HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #201
Julie is a developer who needs to ensure an application can properly renew its lease for AWS credentials it uses to access data in an S3 bucket.
Although the application would generally use the API, what is the equivalent CLI command to perform this action?
- A . vault renew aws/roles/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99
- B . vault lease renew aws/creds/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99
- C . vault lease renew aws/roles/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99
- D . vault lease renew aws/creds/s3-read-only
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
To renew AWS credential leases:
B. Correct: "The proper command would be vault lease renew aws/creds/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99." Targets the credential lease ID.
Incorrect Options:
A, C: Wrong path (roles vs. creds).
D: Missing lease ID.
Reference: https://developer.hashicorp.com/vault/docs/commands/lease/renew
B
Explanation:
Comprehensive and Detailed In-Depth
To renew AWS credential leases:
B. Correct: "The proper command would be vault lease renew aws/creds/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99." Targets the credential lease ID.
Incorrect Options:
A, C: Wrong path (roles vs. creds).
D: Missing lease ID.
Reference: https://developer.hashicorp.com/vault/docs/commands/lease/renew
Question #202
You want to integrate a third-party application to retrieve credentials from the HashiCorp Vault API.
How can you accomplish this without having direct access to the source code?
- A . You cannot integrate a third-party application with Vault without being able to modify the source code
- B . Put in a request to the third-party application vendor
- C . Instead of the API, have the application use the Vault CLI to retrieve credentials
- D . Use the Vault Agent to obtain secrets and provide them to the application
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
Integrating a third-party application with Vault without modifying its source code requires a solution that handles authentication and secret retrieval externally, then delivers secrets in a way the application can consume (e.g., files or environment variables). Let’s break this down:
Option A: You cannot integrate a third-party application with Vault without being able to modify the source code
This is overly restrictive and incorrect. Vault provides tools like the Vault Agent, which can authenticate and fetch secrets on behalf of an application without requiring code changes. The agent can render secrets into a format (e.g., a file) that the application reads naturally. This option ignores Vault’s flexibility for such scenarios. Incorrect.
Option B: Put in a request to the third-party application vendor
While this might eventually lead to native Vault support, it’s impractical, slow, and depends on the vendor’s willingness and timeline. It doesn’t address the immediate need to integrate without source code access. This is a passive approach, not a technical solution within Vault’s capabilities. Incorrect.
Option C: Instead of the API, have the application use the Vault CLI to retrieve credentials
The Vault CLI is designed for human operators or scripts, not seamless application integration. Third-party applications without source code modification can’t invoke the CLI programmatically unless
they’re scripted to do so, which still requires external orchestration and isn’t a clean solution. This approach is clunky, error-prone, and not suited for real-time secret retrieval in production. Incorrect.
Option D: Use the Vault Agent to obtain secrets and provide them to the application
The Vault Agent is a lightweight daemon that authenticates to Vault, retrieves secrets, and renders them into a consumable format (e.g., a file or environment variables) for the application. For example, if the application reads a config file, the agent can write secrets into that file using a template. This requires no changes to the application’s code―just configuration of the agent and the application’s environment. It’s a standard, scalable solution for such use cases. Correct. Detailed Mechanics:
The Vault Agent operates in two modes: authentication (to obtain a token) and secret rendering (via
templates). For a third-party app, you’d configure the agent with an auth method (e.g., AppRole), a
template (e.g., {{ with secret "secret/data/my-secret" }}{{ .Data.data.key }}{{ end }}), and a sink (e.g.,
/path/to/app/config). The agent runs alongside the app (e.g., as a sidecar in Kubernetes or a daemon
on a VM), polls Vault for updates, and refreshes secrets as needed. The app remains oblivious to
Vault, reading secrets as if they were static configs. This decoupling is key to integrating unmodified
applications.
Real-World Example:
Imagine a legacy app that reads an API key from /etc/app/key.txt. The Vault Agent authenticates with Vault, fetches the key from secret/data/api, and writes it to /etc/app/key.txt. The app starts, reads the file, and operates normally―no code changes required. Overall Explanation from Vault Docs:
“Vault Agent… provides a simpler way for applications to integrate with Vault without requiring changes to application code… It renders templates containing secrets required by your application.” This is ideal for third-party or legacy apps where source code access is unavailable.
Reference: https://developer.hashicorp.com/vault/docs/agent-and-proxy/agent
D
Explanation:
Comprehensive and Detailed in Depth
Integrating a third-party application with Vault without modifying its source code requires a solution that handles authentication and secret retrieval externally, then delivers secrets in a way the application can consume (e.g., files or environment variables). Let’s break this down:
Option A: You cannot integrate a third-party application with Vault without being able to modify the source code
This is overly restrictive and incorrect. Vault provides tools like the Vault Agent, which can authenticate and fetch secrets on behalf of an application without requiring code changes. The agent can render secrets into a format (e.g., a file) that the application reads naturally. This option ignores Vault’s flexibility for such scenarios. Incorrect.
Option B: Put in a request to the third-party application vendor
While this might eventually lead to native Vault support, it’s impractical, slow, and depends on the vendor’s willingness and timeline. It doesn’t address the immediate need to integrate without source code access. This is a passive approach, not a technical solution within Vault’s capabilities. Incorrect.
Option C: Instead of the API, have the application use the Vault CLI to retrieve credentials
The Vault CLI is designed for human operators or scripts, not seamless application integration. Third-party applications without source code modification can’t invoke the CLI programmatically unless
they’re scripted to do so, which still requires external orchestration and isn’t a clean solution. This approach is clunky, error-prone, and not suited for real-time secret retrieval in production. Incorrect.
Option D: Use the Vault Agent to obtain secrets and provide them to the application
The Vault Agent is a lightweight daemon that authenticates to Vault, retrieves secrets, and renders them into a consumable format (e.g., a file or environment variables) for the application. For example, if the application reads a config file, the agent can write secrets into that file using a template. This requires no changes to the application’s code―just configuration of the agent and the application’s environment. It’s a standard, scalable solution for such use cases. Correct. Detailed Mechanics:
The Vault Agent operates in two modes: authentication (to obtain a token) and secret rendering (via
templates). For a third-party app, you’d configure the agent with an auth method (e.g., AppRole), a
template (e.g., {{ with secret "secret/data/my-secret" }}{{ .Data.data.key }}{{ end }}), and a sink (e.g.,
/path/to/app/config). The agent runs alongside the app (e.g., as a sidecar in Kubernetes or a daemon
on a VM), polls Vault for updates, and refreshes secrets as needed. The app remains oblivious to
Vault, reading secrets as if they were static configs. This decoupling is key to integrating unmodified
applications.
Real-World Example:
Imagine a legacy app that reads an API key from /etc/app/key.txt. The Vault Agent authenticates with Vault, fetches the key from secret/data/api, and writes it to /etc/app/key.txt. The app starts, reads the file, and operates normally―no code changes required. Overall Explanation from Vault Docs:
“Vault Agent… provides a simpler way for applications to integrate with Vault without requiring changes to application code… It renders templates containing secrets required by your application.” This is ideal for third-party or legacy apps where source code access is unavailable.
Reference: https://developer.hashicorp.com/vault/docs/agent-and-proxy/agent
Question #203
Which of the following storage backends support high availability? (Select four)
- A . Consul
- B . etcd
- C . DynamoDB
- D . Integrated Storage (raft)
- E . Amazon S3
- F . In-Memory
Correct Answer: A, B, C, D
A, B, C, D
Explanation:
Comprehensive and Detailed In-Depth
Vault supports various storage backends, but only some are designed to provide high availability (HA), ensuring data consistency and fault tolerance across multiple nodes.
The four backends that support HA are:
A, B, C, D
Explanation:
Comprehensive and Detailed In-Depth
Vault supports various storage backends, but only some are designed to provide high availability (HA), ensuring data consistency and fault tolerance across multiple nodes.
The four backends that support HA are:
Question #204
What occurs when a Vault cluster cannot maintain a quorum while using the Integrated Storage backend?
- A . Vault continues to operate in read-only mode until quorum is restored
- B . The cluster becomes unavailable and cannot commit new logs
- C . Vault automatically promotes a standby node to a leader to restore quorum
- D . Vault temporarily switches to local storage until quorum is regained
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
Integrated Storage (Raft) requires a quorum:
B. Unavailable: "If a cluster cannot achieve quorum, the cluster becomes unavailable and cannot commit new logs." Quorum is "a majority of members from a peer set," e.g., 3 of 5 nodes.
Incorrect Options:
B
Explanation:
Comprehensive and Detailed In-Depth
Integrated Storage (Raft) requires a quorum:
B. Unavailable: "If a cluster cannot achieve quorum, the cluster becomes unavailable and cannot commit new logs." Quorum is "a majority of members from a peer set," e.g., 3 of 5 nodes.
Incorrect Options:
Question #205
Jason has enabled the userpass auth method at the path users/.
What path would Jason and other Vault operators use to interact with this new auth method?
- A . users/auth/
- B . authentication/users
- C . auth/users
- D . users/
Correct Answer: C
C
Explanation:
Comprehensive and Detailed in Depth
In HashiCorp Vault, authentication methods (auth methods) are mechanisms that allow users or machines to authenticate and obtain a token. When an auth method like userpass is enabled, it is mounted at a specific path in Vault’s namespace, and this path determines where operators interact with it―e.g., to log in, configure, or manage it.
The userpass auth method is enabled with the command vault auth enable -path=users userpass,
meaning it’s explicitly mounted at the users/ path. However, Vault’s authentication system has a
standard convention: all auth methods are accessed under the auth/ prefix, followed by the mount
path. This prefix is a logical namespace separating authentication endpoints from secrets engines or
system endpoints.
Option A: users/auth/
This reverses the expected order. The auth/ prefix comes first, followed by the mount path (users/),
not the other way around. This path would not correspond to any valid Vault endpoint for interacting
with the userpass auth method. Incorrect.
Option B: authentication/users
Vault does not use authentication/ as a prefix; it uses auth/. The term “authentication” is not part of
Vault’s path structure―it’s a conceptual term, not a literal endpoint. This makes the path invalid and
unusable in Vault’s API or CLI. Incorrect.
Option C: auth/users
This follows Vault’s standard convention: auth/ (the authentication namespace) followed by users (the custom mount path specified when enabling the auth method). For example, to log in using the userpass method mounted at users/, the command would be vault login -method=userpass – path=users username=<user>. The API endpoint would be /v1/auth/users/login. This is the correct path for operators to interact with the auth method, whether via CLI, UI, or API. Correct.
Option D: users/
While users/ is the mount path, omitting the auth/ prefix breaks Vault’s structure. Directly accessing
users/ would imply it’s a secrets engine or other mount type, not an auth method. Auth methods always require the auth/ prefix for interaction. Incorrect. Detailed Mechanics:
When an auth method is enabled, Vault creates a backend at the specified path under auth/. The userpass method, for instance, supports endpoints like /login (for authentication) and /users/<username> (for managing users). If mounted at users/, these become auth/users/login and auth/users/users/<username>. This structure ensures isolation and clarity in Vault’s routing system. The ability to customize the path (e.g., users/ instead of the default userpass/) allows flexibility for organizations with multiple auth instances, but the auth/ prefix remains mandatory. Overall Explanation from Vault Docs:
“When enabled, auth methods are mounted within the Vault mount table under the auth/ prefix… For example, enabling userpass at users/ allows interaction at auth/users.” This convention ensures operators can consistently locate and manage auth methods, regardless of custom paths.
Reference: https://developer.hashicorp.com/vault/docs/auth#enabling-disabling-auth-methods
C
Explanation:
Comprehensive and Detailed in Depth
In HashiCorp Vault, authentication methods (auth methods) are mechanisms that allow users or machines to authenticate and obtain a token. When an auth method like userpass is enabled, it is mounted at a specific path in Vault’s namespace, and this path determines where operators interact with it―e.g., to log in, configure, or manage it.
The userpass auth method is enabled with the command vault auth enable -path=users userpass,
meaning it’s explicitly mounted at the users/ path. However, Vault’s authentication system has a
standard convention: all auth methods are accessed under the auth/ prefix, followed by the mount
path. This prefix is a logical namespace separating authentication endpoints from secrets engines or
system endpoints.
Option A: users/auth/
This reverses the expected order. The auth/ prefix comes first, followed by the mount path (users/),
not the other way around. This path would not correspond to any valid Vault endpoint for interacting
with the userpass auth method. Incorrect.
Option B: authentication/users
Vault does not use authentication/ as a prefix; it uses auth/. The term “authentication” is not part of
Vault’s path structure―it’s a conceptual term, not a literal endpoint. This makes the path invalid and
unusable in Vault’s API or CLI. Incorrect.
Option C: auth/users
This follows Vault’s standard convention: auth/ (the authentication namespace) followed by users (the custom mount path specified when enabling the auth method). For example, to log in using the userpass method mounted at users/, the command would be vault login -method=userpass – path=users username=<user>. The API endpoint would be /v1/auth/users/login. This is the correct path for operators to interact with the auth method, whether via CLI, UI, or API. Correct.
Option D: users/
While users/ is the mount path, omitting the auth/ prefix breaks Vault’s structure. Directly accessing
users/ would imply it’s a secrets engine or other mount type, not an auth method. Auth methods always require the auth/ prefix for interaction. Incorrect. Detailed Mechanics:
When an auth method is enabled, Vault creates a backend at the specified path under auth/. The userpass method, for instance, supports endpoints like /login (for authentication) and /users/<username> (for managing users). If mounted at users/, these become auth/users/login and auth/users/users/<username>. This structure ensures isolation and clarity in Vault’s routing system. The ability to customize the path (e.g., users/ instead of the default userpass/) allows flexibility for organizations with multiple auth instances, but the auth/ prefix remains mandatory. Overall Explanation from Vault Docs:
“When enabled, auth methods are mounted within the Vault mount table under the auth/ prefix… For example, enabling userpass at users/ allows interaction at auth/users.” This convention ensures operators can consistently locate and manage auth methods, regardless of custom paths.
Reference: https://developer.hashicorp.com/vault/docs/auth#enabling-disabling-auth-methods
Question #206
Which of the following statements are true about HCP Vault Dedicated? (Select three)
- A . Provides 100% feature parity compared to Vault self-managed clusters
- B . Helps reduce operational overhead for organizations with push-button deployment and fully managed upgrades
- C . Increases reliability and ease of use so you can onboard applications and teams easily
- D . Increases security across clouds and machines through a single interface
Correct Answer: B, C, D
B, C, D
Explanation:
Comprehensive and Detailed in Depth
HCP Vault Dedicated is a managed cloud service offering specific benefits over self-managed Vault. The HashiCorp Vault documentation outlines its advantages: "Vault Enterprise running on the HashiCorp Cloud Platform (HCP) enables users to secure, store, and tightly control access to tokens, passwords, certificates, and encryption keys within one unified cloud-based platform."
It lists the following benefits relevant to the options:
B (Helps reduce operational overhead for organizations with push-button deployment and fully managed upgrades): The documentation states, "Reduce operational overhead: Push-button deployment, fully managed upgrades, and backups mean organizations can focus on adoption and integration instead of operational overhead." This reflects HCP Vault Dedicated’s managed nature, automating deployment and maintenance tasks.
C (Increases reliability and ease of use so you can onboard applications and teams easily): It notes, "Ease of use: HCP Vault Dedicated is built around making cloud security automation simple. Get up and running quickly so that you can onboard applications and teams easily," and "Reliability: HashiCorp has experience supporting thousands of commercial Vault Enterprise clusters and HCP Vault Dedicated brings that expertise directly to users." This simplifies onboarding and ensures dependable operation.
D (Increases security across clouds and machines through a single interface): The docs confirm, "Increase security across clouds and machines: Secure your infrastructure across all your environments through a single interface and globally control and restrict access to sensitive data and systems," highlighting centralized security management.
However, A (Provides 100% feature parity compared to Vault self-managed clusters) is false. The documentation clarifies under "Feature Parity": "HCP Vault Dedicated does not provide 100% feature parity compared to Vault self-managed clusters. While it offers many of the same features and capabilities, there may be some differences or limitations in functionality between the two deployment options." Thus, B, C, and D are true.
Reference: HashiCorp Vault Documentation – What is HCP Vault: Feature Parity
B, C, D
Explanation:
Comprehensive and Detailed in Depth
HCP Vault Dedicated is a managed cloud service offering specific benefits over self-managed Vault. The HashiCorp Vault documentation outlines its advantages: "Vault Enterprise running on the HashiCorp Cloud Platform (HCP) enables users to secure, store, and tightly control access to tokens, passwords, certificates, and encryption keys within one unified cloud-based platform."
It lists the following benefits relevant to the options:
B (Helps reduce operational overhead for organizations with push-button deployment and fully managed upgrades): The documentation states, "Reduce operational overhead: Push-button deployment, fully managed upgrades, and backups mean organizations can focus on adoption and integration instead of operational overhead." This reflects HCP Vault Dedicated’s managed nature, automating deployment and maintenance tasks.
C (Increases reliability and ease of use so you can onboard applications and teams easily): It notes, "Ease of use: HCP Vault Dedicated is built around making cloud security automation simple. Get up and running quickly so that you can onboard applications and teams easily," and "Reliability: HashiCorp has experience supporting thousands of commercial Vault Enterprise clusters and HCP Vault Dedicated brings that expertise directly to users." This simplifies onboarding and ensures dependable operation.
D (Increases security across clouds and machines through a single interface): The docs confirm, "Increase security across clouds and machines: Secure your infrastructure across all your environments through a single interface and globally control and restrict access to sensitive data and systems," highlighting centralized security management.
However, A (Provides 100% feature parity compared to Vault self-managed clusters) is false. The documentation clarifies under "Feature Parity": "HCP Vault Dedicated does not provide 100% feature parity compared to Vault self-managed clusters. While it offers many of the same features and capabilities, there may be some differences or limitations in functionality between the two deployment options." Thus, B, C, and D are true.
Reference: HashiCorp Vault Documentation – What is HCP Vault: Feature Parity
Question #207
True or False? When using the Transit secrets engine, setting the min_decryption_version will determine the minimum key length of the data key (i.e., 2048, 4096, etc.).
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
A: Incorrect. min_decryption_version sets the minimum key version, not length.
B: Correct. It controls versioning, not key size.
Overall Explanation from Vault Docs:
“min_decryption_version specifies the minimum key version for decryption… Key length is a separate configuration.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/transit#usage
B
Explanation:
Comprehensive and Detailed in Depth
A: Incorrect. min_decryption_version sets the minimum key version, not length.
B: Correct. It controls versioning, not key size.
Overall Explanation from Vault Docs:
“min_decryption_version specifies the minimum key version for decryption… Key length is a separate configuration.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/transit#usage
Question #208
Which of the following token attributes can be used to renew a token in Vault (select two)?
- A . TTL
- B . Token ID
- C . Identity policy
- D . Token accessor
Correct Answer: B, D
B, D
Explanation:
Comprehensive and Detailed in Depth
Token renewal extends a token’s TTL. Let’s evaluate:
A: TTL – Defines expiration time, not used for renewal. Incorrect.
B: Token ID – The token’s unique identifier; can be specified to renew it (e.g., vault token renew <token-id>). Correct.
C: Identity policy – Relates to access control, not renewal. Incorrect.
D: Token accessor – A unique identifier for operations like renewal without exposing the token (e.g., vault token renew -accessor <accessor>). Correct.
Overall Explanation from Vault Docs:
“Tokens can be renewed with vault token renew using either the token ID or accessor… TTL is not an attribute for renewal.”
Reference: https://developer.hashicorp.com/vault/docs/commands/token/renew#token-renew
B, D
Explanation:
Comprehensive and Detailed in Depth
Token renewal extends a token’s TTL. Let’s evaluate:
A: TTL – Defines expiration time, not used for renewal. Incorrect.
B: Token ID – The token’s unique identifier; can be specified to renew it (e.g., vault token renew <token-id>). Correct.
C: Identity policy – Relates to access control, not renewal. Incorrect.
D: Token accessor – A unique identifier for operations like renewal without exposing the token (e.g., vault token renew -accessor <accessor>). Correct.
Overall Explanation from Vault Docs:
“Tokens can be renewed with vault token renew using either the token ID or accessor… TTL is not an attribute for renewal.”
Reference: https://developer.hashicorp.com/vault/docs/commands/token/renew#token-renew
Question #209
Tommy has written an AWS Lambda function that will perform certain tasks for the organization when data has been uploaded to an S3 bucket. Security policies for the organization do not allow Tommy to hardcode any type of credential within the Lambda code or environment variables.
However, Tommy needs to retrieve a credential from Vault to write data to an on-premises database.
What auth method should Tommy use in Vault to meet the requirements while not violating security policies?
- A . AWS
- B . Userpass
- C . Token
- D . AppRole
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
A: AWS auth uses IAM roles, avoiding hardcoded credentials. Correct for Lambda.
B: Userpass requires username/password, violating policy. Incorrect.
C: Token requires a pre-generated token, often hardcoded. Incorrect.
D: AppRole needs RoleID/SecretID, typically hardcoded. Incorrect.
Overall Explanation from Vault Docs:
“The AWS auth method provides an automated mechanism to retrieve a Vault token for IAM principals… no manual credential provisioning required.”
Reference: https://developer.hashicorp.com/vault/docs/auth/aws#aws-auth-method
A
Explanation:
Comprehensive and Detailed in Depth
A: AWS auth uses IAM roles, avoiding hardcoded credentials. Correct for Lambda.
B: Userpass requires username/password, violating policy. Incorrect.
C: Token requires a pre-generated token, often hardcoded. Incorrect.
D: AppRole needs RoleID/SecretID, typically hardcoded. Incorrect.
Overall Explanation from Vault Docs:
“The AWS auth method provides an automated mechanism to retrieve a Vault token for IAM principals… no manual credential provisioning required.”
Reference: https://developer.hashicorp.com/vault/docs/auth/aws#aws-auth-method
Question #210
Which of the following are accurate statements regarding the use of a KV v2 secrets engine (select three)?
- A . Issuing a vault kv destroy command permanently deletes the current version of the secret
- B . Issuing a vault kv destroy command deletes all versions of a secret
- C . Issuing a vault kv delete command performs a soft delete of the current version
- D . Issuing a vault kv metadata delete command permanently deletes the secret
Correct Answer: A, C, D
A, C, D
Explanation:
Comprehensive and Detailed in Depth
KV v2 supports versioning. Let’s evaluate:
A: destroy removes a specific version permanently. Correct.
B: destroy targets specified versions, not all. Incorrect.
C: delete soft-deletes the current version. Correct.
D: metadata delete removes all versions and metadata. Correct. Overall Explanation from Vault Docs:
“kv delete soft-deletes… kv destroy permanently removes versions… kv metadata delete wipes everything.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2
A, C, D
Explanation:
Comprehensive and Detailed in Depth
KV v2 supports versioning. Let’s evaluate:
A: destroy removes a specific version permanently. Correct.
B: destroy targets specified versions, not all. Incorrect.
C: delete soft-deletes the current version. Correct.
D: metadata delete removes all versions and metadata. Correct. Overall Explanation from Vault Docs:
“kv delete soft-deletes… kv destroy permanently removes versions… kv metadata delete wipes everything.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2