HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #171
Your organization is integrating its legacy application with Vault to improve its security. However, you have discovered that the application has issues when the token changes for authentication during testing.
What type of token could be used to help alleviate this issue without compromising security?
- A . Periodic Service Token
- B . Root Token
- C . Orphan Service Token
- D . Batch Token
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
Periodic Service Tokens allow renewal without changing the token, addressing the application’s issue. The Vault documentation states:
"In some cases, having a token be revoked would be problematic — for instance, if a long-running service needs to maintain its SQL connection pool over a long period of time. In this scenario, a periodic token can be used. The idea behind periodic tokens is that it is easy for systems and services to perform an action relatively frequently — for instance, every two hours, or even every five minutes. Therefore, as long as a system is actively renewing this token — in other words, as long as the system is alive — the system is allowed to keep using the token and any associated leases."
― Vault Concepts: Tokens
A: Correct. Periodic tokens maintain stability with renewal:
"A Periodic Service Token is a type of token in Vault that can be renewed periodically without the need for the application to re-authenticate every time the token changes."
― Vault Concepts: Tokens
B: Root tokens are insecure for applications due to unlimited access:
"Root tokens should not be used for application authentication due to their high level of access and security risks."
― Vault Concepts: Tokens
C: Orphan tokens don’t support periodic renewal inherently.
D: Batch tokens cannot be renewed:
"Batch tokens cannot be renewed."
― Vault Tutorials: Batch Tokens
Reference: Vault Concepts: Tokens
A
Explanation:
Comprehensive and Detailed In-Depth
Periodic Service Tokens allow renewal without changing the token, addressing the application’s issue. The Vault documentation states:
"In some cases, having a token be revoked would be problematic — for instance, if a long-running service needs to maintain its SQL connection pool over a long period of time. In this scenario, a periodic token can be used. The idea behind periodic tokens is that it is easy for systems and services to perform an action relatively frequently — for instance, every two hours, or even every five minutes. Therefore, as long as a system is actively renewing this token — in other words, as long as the system is alive — the system is allowed to keep using the token and any associated leases."
― Vault Concepts: Tokens
A: Correct. Periodic tokens maintain stability with renewal:
"A Periodic Service Token is a type of token in Vault that can be renewed periodically without the need for the application to re-authenticate every time the token changes."
― Vault Concepts: Tokens
B: Root tokens are insecure for applications due to unlimited access:
"Root tokens should not be used for application authentication due to their high level of access and security risks."
― Vault Concepts: Tokens
C: Orphan tokens don’t support periodic renewal inherently.
D: Batch tokens cannot be renewed:
"Batch tokens cannot be renewed."
― Vault Tutorials: Batch Tokens
Reference: Vault Concepts: Tokens
Question #172
By default, what happens to child tokens when a parent token is revoked?
- A . The child tokens are revoked
- B . The child tokens are renewed
- C . The child tokens are converted to parent tokens
- D . The child tokens create their own child tokens to be used
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
By default, when a parent token is revoked, all child tokens are also revoked. The HashiCorp Vault documentation (via support article) states: "When a parent token is revoked, all of its child tokens― and all of their leases―are revoked as well. This ensures that a user cannot escape revocation by simply generating a never-ending tree of child tokens." This hierarchical revocation ensures security by terminating all derived access when the parent is invalidated.
The documentation on tokens adds: "Tokens in Vault are part of a hierarchy. Child tokens inherit properties from their parents, and revoking a parent token cascades to its children." Options like renewal, conversion to parent tokens, or creating new child tokens do not occur by default. Thus, A is correct.
Reference: HashiCorp Support – Parent-Child Token Hierarchy
HashiCorp Vault Documentation – Tokens
A
Explanation:
Comprehensive and Detailed in Depth
By default, when a parent token is revoked, all child tokens are also revoked. The HashiCorp Vault documentation (via support article) states: "When a parent token is revoked, all of its child tokens― and all of their leases―are revoked as well. This ensures that a user cannot escape revocation by simply generating a never-ending tree of child tokens." This hierarchical revocation ensures security by terminating all derived access when the parent is invalidated.
The documentation on tokens adds: "Tokens in Vault are part of a hierarchy. Child tokens inherit properties from their parents, and revoking a parent token cascades to its children." Options like renewal, conversion to parent tokens, or creating new child tokens do not occur by default. Thus, A is correct.
Reference: HashiCorp Support – Parent-Child Token Hierarchy
HashiCorp Vault Documentation – Tokens
Question #173
Which of the following are benefits of using the Vault Secrets Operator (VSO)? (Select three)
- A . Support for syncing from multiple secret sources
- B . Bi-directional sync between Vault and Kubernetes Secrets
- C . Automatic secret drift and remediation
- D . Automatic secret rotation for multiple Kubernetes resource types
Correct Answer: A, C, D
A, C, D
Explanation:
Comprehensive and Detailed in Depth
The Vault Secrets Operator (VSO) enhances secrets management in Kubernetes. The HashiCorp Vault
documentation lists its benefits: "The following features are supported by the Vault Secrets Operator:
Support for syncing from multiple secret sources.
Automatic secret drift and remediation.
Automatic secret rotation for Deployment, ReplicaSet, StatefulSet Kubernetes resource types."
The docs explain: "VSO watches for changes to its supported Custom Resource Definitions (CRDs) and synchronizes secrets from Vault to Kubernetes Secrets, ensuring consistency (A). It detects and corrects unauthorized changes (C) and rotates secrets for specified resource types (D)." Bi-directional
sync (B) is not supported―sync is one-way from Vault to Kubernetes. Thus, A, C, and D are correct.
Reference: HashiCorp Vault Documentation – Vault Secrets Operator
A, C, D
Explanation:
Comprehensive and Detailed in Depth
The Vault Secrets Operator (VSO) enhances secrets management in Kubernetes. The HashiCorp Vault
documentation lists its benefits: "The following features are supported by the Vault Secrets Operator:
Support for syncing from multiple secret sources.
Automatic secret drift and remediation.
Automatic secret rotation for Deployment, ReplicaSet, StatefulSet Kubernetes resource types."
The docs explain: "VSO watches for changes to its supported Custom Resource Definitions (CRDs) and synchronizes secrets from Vault to Kubernetes Secrets, ensuring consistency (A). It detects and corrects unauthorized changes (C) and rotates secrets for specified resource types (D)." Bi-directional
sync (B) is not supported―sync is one-way from Vault to Kubernetes. Thus, A, C, and D are correct.
Reference: HashiCorp Vault Documentation – Vault Secrets Operator
Question #174
You’ve set up multiple Vault clusters, one on-premises intended to be the primary cluster, and the second cluster in AWS, which was deployed for performance replication. After enabling replication, developers complain that all the data they’ve stored in the AWS Vault cluster is missing.
What happened?
- A . There is a certificate mismatch after replication was enabled since Vault replication generates its own TLS certificates to ensure nodes are trusted entities
- B . All of the data on the secondary cluster was deleted after replication was enabled
- C . The data was automatically copied to the primary cluster after replication was enabled since all writes are always forwarded to the primary cluster
- D . The data was moved to a recovery path after replication was enabled. Use the vault secrets move
command to move the data back to its intended location
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
A: Certificate issues don’t delete data. Incorrect.
B: Performance replication wipes the secondary’s data to sync with the primary. Correct.
C: Data isn’t copied to the primary; replication is one-way. Incorrect.
D: No recovery path exists; data is wiped. Incorrect.
Overall Explanation from Vault Docs:
“When replication is enabled, all of the secondary’s existing storage will be wiped… This is irrevocable.”
Reference: https://developer.hashicorp.com/vault/tutorials/enterprise/performance-replication
B
Explanation:
Comprehensive and Detailed in Depth
A: Certificate issues don’t delete data. Incorrect.
B: Performance replication wipes the secondary’s data to sync with the primary. Correct.
C: Data isn’t copied to the primary; replication is one-way. Incorrect.
D: No recovery path exists; data is wiped. Incorrect.
Overall Explanation from Vault Docs:
“When replication is enabled, all of the secondary’s existing storage will be wiped… This is irrevocable.”
Reference: https://developer.hashicorp.com/vault/tutorials/enterprise/performance-replication
Question #175
Which of the following auth methods is the best choice for human interaction with Vault (as opposed to machine/system authentication)?
- A . Kubernetes
- B . AppRole
- C . TLS
- D . OIDC
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
For human interaction with Vault, OIDC (OpenID Connect) is the best choice. The HashiCorp Vault documentation states: "Out of the selections provided, OIDC is the best choice since OIDC
authentication uses the user’s web browser to complete the authentication request. This is not well suited for machine-to-machine authentication." OIDC leverages identity providers (e.g., AzureAD, Google) for user-friendly authentication via browser-based flows.
The docs add: "The other options of Kubernetes, AppRole, and TLS are more geared towards
application/machine/system authentication since they aren’t human-friendly." Kubernetes suits
cluster workloads, AppRole is for machines, and TLS secures communication, not human logins. Thus,
D (OIDC) is correct.
Reference: HashiCorp Vault Documentation – Authentication Methods
D
Explanation:
Comprehensive and Detailed in Depth
For human interaction with Vault, OIDC (OpenID Connect) is the best choice. The HashiCorp Vault documentation states: "Out of the selections provided, OIDC is the best choice since OIDC
authentication uses the user’s web browser to complete the authentication request. This is not well suited for machine-to-machine authentication." OIDC leverages identity providers (e.g., AzureAD, Google) for user-friendly authentication via browser-based flows.
The docs add: "The other options of Kubernetes, AppRole, and TLS are more geared towards
application/machine/system authentication since they aren’t human-friendly." Kubernetes suits
cluster workloads, AppRole is for machines, and TLS secures communication, not human logins. Thus,
D (OIDC) is correct.
Reference: HashiCorp Vault Documentation – Authentication Methods
Question #176
True or False? Performing a rekey operation using the vault operator rekey command creates new unseal/recovery keys as well as a new root key?
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
False. The vault operator rekey command updates unseal/recovery keys, not the master key (often confused with “root key”).
The Vault documentation states:
"The operator rekey command generates a new set of unseal keys. This can optionally change the total number of key shares or the required threshold of those key shares to reconstruct the master key. This operation is zero downtime, but it requires that Vault is unsealed and a quorum of existing unseal keys are provided."
― Vault Commands: operator rekey
B: Correct. Only unseal keys are recreated:
"When performing a rekey operation using the vault operator rekey command, new unseal/recovery keys are generated, but the root key remains the same."
― Vault Commands: operator rekey
A: Incorrect; the master key persists.
Reference: Vault Commands: operator rekey
B
Explanation:
Comprehensive and Detailed In-Depth
False. The vault operator rekey command updates unseal/recovery keys, not the master key (often confused with “root key”).
The Vault documentation states:
"The operator rekey command generates a new set of unseal keys. This can optionally change the total number of key shares or the required threshold of those key shares to reconstruct the master key. This operation is zero downtime, but it requires that Vault is unsealed and a quorum of existing unseal keys are provided."
― Vault Commands: operator rekey
B: Correct. Only unseal keys are recreated:
"When performing a rekey operation using the vault operator rekey command, new unseal/recovery keys are generated, but the root key remains the same."
― Vault Commands: operator rekey
A: Incorrect; the master key persists.
Reference: Vault Commands: operator rekey
Question #177
What is the difference between the TTL and the Max TTL (select two)?
- A . The TTL defines when the token will expire and be revoked
- B . The TTL defines when another token will be generated
- C . The Max TTL defines the timeframe for which a token cannot be used
- D . The Max TTL defines the maximum timeframe for which a token can be renewed
Correct Answer: A, D
A, D
Explanation:
Comprehensive and Detailed in Depth
Vault tokens have two key time attributes: TTL (Time-To-Live) and Max TTL (Maximum Time-To-Live), governing their lifecycle.
Let’s dissect each option:
Option A: The TTL defines when the token will expire and be revoked
The TTL is the current lifespan of a token before it expires. For example, a token with a TTL of 24h (vault token create -ttl=24h) expires 24 hours from creation unless renewed. Upon expiry, Vault revokes it automatically. This is a fundamental property of TTL, making this statement accurate. Correct.
Vault Docs Insight: “The TTL defines when the token will expire… if it reaches its TTL, it will be revoked by Vault.” (Core definition.)
Option B: The TTL defines when another token will be generated
TTL governs expiration, not token generation. New tokens are created explicitly (e.g., vault token
create) or via auth methods, not automatically by TTL. This misunderstands TTL’s role―it’s about expiry, not regeneration. Incorrect.
Vault Docs Insight: “TTL is the duration until expiration… New tokens are not generated by TTL.” (No generation link.)
Option C: The Max TTL defines the timeframe for which a token cannot be used
This is backwards. Max TTL sets the upper limit a token can exist through renewals, not a period of inactivity or unusability. A token with a Max TTL of 72h can be renewed up to 72 hours from creation, after which it’s revoked. This option inverts the concept. Incorrect.
Vault Docs Insight: “Max TTL defines the maximum timeframe for which the token can be renewed… not a usage restriction.” (Opposite meaning.)
Option D: The Max TTL defines the maximum timeframe for which a token can be renewed
Max TTL caps the total lifespan of a token, including renewals. For example, a token with TTL=24h and Max TTL=72h (vault token create -ttl=24h -explicit-max-ttl=72h) can be renewed twice (24h + 24h
+ 24h = 72h) before hitting the limit. Beyond 72h, renewal fails, and it expires. This is the precise definition of Max TTL. Correct.
Vault Docs Insight: “The Max TTL defines the maximum timeframe for which the token can be renewed… Once reached, it cannot be renewed further.” (Exact match.)
Detailed Mechanics:
TTL is dynamic, decreasing as time passes (e.g., vault token lookup shows ttl: 23h59m50s after 10 seconds). Renewal (vault token renew) resets TTL to its original value (e.g., 24h), but only up to Max TTL from creation. System defaults (768h/32 days) apply unless overridden. Periodic tokens (-period=24h) renew indefinitely within their period, ignoring Max TTL unless explicitly set.
Real-World Example:
Create: vault token create -ttl=1h -explicit-max-ttl=3h. After 1h, TTL=0, renewable. Renew at 2h total, TTL=1h again. At 3h total, Max TTL hits―revoked. Contrast with TTL-only: vault token create -ttl=1h, renewable up to system Max TTL (768h).
Overall Explanation from Vault Docs:
“The TTL defines when the token will expire… If it reaches its TTL, it will be immediately revoked by Vault. The Max TTL defines the maximum timeframe for which the token can be renewed… Once the Max TTL is reached, the token cannot be renewed any longer and will be revoked.” These attributes ensure controlled token lifecycles.
Reference: https://developer.hashicorp.com/vault/docs/concepts/tokens#token-time-to-live-periodic-tokens-and-explicit-max-ttls
A, D
Explanation:
Comprehensive and Detailed in Depth
Vault tokens have two key time attributes: TTL (Time-To-Live) and Max TTL (Maximum Time-To-Live), governing their lifecycle.
Let’s dissect each option:
Option A: The TTL defines when the token will expire and be revoked
The TTL is the current lifespan of a token before it expires. For example, a token with a TTL of 24h (vault token create -ttl=24h) expires 24 hours from creation unless renewed. Upon expiry, Vault revokes it automatically. This is a fundamental property of TTL, making this statement accurate. Correct.
Vault Docs Insight: “The TTL defines when the token will expire… if it reaches its TTL, it will be revoked by Vault.” (Core definition.)
Option B: The TTL defines when another token will be generated
TTL governs expiration, not token generation. New tokens are created explicitly (e.g., vault token
create) or via auth methods, not automatically by TTL. This misunderstands TTL’s role―it’s about expiry, not regeneration. Incorrect.
Vault Docs Insight: “TTL is the duration until expiration… New tokens are not generated by TTL.” (No generation link.)
Option C: The Max TTL defines the timeframe for which a token cannot be used
This is backwards. Max TTL sets the upper limit a token can exist through renewals, not a period of inactivity or unusability. A token with a Max TTL of 72h can be renewed up to 72 hours from creation, after which it’s revoked. This option inverts the concept. Incorrect.
Vault Docs Insight: “Max TTL defines the maximum timeframe for which the token can be renewed… not a usage restriction.” (Opposite meaning.)
Option D: The Max TTL defines the maximum timeframe for which a token can be renewed
Max TTL caps the total lifespan of a token, including renewals. For example, a token with TTL=24h and Max TTL=72h (vault token create -ttl=24h -explicit-max-ttl=72h) can be renewed twice (24h + 24h
+ 24h = 72h) before hitting the limit. Beyond 72h, renewal fails, and it expires. This is the precise definition of Max TTL. Correct.
Vault Docs Insight: “The Max TTL defines the maximum timeframe for which the token can be renewed… Once reached, it cannot be renewed further.” (Exact match.)
Detailed Mechanics:
TTL is dynamic, decreasing as time passes (e.g., vault token lookup shows ttl: 23h59m50s after 10 seconds). Renewal (vault token renew) resets TTL to its original value (e.g., 24h), but only up to Max TTL from creation. System defaults (768h/32 days) apply unless overridden. Periodic tokens (-period=24h) renew indefinitely within their period, ignoring Max TTL unless explicitly set.
Real-World Example:
Create: vault token create -ttl=1h -explicit-max-ttl=3h. After 1h, TTL=0, renewable. Renew at 2h total, TTL=1h again. At 3h total, Max TTL hits―revoked. Contrast with TTL-only: vault token create -ttl=1h, renewable up to system Max TTL (768h).
Overall Explanation from Vault Docs:
“The TTL defines when the token will expire… If it reaches its TTL, it will be immediately revoked by Vault. The Max TTL defines the maximum timeframe for which the token can be renewed… Once the Max TTL is reached, the token cannot be renewed any longer and will be revoked.” These attributes ensure controlled token lifecycles.
Reference: https://developer.hashicorp.com/vault/docs/concepts/tokens#token-time-to-live-periodic-tokens-and-explicit-max-ttls
Question #178
Which core component of Vault can store, generate, or encrypt data for organizations?
- A . auth method
- B . storage backend
- C . secrets engine
- D . audit device
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
Secrets engines are Vault’s core components for managing data. The Vault documentation states: "Secrets engines are components that store, generate, or encrypt data. Secrets engines are incredibly flexible, so it is easiest to think about them in terms of their function. Secrets engines are provided some set of data, they take some action on that data, and they return a result."
― Vault Secrets Engines
C: Correct. Secrets engines (e.g., KV, Transit) handle storing, generating, or encrypting data: "The secrets engine is a core component of Vault that is responsible for storing, generating, and encrypting data for organizations."
― Vault Secrets Engines
A: Auth methods authenticate, not manage data.
B: Storage backends persist encrypted data, not generate or encrypt it directly.
D: Audit devices log actions, not handle data.
Reference: Vault Secrets Engines
C
Explanation:
Comprehensive and Detailed In-Depth
Secrets engines are Vault’s core components for managing data. The Vault documentation states: "Secrets engines are components that store, generate, or encrypt data. Secrets engines are incredibly flexible, so it is easiest to think about them in terms of their function. Secrets engines are provided some set of data, they take some action on that data, and they return a result."
― Vault Secrets Engines
C: Correct. Secrets engines (e.g., KV, Transit) handle storing, generating, or encrypting data: "The secrets engine is a core component of Vault that is responsible for storing, generating, and encrypting data for organizations."
― Vault Secrets Engines
A: Auth methods authenticate, not manage data.
B: Storage backends persist encrypted data, not generate or encrypt it directly.
D: Audit devices log actions, not handle data.
Reference: Vault Secrets Engines
Question #179
True or False? The Vault Secrets Operator does NOT encrypt client cache, such as Vault tokens and leases, by default in Kubernetes Secrets.
- A . True
- B . False
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
A: VSO doesn’t encrypt client cache by default; it requires extra configuration. Correct.
B: Incorrect; encryption is optional, not default.
Overall Explanation from Vault Docs:
“Client cache persistence and encryption are not enabled by default… Requires Transit engine configuration.”
Reference: https://developer.hashicorp.com/vault/docs/platform/k8s/vso/sources/vault#vault-client-cache
A
Explanation:
Comprehensive and Detailed in Depth
A: VSO doesn’t encrypt client cache by default; it requires extra configuration. Correct.
B: Incorrect; encryption is optional, not default.
Overall Explanation from Vault Docs:
“Client cache persistence and encryption are not enabled by default… Requires Transit engine configuration.”
Reference: https://developer.hashicorp.com/vault/docs/platform/k8s/vso/sources/vault#vault-client-cache
Question #180
You need to create a limited-privileged token that isn’t impacted by the TTL of its parent.
What type of token should you create?
- A . Service token with a use limit
- B . Orphan token
- C . Periodic token
- D . Root token
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
For independence from parent TTL:
B. Orphan token: "Orphan tokens are not children of their parent; therefore, orphan tokens do not
expire when their parent does."
Incorrect Options:
A: Use limit doesn’t affect TTL linkage.
C: Periodic tokens renew but follow parent TTL.
D: Root tokens are unrestricted.
Reference: https://developer.hashicorp.com/vault/tutorials/tokens/tokens#orphan-tokens
B
Explanation:
Comprehensive and Detailed In-Depth
For independence from parent TTL:
B. Orphan token: "Orphan tokens are not children of their parent; therefore, orphan tokens do not
expire when their parent does."
Incorrect Options:
A: Use limit doesn’t affect TTL linkage.
C: Periodic tokens renew but follow parent TTL.
D: Root tokens are unrestricted.
Reference: https://developer.hashicorp.com/vault/tutorials/tokens/tokens#orphan-tokens