HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 21,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 21,2026
Question #11
Christy has created a token and needs to use that token to access Vault.
What command can she use to authenticate and access secrets stored in Vault?
$ vault token create -policy=christy
Key Value
— —–
- A . vault login hvs.hxDIPd8RPVtxu4AzSGS1lArP
- B . vault login -method=password
- C . vault login -method=token christy
- D . vault login -accessor=AxwxpDs6LbdFQbWGmBDnwIK3
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
To authenticate with a specific token, Christy should use the vault login command with the token value. The HashiCorp Vault documentation states: "To login with a token, you can use vault login <token> or even vault login -method=token <token> if you like typing more." For the given token hvs.hxDIPd8RPVtxu4AzSGS1lArP, the command vault login hvs.hxDIPd8RPVtxu4AzSGS1lArP authenticates Christy and stores the token for subsequent CLI use. The docs provide an example: "“`
$ vault login s.sf4vj1rFV5PvQSbrxQFsfbXA
Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run ‘vault login’ again. Future Vault requests will automatically use this token.
Key Value
token s.sf4vj1rFV5PvQSbrxQFsfbXA
A
Explanation:
Comprehensive and Detailed in Depth
To authenticate with a specific token, Christy should use the vault login command with the token value. The HashiCorp Vault documentation states: "To login with a token, you can use vault login <token> or even vault login -method=token <token> if you like typing more." For the given token hvs.hxDIPd8RPVtxu4AzSGS1lArP, the command vault login hvs.hxDIPd8RPVtxu4AzSGS1lArP authenticates Christy and stores the token for subsequent CLI use. The docs provide an example: "“`
$ vault login s.sf4vj1rFV5PvQSbrxQFsfbXA
Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run ‘vault login’ again. Future Vault requests will automatically use this token.
Key Value
token s.sf4vj1rFV5PvQSbrxQFsfbXA
Question #12
You are trying to create a new orphan token but receiving a Permission Denied error.
What capabilities are required to create this token without using a root token?
- A . write privileges on the path auth/token
- B . write privileges on the path sys/mounts
- C . sudo privileges on the path auth/token/create
- D . sudo privileges on the path sys/mounts/token
Correct Answer: C
C
Explanation:
Comprehensive and Detailed in Depth
Creating an orphan token without a root token requires sudo privileges on the path auth/token/create. The HashiCorp Vault documentation states: "The following paths require a root token or sudo capability in the policy: auth/token/create POST Create a periodic or an orphan token (period or no_parent) option." Orphan tokens are not tied to a parent, requiring elevated permissions due to their standalone nature.
The docs further note: "Certain endpoints, such as creating orphan tokens, are root-protected and require either a root token or a policy with sudo capability on the specific path." write on auth/token (A) is insufficient without sudo. write on sys/mounts (B) and sudo on sys/mounts/token (D) are unrelated to token creation. Thus, C is correct.
Reference: HashiCorp Vault Documentation – Policies: Root-Protected API Endpoints
C
Explanation:
Comprehensive and Detailed in Depth
Creating an orphan token without a root token requires sudo privileges on the path auth/token/create. The HashiCorp Vault documentation states: "The following paths require a root token or sudo capability in the policy: auth/token/create POST Create a periodic or an orphan token (period or no_parent) option." Orphan tokens are not tied to a parent, requiring elevated permissions due to their standalone nature.
The docs further note: "Certain endpoints, such as creating orphan tokens, are root-protected and require either a root token or a policy with sudo capability on the specific path." write on auth/token (A) is insufficient without sudo. write on sys/mounts (B) and sudo on sys/mounts/token (D) are unrelated to token creation. Thus, C is correct.
Reference: HashiCorp Vault Documentation – Policies: Root-Protected API Endpoints
Question #13
There are a few ways in Vault that can be used to obtain a root token. Select the valid methods from the answers below. (Select three)
- A . Generating a root token using a quorum of recovery keys when using Vault auto unseal
- B . Initializing Vault when first creating the cluster by using vault operator init
- C . Using a batch DR operation token to create a new root token in the event of an emergency
- D . Running the command vault token create when using a valid root token
Correct Answer: A, B, D
A, B, D
Explanation:
Comprehensive and Detailed In-Depth
Root tokens are restricted in creation. The Vault documentation states:
"Root tokens are tokens that have the root policy attached to them. In fact, there are only three ways to create root tokens:
The initial root token generated at vault operator init — this token has no expiration
By using another root token; a root token with an expiration cannot create a root token that never expires
By using vault operator generate-root with the permission of a quorum of unseal/recovery key holders"
― Vault Concepts: Tokens
A, B, D: Correct per the above.
C: Incorrect; DR tokens are for replication, not root creation:
"DR operation tokens are typically used for disaster recovery operations and may not be directly related to generating a root token in Vault."
― Vault Replication
Reference: Vault Concepts: Tokens
A, B, D
Explanation:
Comprehensive and Detailed In-Depth
Root tokens are restricted in creation. The Vault documentation states:
"Root tokens are tokens that have the root policy attached to them. In fact, there are only three ways to create root tokens:
The initial root token generated at vault operator init — this token has no expiration
By using another root token; a root token with an expiration cannot create a root token that never expires
By using vault operator generate-root with the permission of a quorum of unseal/recovery key holders"
― Vault Concepts: Tokens
A, B, D: Correct per the above.
C: Incorrect; DR tokens are for replication, not root creation:
"DR operation tokens are typically used for disaster recovery operations and may not be directly related to generating a root token in Vault."
― Vault Replication
Reference: Vault Concepts: Tokens
Question #14
Which two interfaces automatically assume the token for subsequent requests after successfully authenticating? (Select two)
- A . CLI
- B . API
- C . UI
Correct Answer: A, C
A, C
Explanation:
Comprehensive and Detailed in Depth
After successful authentication, the CLI and UI interfaces in Vault automatically assume the token for subsequent requests, simplifying user interaction. The HashiCorp Vault documentation states: "After authenticating, the UI and CLI automatically assume the token for all subsequent requests. The API, however, requires the user to extract the token from the server response after authenticating in order to send with subsequent requests." This is facilitated by Vault’s token helper mechanism for CLI and session management in the UI.
The documentation under "Token Helper" explains: "The Vault CLI uses a token helper to store the token locally after login (e.g., vault login), and future commands automatically use this token without requiring it to be specified each time." Similarly, the UI stores the token in the browser session post-login. In contrast, the API requires explicit inclusion of the token in each request header (e.g., X-Vault-Token), making manual token management necessary. Thus, A (CLI) and C (UI) are correct.
Reference: HashiCorp Vault Documentation – Commands: Token Helper
A, C
Explanation:
Comprehensive and Detailed in Depth
After successful authentication, the CLI and UI interfaces in Vault automatically assume the token for subsequent requests, simplifying user interaction. The HashiCorp Vault documentation states: "After authenticating, the UI and CLI automatically assume the token for all subsequent requests. The API, however, requires the user to extract the token from the server response after authenticating in order to send with subsequent requests." This is facilitated by Vault’s token helper mechanism for CLI and session management in the UI.
The documentation under "Token Helper" explains: "The Vault CLI uses a token helper to store the token locally after login (e.g., vault login), and future commands automatically use this token without requiring it to be specified each time." Similarly, the UI stores the token in the browser session post-login. In contrast, the API requires explicit inclusion of the token in each request header (e.g., X-Vault-Token), making manual token management necessary. Thus, A (CLI) and C (UI) are correct.
Reference: HashiCorp Vault Documentation – Commands: Token Helper
Question #15
When looking at Vault token details, which key helps you find the paths the token is able to access?
- A . Meta
- B . Path
- C . Policies
- D . Accessor
Correct Answer: C
C
Explanation:
When looking at Vault token details, the policies key helps you find the paths the token is able to access. Policies are a declarative way to grant or forbid access to certain paths and operations in Vault. Policies are written in HCL or JSON and are attached to tokens by name. Policies are deny by default, so an empty policy grants no permission in the system. A token can have one or more policies associated with it, and the effective policy is the union of all the individual policies. You can view the token details by using the vault token lookup command or the auth/token/lookup API endpoint. The output will show the policies key with a list of policy names that are attached to the token. You can also view the contents of a policy by using the vault policy read command or the sys/policy API endpoint. The output will show the rules key with the HCL or JSON representation of the policy. The rules will specify the paths and the capabilities (such as create, read, update, delete, list, etc.) that the policy allows or denies.
Reference:
https://developer.hashicorp.com/vault/docs/concepts/policies4, https://developer.hashicorp.com/vault/docs/commands/token/lookup5, https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token6, https://developer.hashicorp.com/vault/docs/commands/policy/read7, https://developer.hashicorp.com/vault/api-docs/system/policy8
C
Explanation:
When looking at Vault token details, the policies key helps you find the paths the token is able to access. Policies are a declarative way to grant or forbid access to certain paths and operations in Vault. Policies are written in HCL or JSON and are attached to tokens by name. Policies are deny by default, so an empty policy grants no permission in the system. A token can have one or more policies associated with it, and the effective policy is the union of all the individual policies. You can view the token details by using the vault token lookup command or the auth/token/lookup API endpoint. The output will show the policies key with a list of policy names that are attached to the token. You can also view the contents of a policy by using the vault policy read command or the sys/policy API endpoint. The output will show the rules key with the HCL or JSON representation of the policy. The rules will specify the paths and the capabilities (such as create, read, update, delete, list, etc.) that the policy allows or denies.
Reference:
https://developer.hashicorp.com/vault/docs/concepts/policies4, https://developer.hashicorp.com/vault/docs/commands/token/lookup5, https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token6, https://developer.hashicorp.com/vault/docs/commands/policy/read7, https://developer.hashicorp.com/vault/api-docs/system/policy8
Question #16
Holly has discovered that a highly privileged dynamic credential with a very long lease time was created, which could negatively impact the organization’s security.
What command can Holly use to invalidate the credential so it can’t be used without affecting other credentials?
- A . vault lease revoke aws/creds/admin/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
- B . Holly would need to delete the credential on the cloud platform directly
- C . vault lease revoke -all
- D . vault lease revoke aws/creds/admin/*
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
To invalidate a specific dynamic credential without affecting others, Holly should use the vault lease revoke command with the exact lease ID. The HashiCorp Vault documentation states: "The lease revoke command revokes the lease on a secret, invalidating the underlying secret. To revoke a lease, you can specify the path and lease ID attached to the creds." The command vault lease revoke aws/creds/admin/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83 targets the specific credential by its unique lease ID, ensuring precision without broader impact.
Deleting the credential on the cloud platform (B) doesn’t guarantee Vault recognizes it as revoked.
vault lease revoke -all (C) revokes all leases, affecting unrelated credentials. vault lease revoke
aws/creds/admin/* (D) revokes all leases under that path, potentially impacting other valid
credentials. Thus, A is the correct command.
Reference: HashiCorp Vault Documentation – Lease Revoke Command
A
Explanation:
Comprehensive and Detailed in Depth
To invalidate a specific dynamic credential without affecting others, Holly should use the vault lease revoke command with the exact lease ID. The HashiCorp Vault documentation states: "The lease revoke command revokes the lease on a secret, invalidating the underlying secret. To revoke a lease, you can specify the path and lease ID attached to the creds." The command vault lease revoke aws/creds/admin/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83 targets the specific credential by its unique lease ID, ensuring precision without broader impact.
Deleting the credential on the cloud platform (B) doesn’t guarantee Vault recognizes it as revoked.
vault lease revoke -all (C) revokes all leases, affecting unrelated credentials. vault lease revoke
aws/creds/admin/* (D) revokes all leases under that path, potentially impacting other valid
credentials. Thus, A is the correct command.
Reference: HashiCorp Vault Documentation – Lease Revoke Command
Question #17
Which of the following is not an action associated with the Transit secrets engine when interacting with data?
- A . encrypt
- B . decrypt
- C . rewrap
- D . update
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
The Transit secrets engine focuses on cryptographic operations, not data storage or modification. The HashiCorp Vault documentation states: "The transit secrets engine handles cryptographic functions on data in-transit. Vault doesn’t store the data sent to the secrets engine. It can also be viewed as ‘cryptography as a service’ or ‘encryption as a service’. The transit secrets engine can also sign and verify data; generate hashes and HMACs of data; and act as a source of random bytes."
It further notes: "You can, however, rewrap data when the key has been rotated to ensure data is encrypted with the latest version." Supported actions include encrypt, decrypt, and rewrap, but update is not a function, as Transit doesn’t store or modify data. Thus, D is correct.
Reference: HashiCorp Vault Documentation – Transit Secrets Engine
D
Explanation:
Comprehensive and Detailed in Depth
The Transit secrets engine focuses on cryptographic operations, not data storage or modification. The HashiCorp Vault documentation states: "The transit secrets engine handles cryptographic functions on data in-transit. Vault doesn’t store the data sent to the secrets engine. It can also be viewed as ‘cryptography as a service’ or ‘encryption as a service’. The transit secrets engine can also sign and verify data; generate hashes and HMACs of data; and act as a source of random bytes."
It further notes: "You can, however, rewrap data when the key has been rotated to ensure data is encrypted with the latest version." Supported actions include encrypt, decrypt, and rewrap, but update is not a function, as Transit doesn’t store or modify data. Thus, D is correct.
Reference: HashiCorp Vault Documentation – Transit Secrets Engine
Question #18
Your organization has many applications needing heavy read access to Vault. As these applications integrate with Vault, the primary Vault cluster’s performance is negatively impacted.
What feature can you use to scale the cluster and improve performance?
- A . Add additional standby nodes
- B . Enable multiple secrets engines for the applications
- C . Enable control groups
- D . Add performance standby nodes
Correct Answer: D
D
Explanation:
Comprehensive and Detailed In-Depth
To address performance issues from heavy read access, Vault Enterprise offers performance standby nodes:
D. Add performance standby nodes: These nodes handle read-only requests locally, offloading the primary cluster. "Vault Enterprise offers additional features that allow HA nodes to service read-only requests on the local standby node," improving scalability and performance. Incorrect Options:
D
Explanation:
Comprehensive and Detailed In-Depth
To address performance issues from heavy read access, Vault Enterprise offers performance standby nodes:
D. Add performance standby nodes: These nodes handle read-only requests locally, offloading the primary cluster. "Vault Enterprise offers additional features that allow HA nodes to service read-only requests on the local standby node," improving scalability and performance. Incorrect Options:
Question #19
A DevOps engineer has set up LDAP and GitHub auth methods. The engineer must ensure user Sarah, who authenticates via either method, has consistent access permissions.
Which approach correctly
describes how to achieve this in Vault?
- A . Create an entity for Sarah and map both her LDAP and GitHub identities as entity aliases to this single entity
- B . Create an external group and add the LDAP and GitHub providers as members of the group
- C . Create separate policies for each auth method and manually ensure they remain synchronized
- D . Configure a trust relationship between the LDAP and GitHub providers to ensure Sarah’s account is synced
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
To ensure consistent access permissions for Sarah across multiple authentication methods (LDAP and GitHub), the correct approach in Vault is to create an entity for Sarah and map both her LDAP and GitHub identities as entity aliases to this single entity.
Entities and Aliases in Vault: Vault’s Identity secrets engine allows the creation of entities, which are logical representations of users or machines. Each entity can have multiple aliases, where an alias corresponds to an identity from a specific auth method. By mapping Sarah’s LDAP identity (e.g., her LDAP username) and GitHub identity (e.g., her GitHub username) as aliases to a single entity, Vault associates both identities with one set of policies. The documentation states: "Vault clients can be mapped as entities and their corresponding accounts with authentication providers can be mapped as aliases."
Why This Works: Assigning policies to the entity ensures that Sarah’s permissions remain consistent regardless of whether she logs in via LDAP or GitHub. This centralizes policy management and eliminates discrepancies.
Incorrect Options:
B. External Group Approach: Creating an external group and adding LDAP and GitHub providers as members does not inherently synchronize permissions for a single user like Sarah. External groups are better suited for mapping group memberships from external systems to Vault policies, not individual identity unification.
C. Separate Policies: Managing separate policies per auth method is error-prone and inefficient.
Manual synchronization risks inconsistencies, undermining security and manageability.
D. Trust Relationship: Vault does not support configuring trust relationships between auth methods like LDAP and GitHub to sync accounts. This is a misunderstanding of Vault’s architecture.
This entity-based approach leverages Vault’s identity system to unify Sarah’s access, simplifying administration and ensuring consistency.
Reference: https://developer.hashicorp.com/vault/tutorials/auth-methods/identity
A
Explanation:
Comprehensive and Detailed In-Depth
To ensure consistent access permissions for Sarah across multiple authentication methods (LDAP and GitHub), the correct approach in Vault is to create an entity for Sarah and map both her LDAP and GitHub identities as entity aliases to this single entity.
Entities and Aliases in Vault: Vault’s Identity secrets engine allows the creation of entities, which are logical representations of users or machines. Each entity can have multiple aliases, where an alias corresponds to an identity from a specific auth method. By mapping Sarah’s LDAP identity (e.g., her LDAP username) and GitHub identity (e.g., her GitHub username) as aliases to a single entity, Vault associates both identities with one set of policies. The documentation states: "Vault clients can be mapped as entities and their corresponding accounts with authentication providers can be mapped as aliases."
Why This Works: Assigning policies to the entity ensures that Sarah’s permissions remain consistent regardless of whether she logs in via LDAP or GitHub. This centralizes policy management and eliminates discrepancies.
Incorrect Options:
B. External Group Approach: Creating an external group and adding LDAP and GitHub providers as members does not inherently synchronize permissions for a single user like Sarah. External groups are better suited for mapping group memberships from external systems to Vault policies, not individual identity unification.
C. Separate Policies: Managing separate policies per auth method is error-prone and inefficient.
Manual synchronization risks inconsistencies, undermining security and manageability.
D. Trust Relationship: Vault does not support configuring trust relationships between auth methods like LDAP and GitHub to sync accounts. This is a misunderstanding of Vault’s architecture.
This entity-based approach leverages Vault’s identity system to unify Sarah’s access, simplifying administration and ensuring consistency.
Reference: https://developer.hashicorp.com/vault/tutorials/auth-methods/identity
Question #20
You are using Vault to generate dynamic credentials for a Microsoft SQL server to perform queries for a month-end report. The report seems to be taking much longer than expected due to degradation on the underlying server, and you are afraid that Vault might automatically revoke the credentials.
How can you extend the time the credentials are valid to ensure your month-end query is successful?
- A . Renew the lease
- B . Generate a new lease
- C . Create a new role within the secrets engine for the database
- D . Revoke the lease
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
Dynamic credentials have a lease with a TTL, after which Vault revokes them. To extend their validity, you renew the lease. The Vault documentation states:
"If a lease has been created in Vault, it has an associated TTL in which it will expire and be revoked. If the lease needs to be extended for some reason, you can use the command vault lease renew <lease_id> to extend the TTL of the lease so it will not expire at its original TTL and will be extended by the time specified in seconds from the current time the lease renewal was issued."
― Vault Commands: lease renew
A: Correct. Renewing the lease (e.g., vault lease renew <lease_id>) extends the TTL: "Renewing the lease of the dynamic credentials in Vault allows you to extend the validity period without having to generate new credentials."
― Vault Commands: lease renew
B: Generating a new lease creates new credentials, disrupting the query.
C: Creating a new role doesn’t extend existing credentials’ TTL.
D: Revoking the lease terminates the credentials, halting the query.
Reference: Vault Commands: lease renew
Vault Concepts: Leases
A
Explanation:
Comprehensive and Detailed In-Depth
Dynamic credentials have a lease with a TTL, after which Vault revokes them. To extend their validity, you renew the lease. The Vault documentation states:
"If a lease has been created in Vault, it has an associated TTL in which it will expire and be revoked. If the lease needs to be extended for some reason, you can use the command vault lease renew <lease_id> to extend the TTL of the lease so it will not expire at its original TTL and will be extended by the time specified in seconds from the current time the lease renewal was issued."
― Vault Commands: lease renew
A: Correct. Renewing the lease (e.g., vault lease renew <lease_id>) extends the TTL: "Renewing the lease of the dynamic credentials in Vault allows you to extend the validity period without having to generate new credentials."
― Vault Commands: lease renew
B: Generating a new lease creates new credentials, disrupting the query.
C: Creating a new role doesn’t extend existing credentials’ TTL.
D: Revoking the lease terminates the credentials, halting the query.
Reference: Vault Commands: lease renew
Vault Concepts: Leases