the data/ (delete) or delete/ path, while metadata/ manages version metadata. Destroy removes the underlying version data irreversibly.

   Why the other options are wrong

   • Adelete on data/ soft-deletes the latest version; it does not destroy data.
   • Bread on metadata/ only views version info and cannot destroy data.
   • DThere is no erase/ endpoint; permanent removal uses the destroy/ path.
7. Question 7Tokens and Leases

   A parent service token is revoked. What happens to its non-orphan child tokens?

   • AThey are automatically converted into orphan tokens
   • BThey continue to work until their own TTL expires
   • CThey are promoted to inherit the parent's policies
   • DThey are also revoked as part of the token treeCorrect
   ✓ Correct answer: D

   Service tokens are tracked in a parent-child hierarchy, and the default revocation mode revokes the target token together with all of its descendants. Any non-orphan child is therefore revoked immediately, regardless of the TTL it had remaining. To revoke only the parent and spare the children, an operator must use vault token revoke -mode=orphan.

   Why the other options are wrong

   • ARevoking a parent does not orphan children; orphaning must be chosen at creation or via revoke -mode=orphan.
   • BNon-orphan children are revoked immediately with the parent, regardless of remaining TTL.
   • CRevocation never promotes or re-assigns policies to child tokens.
8. Question 8Tokens and LeasesSelect all that apply

   Which TWO configuration levels can constrain a lease's maximum TTL, with the shortest limit taking effect? (Choose TWO)

   • AThe secrets engine mount's tuned max_lease_ttlCorrect
   • BThe client's local shell environment variables
   • CThe per-role max_ttl configured on the backendCorrect
   • DThe token's display name
   • EThe audit device's log rotation setting
   ✓ Correct answer: A, C

   TTL limits are layered: the system default/max, the mount tune values, and per-role settings, plus the per-request increment. Vault applies the shortest applicable value, and a more specific level can only shorten, never lengthen, a broader one. The mount tune and per-role configuration are two of these levels.

   Why the other options are wrong

   • BShell environment variables do not bound server-side lease TTLs.
   • DA token's display name is cosmetic metadata with no effect on TTL.
   • EAudit device settings control logging, not lease duration.
9. Question 9Secrets EnginesSelect all that apply

   Which TWO are advantages of dynamic secrets over long-lived static credentials? (Choose TWO)

   • ACredentials are stored unencrypted so they can be retrieved more quickly
   • BEach credential is unique per client, improving audit attributionCorrect
   • CCredentials are automatically revoked when their lease expiresCorrect
   • DCredentials are shared across all clients to reduce database load
   ✓ Correct answer: B, C

   Because Vault generates a distinct credential for each request, activity can be traced to a single client and a single lease can be revoked without disturbing others. The lease also guarantees the credential is torn down automatically when it expires, so there are no lingering standing secrets. Together these properties shrink blast radius and eliminate manual cleanup.

   Why the other options are wrong

   • AVault always stores secrets encrypted in the barrier; secrets are never kept unencrypted for speed.
   • DSharing one credential across clients is the static-account anti-pattern that dynamic secrets avoid.
10. Question 10Encryption as a Service

    How do you create a transit key named logs that uses chacha20-poly1305 instead of the default type?

    • Avault write -f transit/keys/logs algorithm=chacha20-poly1305
    • Bvault secrets enable -type=chacha20-poly1305 transit/logs
    • Cvault write transit/keys/logs type=chacha20-poly1305Correct
    • Dvault write transit/encrypt/logs type=chacha20-poly1305
    ✓ Correct answer: C

    The key type is chosen at creation with the `type` parameter: `vault write transit/keys/logs type=chacha20-poly1305`. Because a field is now supplied, the `-f` flag is unnecessary. The type is immutable after creation, so it must be set correctly up front.

    Why the other options are wrong

    • AThe parameter is `type`, not `algorithm`.
    • B`vault secrets enable` mounts an engine and does not set a key type.
    • Dtransit/encrypt performs encryption; it does not create a typed key.

Related HashiCorp resources

• HashiCorp Vault Associate (003) study guideKey concepts
• HashiCorp practice examsAll HashiCorp
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• HashiCorp Terraform Associate (004) practice examRelated

HashiCorp Vault Associate (003) practice exam FAQ