HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #131
When generating a dynamic secret, what value is returned that a user can use to renew or revoke the lease?
- A . renewable
- B . token_ttl
- C . lease_max
- D . lease_id
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
When Vault generates a dynamic secret, it returns a lease_id, which is the value a user can use to renew or revoke the lease. The HashiCorp Vault documentation states: "When creating a dynamic secret, Vault always returns a lease_id. This lease_id can be used to do a vault lease renew or a vault lease revoke command to manage the lease of a secret." The lease_id uniquely identifies the lease associated with the dynamic secret, enabling precise management of its lifecycle.
The documentation under the "Lease Renew and Revoke" section explains: "Every secret in Vault is associated with a lease. When that lease expires, Vault revokes the secret and removes access to it.
Associated with every lease is a unique lease_id. This identifier can be used to renew the lease before it expires or revoke it manually." In contrast, renewable is a boolean indicating if the lease can be renewed, not a value for management. token_ttl relates to token duration, not lease
management. lease_max is not a standard term in Vault’s lease system. Thus, D (lease_id) is the correct answer.
Reference: HashiCorp Vault Documentation – Leases: Lease Renew and Revoke
D
Explanation:
Comprehensive and Detailed in Depth
When Vault generates a dynamic secret, it returns a lease_id, which is the value a user can use to renew or revoke the lease. The HashiCorp Vault documentation states: "When creating a dynamic secret, Vault always returns a lease_id. This lease_id can be used to do a vault lease renew or a vault lease revoke command to manage the lease of a secret." The lease_id uniquely identifies the lease associated with the dynamic secret, enabling precise management of its lifecycle.
The documentation under the "Lease Renew and Revoke" section explains: "Every secret in Vault is associated with a lease. When that lease expires, Vault revokes the secret and removes access to it.
Associated with every lease is a unique lease_id. This identifier can be used to renew the lease before it expires or revoke it manually." In contrast, renewable is a boolean indicating if the lease can be renewed, not a value for management. token_ttl relates to token duration, not lease
management. lease_max is not a standard term in Vault’s lease system. Thus, D (lease_id) is the correct answer.
Reference: HashiCorp Vault Documentation – Leases: Lease Renew and Revoke
Question #132
True or False? All Vault policies are deny by default.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
The statement is True. Vault operates on a default-deny model for policies. The HashiCorp Vault documentation states: "Vault policies implicitly deny all actions that are not explicitly permitted in the Vault policy." This ensures that access must be explicitly granted, enhancing security.
The docs elaborate: "By default, a token has no policies attached beyond the default policy (which grants minimal permissions), and any action not explicitly allowed by an attached policy is denied." This principle underpins Vault’s access control, making A correct.
Reference: HashiCorp Vault Documentation – Policies Tutorial
A
Explanation:
Comprehensive and Detailed in Depth
The statement is True. Vault operates on a default-deny model for policies. The HashiCorp Vault documentation states: "Vault policies implicitly deny all actions that are not explicitly permitted in the Vault policy." This ensures that access must be explicitly granted, enhancing security.
The docs elaborate: "By default, a token has no policies attached beyond the default policy (which grants minimal permissions), and any action not explicitly allowed by an attached policy is denied." This principle underpins Vault’s access control, making A correct.
Reference: HashiCorp Vault Documentation – Policies Tutorial
Question #133
Which of the following is a machine-oriented Vault authentication backend?
- A . Okta
- B . AppRole
- C . Transit
- D . GitHub
Correct Answer: B
B
Explanation:
AppRole is a machine-oriented authentication method that allows machines or applications to authenticate with Vault using a role ID and a secret ID. The role ID is a unique identifier for the application, and the secret ID is a single-use credential that can be delivered to the application securely. AppRole is designed to provide secure introduction of machines and applications to Vault, and to support the principle of least privilege by allowing fine-grained access control policies to be attached to each role1.
Okta, GitHub, and Transit are not machine-oriented authentication methods. Okta and GitHub are user-oriented authentication methods that allow users to authenticate with Vault using their Okta or GitHub credentials23. Transit is not an authentication method at all, but a secrets engine that provides encryption as a service4.
Reference: AppRole Auth Method | Vault | HashiCorp Developer
Okta Auth Method | Vault | HashiCorp Developer
GitHub Auth Method | Vault | HashiCorp Developer
Transit Secrets Engine | Vault | HashiCorp Developer
B
Explanation:
AppRole is a machine-oriented authentication method that allows machines or applications to authenticate with Vault using a role ID and a secret ID. The role ID is a unique identifier for the application, and the secret ID is a single-use credential that can be delivered to the application securely. AppRole is designed to provide secure introduction of machines and applications to Vault, and to support the principle of least privilege by allowing fine-grained access control policies to be attached to each role1.
Okta, GitHub, and Transit are not machine-oriented authentication methods. Okta and GitHub are user-oriented authentication methods that allow users to authenticate with Vault using their Okta or GitHub credentials23. Transit is not an authentication method at all, but a secrets engine that provides encryption as a service4.
Reference: AppRole Auth Method | Vault | HashiCorp Developer
Okta Auth Method | Vault | HashiCorp Developer
GitHub Auth Method | Vault | HashiCorp Developer
Transit Secrets Engine | Vault | HashiCorp Developer
Question #134
True or False? Once you create a KV v1 secrets engine and place data in it, there is no way to modify the mount to include the features of a KV v2 secrets engine.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
A: Incorrect; KV v1 can be upgraded to v2.
B: Correct; vault kv enable-versioning upgrades it. Overall Explanation from Vault Docs:
“kv enable-versioning turns on versioning for an existing KV v1 engine at its path.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2#upgrading-from-version-1
B
Explanation:
Comprehensive and Detailed in Depth
A: Incorrect; KV v1 can be upgraded to v2.
B: Correct; vault kv enable-versioning upgrades it. Overall Explanation from Vault Docs:
“kv enable-versioning turns on versioning for an existing KV v1 engine at its path.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2#upgrading-from-version-1
Question #135
From the options below, select the auth methods that are better suited for machine-to-machine authentication (select five):
- A . Kubernetes
- B . GitHub
- C . TLS
- D . Token
- E . AppRole
- F . AWS
- G . LDAP
- H . OIDC
Correct Answer: A, C, D, E, F
A, C, D, E, F
Explanation:
Comprehensive and Detailed in Depth
Machine-to-machine (M2M) auth methods in Vault enable automated systems to authenticate without human interaction.
Let’s assess:
A: Kubernetes – Uses service account tokens for pods. Correct.
Vault Docs Insight: “Kubernetes auth… ideal for workloads in Kubernetes clusters.”
B: GitHub – User-focused, requires human GitHub login. Incorrect. Vault Docs Insight: “GitHub auth… typically for human users.”
C: TLS – Certificate-based, perfect for M2M. Correct.
Vault Docs Insight: “TLS auth uses certificates… suited for machine authentication.”
D: Token – Pre-generated tokens for automation. Correct.
Vault Docs Insight: “Token auth… can be used by machines with proper management.”
E: AppRole – RoleID/SecretID for apps. Correct.
Vault Docs Insight: “AppRole is designed for machine-to-machine authentication…”
F: AWS – IAM roles for AWS resources. Correct.
Vault Docs Insight: “AWS auth… automated for AWS-based machines.”
G: LDAP – User directory-based, human-oriented. Incorrect.
Vault Docs Insight: “LDAP… commonly for human user authentication.”
H: OIDC – User SSO, not M2M. Incorrect.
Vault Docs Insight: “OIDC… for human single sign-on.”
Overall Explanation from Vault Docs:
“Examples of machine auth methods include AppRole, AWS, Kubernetes, TLS, and Token… Human auth methods include LDAP, GitHub, OIDC.”
Reference: https://developer.hashicorp.com/vault/docs/auth
A, C, D, E, F
Explanation:
Comprehensive and Detailed in Depth
Machine-to-machine (M2M) auth methods in Vault enable automated systems to authenticate without human interaction.
Let’s assess:
A: Kubernetes – Uses service account tokens for pods. Correct.
Vault Docs Insight: “Kubernetes auth… ideal for workloads in Kubernetes clusters.”
B: GitHub – User-focused, requires human GitHub login. Incorrect. Vault Docs Insight: “GitHub auth… typically for human users.”
C: TLS – Certificate-based, perfect for M2M. Correct.
Vault Docs Insight: “TLS auth uses certificates… suited for machine authentication.”
D: Token – Pre-generated tokens for automation. Correct.
Vault Docs Insight: “Token auth… can be used by machines with proper management.”
E: AppRole – RoleID/SecretID for apps. Correct.
Vault Docs Insight: “AppRole is designed for machine-to-machine authentication…”
F: AWS – IAM roles for AWS resources. Correct.
Vault Docs Insight: “AWS auth… automated for AWS-based machines.”
G: LDAP – User directory-based, human-oriented. Incorrect.
Vault Docs Insight: “LDAP… commonly for human user authentication.”
H: OIDC – User SSO, not M2M. Incorrect.
Vault Docs Insight: “OIDC… for human single sign-on.”
Overall Explanation from Vault Docs:
“Examples of machine auth methods include AppRole, AWS, Kubernetes, TLS, and Token… Human auth methods include LDAP, GitHub, OIDC.”
Reference: https://developer.hashicorp.com/vault/docs/auth
Question #136
What command can be used to update a Vault policy named web-app-1 using the command line?
- A . vault policy create web-app-1 web.hcl
- B . vault policy fmt web.hcl
- C . vault policy update web-app-1 web.hcl
- D . vault policy write web-app-1 web.hcl
Correct Answer: D
D
Explanation:
Comprehensive and Detailed In-Depth
To update an existing Vault policy via the CLI, the correct command is vault policy write:
D. vault policy write web-app-1 web.hcl: This command updates (or creates if it doesn’t exist) the policy named "web-app-1" with the contents of "web.hcl". The documentation states: "The write keyword is used to update an existing policy with the contents of the specified file."
Incorrect Options:
D
Explanation:
Comprehensive and Detailed In-Depth
To update an existing Vault policy via the CLI, the correct command is vault policy write:
D. vault policy write web-app-1 web.hcl: This command updates (or creates if it doesn’t exist) the policy named "web-app-1" with the contents of "web.hcl". The documentation states: "The write keyword is used to update an existing policy with the contents of the specified file."
Incorrect Options:
Question #137
From the options below, select the benefits of using the PKI (x.509 certificates) secrets engine (select three):
- A . TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time
- B . Reducing, or eliminating certificate revocations
- C . Reduces time to get a certificate by eliminating the need to generate a private key and CSR
- D . Vault can act as an intermediate CA
Correct Answer: B, C, D
B, C, D
Explanation:
Comprehensive and Detailed in Depth
The PKI secrets engine in Vault generates dynamic X.509 certificates, acting as a certificate authority (CA) to streamline certificate management. Let’s assess each option based on its documented benefits:
Option A: TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time This is misleading. Vault’s PKI engine allows configurable TTLs, but the recommendation is for short TTLs (e.g., hours or days) to reduce the need for revocation and enhance security. Long TTLs increase exposure if a certificate is compromised, requiring revocation and larger Certificate Revocation Lists (CRLs). The engine’s benefit isn’t longer validity―it’s flexibility and automation, not extended lifetimes. Incorrect.
Vault Docs Insight: “By keeping TTLs relatively short, revocations are less likely… helping scale to large workloads.” (Short TTLs are preferred.)
Option B: Reducing, or eliminating certificate revocations
A key advantage of the PKI engine is issuing short-lived certificates. With short TTLs (e.g., 24h), certificates expire naturally before revocation is needed, minimizing CRL maintenance. For example, an app can fetch a new cert daily, reducing revocation events compared to traditional multi-year certs. This aligns with Vault’s ephemeral certificate model. Correct.
Vault Docs Insight: “By keeping TTLs relatively short, revocations are less likely to be needed, keeping CRLs short…” (Direct benefit.)
Option C: Reduces time to get a certificate by eliminating the need to generate a private key and CSR Traditionally, obtaining a certificate involves generating a private key, creating a Certificate Signing Request (CSR), and submitting it to a CA―a manual, time-consuming process. The PKI engine automates this: vault write pki/issue/my-role common_name=app.example.com instantly generates a private key and signed certificate. This eliminates manual steps, speeding up issuance significantly. Correct.
Vault Docs Insight: “Services can get certificates without… generating a private key and CSR, submitting to a CA, and waiting…” (Automation reduces time.) Option D: Vault can act as an intermediate CA
The PKI engine can be configured as an intermediate CA, signed by a root CA (internal or external). For example, vault write pki/intermediate/generate/internal common_name="Intermediate CA" creates an intermediate, which can issue certificates under a trust chain. This supports hierarchical PKI setups, a major feature. Correct.
Vault Docs Insight: “The PKI secrets engine can act as an intermediate CA… issuing certificates on behalf of a root CA.” (Explicit capability.)
Detailed Mechanics:
The PKI engine operates at paths like pki/ (root) or pki_int/ (intermediate). Roles (e.g., my-role) define parameters like TTL and allowed domains. Issuing a cert (vault write pki/issue/my-role…) returns a JSON payload with certificate, private_key, and issuing_ca. Short TTLs leverage Vault’s lease system, auto-revoking certs on expiry. As an intermediate CA, it signs certificates with its key,
validated against a root, enhancing trust management.
Real-World Example:
An app needs a cert: vault write pki/issue/web common_name=web.example.com ttl=24h. Vault returns a cert and key instantly, valid for 24 hours. No CSR, no revocation needed―expires tomorrow. Another PKI mount at pki_int/ issues certs under a corporate root CA.
Overall Explanation from Vault Docs:
“The PKI secrets engine generates dynamic X.509 certificates… Services can get certificates without the usual manual process… By keeping TTLs short, revocations are less likely… Vault can act as an intermediate CA, issuing certificates efficiently.” These benefits―automation, reduced revocation, and CA flexibility―define its value.
Reference: https://developer.hashicorp.com/vault/docs/secrets/pki
B, C, D
Explanation:
Comprehensive and Detailed in Depth
The PKI secrets engine in Vault generates dynamic X.509 certificates, acting as a certificate authority (CA) to streamline certificate management. Let’s assess each option based on its documented benefits:
Option A: TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time This is misleading. Vault’s PKI engine allows configurable TTLs, but the recommendation is for short TTLs (e.g., hours or days) to reduce the need for revocation and enhance security. Long TTLs increase exposure if a certificate is compromised, requiring revocation and larger Certificate Revocation Lists (CRLs). The engine’s benefit isn’t longer validity―it’s flexibility and automation, not extended lifetimes. Incorrect.
Vault Docs Insight: “By keeping TTLs relatively short, revocations are less likely… helping scale to large workloads.” (Short TTLs are preferred.)
Option B: Reducing, or eliminating certificate revocations
A key advantage of the PKI engine is issuing short-lived certificates. With short TTLs (e.g., 24h), certificates expire naturally before revocation is needed, minimizing CRL maintenance. For example, an app can fetch a new cert daily, reducing revocation events compared to traditional multi-year certs. This aligns with Vault’s ephemeral certificate model. Correct.
Vault Docs Insight: “By keeping TTLs relatively short, revocations are less likely to be needed, keeping CRLs short…” (Direct benefit.)
Option C: Reduces time to get a certificate by eliminating the need to generate a private key and CSR Traditionally, obtaining a certificate involves generating a private key, creating a Certificate Signing Request (CSR), and submitting it to a CA―a manual, time-consuming process. The PKI engine automates this: vault write pki/issue/my-role common_name=app.example.com instantly generates a private key and signed certificate. This eliminates manual steps, speeding up issuance significantly. Correct.
Vault Docs Insight: “Services can get certificates without… generating a private key and CSR, submitting to a CA, and waiting…” (Automation reduces time.) Option D: Vault can act as an intermediate CA
The PKI engine can be configured as an intermediate CA, signed by a root CA (internal or external). For example, vault write pki/intermediate/generate/internal common_name="Intermediate CA" creates an intermediate, which can issue certificates under a trust chain. This supports hierarchical PKI setups, a major feature. Correct.
Vault Docs Insight: “The PKI secrets engine can act as an intermediate CA… issuing certificates on behalf of a root CA.” (Explicit capability.)
Detailed Mechanics:
The PKI engine operates at paths like pki/ (root) or pki_int/ (intermediate). Roles (e.g., my-role) define parameters like TTL and allowed domains. Issuing a cert (vault write pki/issue/my-role…) returns a JSON payload with certificate, private_key, and issuing_ca. Short TTLs leverage Vault’s lease system, auto-revoking certs on expiry. As an intermediate CA, it signs certificates with its key,
validated against a root, enhancing trust management.
Real-World Example:
An app needs a cert: vault write pki/issue/web common_name=web.example.com ttl=24h. Vault returns a cert and key instantly, valid for 24 hours. No CSR, no revocation needed―expires tomorrow. Another PKI mount at pki_int/ issues certs under a corporate root CA.
Overall Explanation from Vault Docs:
“The PKI secrets engine generates dynamic X.509 certificates… Services can get certificates without the usual manual process… By keeping TTLs short, revocations are less likely… Vault can act as an intermediate CA, issuing certificates efficiently.” These benefits―automation, reduced revocation, and CA flexibility―define its value.
Reference: https://developer.hashicorp.com/vault/docs/secrets/pki
Question #138
Which of the following statements best describes the difference in cluster strategies between self-managed Vault and HashiCorp-managed Vault?
- A . Self-managed clusters require users to handle setup, maintenance, and scaling, whereas HCP Vault Dedicated is fully managed by HashiCorp and offloads most operational tasks
- B . Neither self-managed clusters nor HCP Vault Dedicated include enterprise security features such as replication or disaster recovery
- C . Both self-managed clusters and HCP Vault Dedicated require manual patching and upgrades, but only self-managed clusters are hosted in the user’s cloud
- D . In self-managed clusters, HashiCorp is responsible for scaling, upgrades, and patching, while HCP Vault Dedicated requires the user to handle all operational overhead
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
A: Correctly contrasts self-managed (user responsibility) with HCP Vault (HashiCorp-managed). Correct.
B: Both support replication; false. Incorrect.
C: HCP Vault doesn’t require manual upgrades. Incorrect.
D: Reverses responsibilities; false. Incorrect.
Overall Explanation from Vault Docs:
“HCP Vault Dedicated is operated by HashiCorp… Self-managed Vault requires users to handle setup, maintenance, and scaling.”
Reference: https://developer.hashicorp.com/hcp/docs/vault/what-is-hcp-vault
A
Explanation:
Comprehensive and Detailed in Depth
A: Correctly contrasts self-managed (user responsibility) with HCP Vault (HashiCorp-managed). Correct.
B: Both support replication; false. Incorrect.
C: HCP Vault doesn’t require manual upgrades. Incorrect.
D: Reverses responsibilities; false. Incorrect.
Overall Explanation from Vault Docs:
“HCP Vault Dedicated is operated by HashiCorp… Self-managed Vault requires users to handle setup, maintenance, and scaling.”
Reference: https://developer.hashicorp.com/hcp/docs/vault/what-is-hcp-vault
Question #139
Your organization has an initiative to reduce and ultimately remove the use of long lived X.509 certificates.
Which secrets engine will best support this use case?
- A . PKI
- B . Key/Value secrets engine version 2, with TTL defined
- C . Cloud KMS
- D . Transit
Correct Answer: A
A
Explanation:
The PKI secrets engine is designed to support the use case of reducing and ultimately removing the use of long lived X.509 certificates. The PKI secrets engine can generate dynamic X.509 certificates on demand, with short time-to-live (TTL) and automatic revocation. This eliminates the need for manual processes of generating, signing, and rotating certificates, and reduces the risk of certificate compromise or misuse. The PKI secrets engine can also act as a certificate authority (CA) or an intermediate CA, and can integrate with external CAs or CRLs. The PKI secrets engine can issue certificates for various purposes, such as TLS, SSH, code signing, email encryption, etc.
Reference: https://developer.hashicorp.com/vault/docs/secrets/pki1, https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-dynamic-secrets
A
Explanation:
The PKI secrets engine is designed to support the use case of reducing and ultimately removing the use of long lived X.509 certificates. The PKI secrets engine can generate dynamic X.509 certificates on demand, with short time-to-live (TTL) and automatic revocation. This eliminates the need for manual processes of generating, signing, and rotating certificates, and reduces the risk of certificate compromise or misuse. The PKI secrets engine can also act as a certificate authority (CA) or an intermediate CA, and can integrate with external CAs or CRLs. The PKI secrets engine can issue certificates for various purposes, such as TLS, SSH, code signing, email encryption, etc.
Reference: https://developer.hashicorp.com/vault/docs/secrets/pki1, https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-dynamic-secrets
Question #140
Over a few years, you have a lot of data that has been encrypted by older versions of a Transit encryption key. Due to compliance regulations, you have to re-encrypt the data using the newest version of the encryption key.
What is the easiest way to complete this task without putting the data at risk?
- A . Rotate the encryption key used to encrypt the data
- B . Decrypt the data manually and encrypt it with the latest version
- C . Use the transit rewrap feature
- D . Create a new master key used by Vault
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
The Transit rewrap feature re-encrypts data safely. The Vault documentation states:
"Luckily, Vault provides an easy way of re-wrapping encrypted data when a key is rotated. Using the rewrap API endpoint, a non-privileged Vault entity can send data encrypted with an older version of the key to have it re-encrypted with the latest version. The application performing the re-wrapping never interacts with the decrypted data."
― Transit Rewrap Tutorial
C: Correct. Rewrap avoids decryption risks:
"Using the transit rewrap feature in Vault allows you to re-encrypt the data without decrypting it first."
― Transit Rewrap Tutorial
A: Rotation doesn’t re-encrypt existing data.
B: Manual decryption exposes data.
D: Master key changes don’t affect Transit data.
Reference: Transit Rewrap Tutorial
C
Explanation:
Comprehensive and Detailed In-Depth
The Transit rewrap feature re-encrypts data safely. The Vault documentation states:
"Luckily, Vault provides an easy way of re-wrapping encrypted data when a key is rotated. Using the rewrap API endpoint, a non-privileged Vault entity can send data encrypted with an older version of the key to have it re-encrypted with the latest version. The application performing the re-wrapping never interacts with the decrypted data."
― Transit Rewrap Tutorial
C: Correct. Rewrap avoids decryption risks:
"Using the transit rewrap feature in Vault allows you to re-encrypt the data without decrypting it first."
― Transit Rewrap Tutorial
A: Rotation doesn’t re-encrypt existing data.
B: Manual decryption exposes data.
D: Master key changes don’t affect Transit data.
Reference: Transit Rewrap Tutorial