HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #121
When configuring Vault replication and monitoring its status, you keep seeing something called ‘WALs’.
What are WALs?
- A . Warning of allocated logs
- B . Write along logging
- C . Write-ahead logs
- D . Wake after LAN
Correct Answer: C
C
Explanation:
Comprehensive and Detailed in Depth
C: WALs (Write-Ahead Logs) ensure data consistency in replication. Correct. Overall Explanation from Vault Docs:
“Replication uses Write-Ahead Logs (WALs) for log shipping between clusters…”
Reference: https://developer.hashicorp.com/vault/docs/internals/replication
C
Explanation:
Comprehensive and Detailed in Depth
C: WALs (Write-Ahead Logs) ensure data consistency in replication. Correct. Overall Explanation from Vault Docs:
“Replication uses Write-Ahead Logs (WALs) for log shipping between clusters…”
Reference: https://developer.hashicorp.com/vault/docs/internals/replication
Question #122
Given the following policy, which command below would not result in a permission denied error (select two)?
path "secret/*" { capabilities = ["create", "update"] allowed_parameters = { "student" = ["steve",
"frank", "jamie", "susan", "gerry", "damien"] } }
path "secret/apps/*" { capabilities = ["read"] }
path "secret/apps/results" { capabilities = ["deny"] }
- A . vault kv put secret/apps/results student03=practice
- B . vault kv put secret/apps/app01 student=bryan
- C . vault kv put secret/common/results student=frank
- D . vault kv get secret/apps/api_key
Correct Answer: C, D
C, D
Explanation:
Comprehensive and Detailed in Depth
A: Denied by secret/apps/results deny policy. Incorrect.
B: secret/apps/app01 only allows read, not create. Incorrect.
C: secret/common/results allows create with student=frank (allowed value). Correct.
D: secret/apps/api_key allows read. Correct.
Overall Explanation from Vault Docs:
“deny overrides any allow… allowed_parameters restricts values.”
Reference: https://developer.hashicorp.com/vault/docs/concepts/policies#parameter-constraints
C, D
Explanation:
Comprehensive and Detailed in Depth
A: Denied by secret/apps/results deny policy. Incorrect.
B: secret/apps/app01 only allows read, not create. Incorrect.
C: secret/common/results allows create with student=frank (allowed value). Correct.
D: secret/apps/api_key allows read. Correct.
Overall Explanation from Vault Docs:
“deny overrides any allow… allowed_parameters restricts values.”
Reference: https://developer.hashicorp.com/vault/docs/concepts/policies#parameter-constraints
Question #123
A security architect is designing a solution to address the "Secret Zero" problem for a Kubernetes-
based application that needs to authenticate to HashiCorp Vault.
Which approach correctly leverages Vault features to solve this challenge?
- A . Store the Vault root token in a ConfigMap and mount it to all containers that require access to sensitive information
- B . Generate a long-lived token during deployment and store it as an environment variable within each container that needs to access Vault
- C . Configure the Kubernetes auth method in Vault and enable applications to authenticate without pre-shared secrets
- D . Implement a custom sidecar container that uses AppRole role-id and secret-id each time the application needs to access Vault
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
The Kubernetes auth method addresses Secret Zero by using service account tokens. The Vault documentation states:
"The ‘Secret Zero’ problem refers to the bootstrapping challenge of how applications can authenticate to a secrets management system without requiring an initial secret. In a Kubernetes environment, the Kubernetes Auth Method in Vault allows applications to authenticate using their Kubernetes service account tokens, which are automatically provided to pods. The Vault server validates these tokens against the Kubernetes API server, establishing a chain of trust where applications can authenticate to Vault without pre-shared secrets."
― Vault Auth Methods
C: Correct. Eliminates pre-shared secrets:
"Configuring the Kubernetes auth method in Vault allows applications running in Kubernetes to authenticate to Vault without the need for pre-shared secrets."
― Vault Auth: Kubernetes
A, B: Introduce static secrets, worsening Secret Zero.
D: Retains pre-shared secrets (role-id/secret-id).
Reference: Vault Auth Methods Vault Auth: Kubernetes
C
Explanation:
Comprehensive and Detailed In-Depth
The Kubernetes auth method addresses Secret Zero by using service account tokens. The Vault documentation states:
"The ‘Secret Zero’ problem refers to the bootstrapping challenge of how applications can authenticate to a secrets management system without requiring an initial secret. In a Kubernetes environment, the Kubernetes Auth Method in Vault allows applications to authenticate using their Kubernetes service account tokens, which are automatically provided to pods. The Vault server validates these tokens against the Kubernetes API server, establishing a chain of trust where applications can authenticate to Vault without pre-shared secrets."
― Vault Auth Methods
C: Correct. Eliminates pre-shared secrets:
"Configuring the Kubernetes auth method in Vault allows applications running in Kubernetes to authenticate to Vault without the need for pre-shared secrets."
― Vault Auth: Kubernetes
A, B: Introduce static secrets, worsening Secret Zero.
D: Retains pre-shared secrets (role-id/secret-id).
Reference: Vault Auth Methods Vault Auth: Kubernetes
Question #124
You are planning the deployment of your first Vault cluster and have decided to use Integrated Storage as the storage backend.
Where do you configure the storage backend to be used by Vault?
- A . In the systemd service file
- B . Inside the Vault service once Vault is up and running
- C . In the Vault configuration file
- D . In the Vault Agent sink file
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
The storage backend is configured in the Vault configuration file. The Vault documentation states: "The Vault configuration file includes different stanzas and parameters to define a variety of configuration options. These configurations include the storage backend, listener, TLS certificates, seal type, cluster name, log level, UI, cluster IP address, and a few more. Most of these are required to get Vault up and running in the first place, so they must be placed in the configuration file."
― Vault Configuration
C: Correct. For Integrated Storage:
"Configuring the storage backend to be used by Vault is done in the Vault configuration file."
― Vault Configuration: Raft Storage
A: systemd manages the service, not storage.
B: Backend must be set before running.
D: Agent sink is for client tokens.
Reference: Vault Configuration
Vault Configuration: Raft Storage
C
Explanation:
Comprehensive and Detailed In-Depth
The storage backend is configured in the Vault configuration file. The Vault documentation states: "The Vault configuration file includes different stanzas and parameters to define a variety of configuration options. These configurations include the storage backend, listener, TLS certificates, seal type, cluster name, log level, UI, cluster IP address, and a few more. Most of these are required to get Vault up and running in the first place, so they must be placed in the configuration file."
― Vault Configuration
C: Correct. For Integrated Storage:
"Configuring the storage backend to be used by Vault is done in the Vault configuration file."
― Vault Configuration: Raft Storage
A: systemd manages the service, not storage.
B: Backend must be set before running.
D: Agent sink is for client tokens.
Reference: Vault Configuration
Vault Configuration: Raft Storage
Question #125
Select the two paths below that would be permitted for read access based on the following Vault policy:
path "secret/+/training/*" {
capabilities = ["create", "read"]
}
- A . secret/business/training
- B . secret/cloud/training/test/exam
- C . secret/departments/certification/api
- D . secret/departments/training/vault
Correct Answer: BD
BD
Explanation:
Comprehensive and Detailed In-Depth
Vault policies use path-based syntax with wildcards (+ for one segment, * for zero or more) to define
permissions. The policy path "secret/+/training/*" { capabilities = ["create", "read"] } grants "create"
and "read" access to paths matching this pattern.
Path Analysis:
The + wildcard matches exactly one segment after "secret/".
"training/" must follow that segment.
The * wildcard allows any number of subsequent segments (including none).
Correct Paths:
B. secret/cloud/training/test/exam: Matches as "cloud" fits +, followed by "training/", and "test/exam" fits *. "Permitted since + allows for cloud and * allows for test/exam."
D. secret/departments/training/vault: Matches with "departments" as +, "training/", and "vault" as *. "Permitted since + allows for departments and vault is in place of *." Incorrect Paths:
BD
Explanation:
Comprehensive and Detailed In-Depth
Vault policies use path-based syntax with wildcards (+ for one segment, * for zero or more) to define
permissions. The policy path "secret/+/training/*" { capabilities = ["create", "read"] } grants "create"
and "read" access to paths matching this pattern.
Path Analysis:
The + wildcard matches exactly one segment after "secret/".
"training/" must follow that segment.
The * wildcard allows any number of subsequent segments (including none).
Correct Paths:
B. secret/cloud/training/test/exam: Matches as "cloud" fits +, followed by "training/", and "test/exam" fits *. "Permitted since + allows for cloud and * allows for test/exam."
D. secret/departments/training/vault: Matches with "departments" as +, "training/", and "vault" as *. "Permitted since + allows for departments and vault is in place of *." Incorrect Paths:
Question #126
What features are offered by the Vault Agent? (Select three)
- A . Auditing
- B . Templating
- C . Auto-auth
- D . Secret caching
Correct Answer: B, C, D
B, C, D
Explanation:
Comprehensive and Detailed In-Depth
The Vault Agent is a client-side daemon with these features:
B. Templating: "Allows rendering of user-supplied templates by Vault Agent," integrating secrets into configs.
C. Auto-auth: "Automatically authenticate to Vault and manage token renewal," simplifying auth workflows.
D. Secret caching: "Allows client-side caching of responses," reducing Vault load.
Incorrect Option:
B, C, D
Explanation:
Comprehensive and Detailed In-Depth
The Vault Agent is a client-side daemon with these features:
B. Templating: "Allows rendering of user-supplied templates by Vault Agent," integrating secrets into configs.
C. Auto-auth: "Automatically authenticate to Vault and manage token renewal," simplifying auth workflows.
D. Secret caching: "Allows client-side caching of responses," reducing Vault load.
Incorrect Option:
Question #127
Your organization wants to set up human-based authentication for AzureAD.
What authentication method should you enable and configure for Vault?
- A . OIDC/JWT
- B . Okta
- C . Active Directory
- D . UserPass
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
For human-based authentication with Azure Active Directory (AzureAD), the OIDC/JWT authentication method is the best choice. The HashiCorp Vault documentation explains: "The OIDC/JWT auth method is the best choice here. The organization should configure Vault to send authentication requests to AzureAD, which can then validate credentials on behalf of the user." OIDC (OpenID Connect) leverages AzureAD as an identity provider, allowing users to authenticate via their AzureAD credentials in a secure, human-friendly manner.
Okta is a separate identity provider, not directly tied to AzureAD. Active Directory auth is deprecated and less suitable for cloud-based AzureAD integration. UserPass uses a local Vault-managed username/password, not external AzureAD authentication. Thus, A (OIDC/JWT) is correct.
Reference: HashiCorp Vault Documentation – JWT/OIDC Auth Method
A
Explanation:
Comprehensive and Detailed in Depth
For human-based authentication with Azure Active Directory (AzureAD), the OIDC/JWT authentication method is the best choice. The HashiCorp Vault documentation explains: "The OIDC/JWT auth method is the best choice here. The organization should configure Vault to send authentication requests to AzureAD, which can then validate credentials on behalf of the user." OIDC (OpenID Connect) leverages AzureAD as an identity provider, allowing users to authenticate via their AzureAD credentials in a secure, human-friendly manner.
Okta is a separate identity provider, not directly tied to AzureAD. Active Directory auth is deprecated and less suitable for cloud-based AzureAD integration. UserPass uses a local Vault-managed username/password, not external AzureAD authentication. Thus, A (OIDC/JWT) is correct.
Reference: HashiCorp Vault Documentation – JWT/OIDC Auth Method
Question #128
Before data is written to the storage backend, the data is encrypted by which Vault feature?
- A . TLS certificate
- B . Cryptographic barrier
- C . Unseal keys
- D . Transit secrets engine
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
Vault’s architecture includes a cryptographic barrier that encrypts all data before it’s written to the storage backend. This ensures that the backend (e.g., Consul, Filesystem) only stores encrypted data, enhancing security even if the backend is compromised. The barrier uses a master key (split into unseal keys via Shamir’s Secret Sharing) to encrypt a keyring, which in turn encrypts the data. TLS certificates secure network communication, not storage encryption. Unseal keys unlock the master key, not encrypt data directly. The Transit engine is for application-level encryption, not storage backend protection. The Vault architecture docs confirm the cryptographic barrier’s role.
Reference: Vault Architecture Overview
Data Encryption
B
Explanation:
Comprehensive and Detailed In-Depth
Vault’s architecture includes a cryptographic barrier that encrypts all data before it’s written to the storage backend. This ensures that the backend (e.g., Consul, Filesystem) only stores encrypted data, enhancing security even if the backend is compromised. The barrier uses a master key (split into unseal keys via Shamir’s Secret Sharing) to encrypt a keyring, which in turn encrypts the data. TLS certificates secure network communication, not storage encryption. Unseal keys unlock the master key, not encrypt data directly. The Transit engine is for application-level encryption, not storage backend protection. The Vault architecture docs confirm the cryptographic barrier’s role.
Reference: Vault Architecture Overview
Data Encryption
Question #129
What API endpoint is used to manage secrets engines in Vault?
- A . /secret-engines/
- B . /sys/mounts
- C . /sys/capabilities
- D . /sys/kv
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
Vault’s API provides endpoints for managing its components, including secrets engines, which
generate and manage secrets (e.g., AWS, KV, Transit). Managing secrets engines involves enabling,
disabling, tuning, or listing them.
Let’s evaluate:
Option A: /secret-engines/
This is not a valid Vault API endpoint. Vault uses /sys/ for system-level operations, and no endpoint named /secret-engines/ exists in the official API documentation. It’s a fabricated path, possibly a misunderstanding of secrets engine management. Incorrect.
Option B: /sys/mounts
This is the correct endpoint. The /sys/mounts endpoint allows operators to list all mounted secrets engines (GET), enable a new one (POST to /sys/mounts/<path>), or tune existing ones (POST to /sys/mounts/<path>/tune). For example, enabling the AWS secrets engine at aws/ uses POST /v1/sys/mounts/aws with a payload specifying the type (aws). This endpoint is the central hub for secrets engine management. Correct.
Option C: /sys/capabilities
The /sys/capabilities endpoint checks permissions for a token on specific paths (e.g., what capabilities like read or write are allowed). It’s unrelated to managing secrets engines―it’s for policy
auditing, not mount operations. Incorrect.
Option D: /sys/kv
There’s no /sys/kv endpoint. The KV secrets engine, when enabled, lives at a user-defined path (e.g.,
kv/), not under /sys/. System endpoints under /sys/ handle configuration, not specific secrets engine
instances. Incorrect.
Detailed Mechanics:
The /sys/mounts endpoint interacts with Vault’s mount table, a registry of all enabled backends (auth methods and secrets engines). A GET request to /v1/sys/mounts returns a JSON list of mounts, e.g., {"kv/": {"type": "kv", "options": {"version": "2"}}}. A POST request to /v1/sys/mounts/my-mount with {"type": "kv"} mounts a new KV engine. Tuning (e.g., setting TTLs) uses /sys/mounts/<path>/tune. This endpoint’s versatility makes it the go-to for secrets engine management. Real-World Example:
To enable the Transit engine: curl -X POST -H "X-Vault-Token: <token>" -d ‘{"type":"transit"}’
http://127.0.0.1:8200/v1/sys/mounts/transit. To list mounts: curl -X GET -H "X-Vault-Token: <token>"
http://127.0.0.1:8200/v1/sys/mounts.
Overall Explanation from Vault Docs:
“The /sys/mounts endpoint is used to manage secrets engines in Vault… List, enable, or tune mounts via this system endpoint.”
Reference: https://developer.hashicorp.com/vault/api-docs/system/mounts
B
Explanation:
Comprehensive and Detailed in Depth
Vault’s API provides endpoints for managing its components, including secrets engines, which
generate and manage secrets (e.g., AWS, KV, Transit). Managing secrets engines involves enabling,
disabling, tuning, or listing them.
Let’s evaluate:
Option A: /secret-engines/
This is not a valid Vault API endpoint. Vault uses /sys/ for system-level operations, and no endpoint named /secret-engines/ exists in the official API documentation. It’s a fabricated path, possibly a misunderstanding of secrets engine management. Incorrect.
Option B: /sys/mounts
This is the correct endpoint. The /sys/mounts endpoint allows operators to list all mounted secrets engines (GET), enable a new one (POST to /sys/mounts/<path>), or tune existing ones (POST to /sys/mounts/<path>/tune). For example, enabling the AWS secrets engine at aws/ uses POST /v1/sys/mounts/aws with a payload specifying the type (aws). This endpoint is the central hub for secrets engine management. Correct.
Option C: /sys/capabilities
The /sys/capabilities endpoint checks permissions for a token on specific paths (e.g., what capabilities like read or write are allowed). It’s unrelated to managing secrets engines―it’s for policy
auditing, not mount operations. Incorrect.
Option D: /sys/kv
There’s no /sys/kv endpoint. The KV secrets engine, when enabled, lives at a user-defined path (e.g.,
kv/), not under /sys/. System endpoints under /sys/ handle configuration, not specific secrets engine
instances. Incorrect.
Detailed Mechanics:
The /sys/mounts endpoint interacts with Vault’s mount table, a registry of all enabled backends (auth methods and secrets engines). A GET request to /v1/sys/mounts returns a JSON list of mounts, e.g., {"kv/": {"type": "kv", "options": {"version": "2"}}}. A POST request to /v1/sys/mounts/my-mount with {"type": "kv"} mounts a new KV engine. Tuning (e.g., setting TTLs) uses /sys/mounts/<path>/tune. This endpoint’s versatility makes it the go-to for secrets engine management. Real-World Example:
To enable the Transit engine: curl -X POST -H "X-Vault-Token: <token>" -d ‘{"type":"transit"}’
http://127.0.0.1:8200/v1/sys/mounts/transit. To list mounts: curl -X GET -H "X-Vault-Token: <token>"
http://127.0.0.1:8200/v1/sys/mounts.
Overall Explanation from Vault Docs:
“The /sys/mounts endpoint is used to manage secrets engines in Vault… List, enable, or tune mounts via this system endpoint.”
Reference: https://developer.hashicorp.com/vault/api-docs/system/mounts
Question #130
Compared to service tokens, batch tokens are ideal for what type of action?
- A . Generating dynamic credentials
- B . Renewing other tokens
- C . For daily batch jobs requesting secrets from Vault
- D . Short-lived, high-volume, or “ephemeral” tasks
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
Batch tokens are designed for specific, transient use cases. The HashiCorp Vault documentation states: "Batch tokens are lightweight and scalable and include just enough information to be used with Vault. They are generally used for ephemeral, high-performance workloads, such as encrypting data." This makes them ideal for short-lived, high-volume, or ‘ephemeral’ tasks (D).
The docs contrast: "Unlike service tokens, which are renewable and suited for long-lived processes, batch tokens have a fixed TTL and cannot be renewed." Options like generating dynamic credentials (A) and daily batch jobs (C) align more with service tokens, while renewing tokens (B) isn’t a batch token function. Thus, D is correct.
Reference: HashiCorp Vault Documentation – Batch Tokens
D
Explanation:
Comprehensive and Detailed in Depth
Batch tokens are designed for specific, transient use cases. The HashiCorp Vault documentation states: "Batch tokens are lightweight and scalable and include just enough information to be used with Vault. They are generally used for ephemeral, high-performance workloads, such as encrypting data." This makes them ideal for short-lived, high-volume, or ‘ephemeral’ tasks (D).
The docs contrast: "Unlike service tokens, which are renewable and suited for long-lived processes, batch tokens have a fixed TTL and cannot be renewed." Options like generating dynamic credentials (A) and daily batch jobs (C) align more with service tokens, while renewing tokens (B) isn’t a batch token function. Thus, D is correct.
Reference: HashiCorp Vault Documentation – Batch Tokens