HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #211
Which of the following tokens are representative of a batch token? (Select two)
- A . hvr.AAAAAQL_tyer_gNuQqvQYPVQgsNxjap_YW1NB2m4CDHHadQo7rF2XLFGdwNJplAZNKbfloOvifrb pRCGdgG1taTqmC7Da_qftN64zeL10SmNwEoDTiPzC_1aS1KExbtVftU3Sx16cBVqaynwsYRDfVnfTAffE
- B . hvb.CAESIKOOSODDNGUJQe3EmsS8EQthulLjxRDhan_Axte2OrmPGiAKHGh2cy5KVnNhM25JdG82cDB 0a1ZDbWhPTlAyekMQHg
- C . hvb.AAAAAQJnAGuRT_z8FD_jOwP26zYaNzJ456_SVqse0oXtaqrpaLUC3LlHrUoJhQPylGX7A6K_dcS0shi ql6g5-BVpz0QIkCm7ePFQVjDT2HcIf8C6FNgkW313vYgBGP8lzQHebtspC0pqK64cfyU_qPKIka2u4ng-jsoy
- D . hvs.493n55sZp2lX2zyQfpkHTkL4
Correct Answer: BC
BC
Explanation:
Comprehensive and Detailed In-Depth
Batch tokens are identified by:
B, C: "In newer versions of Vault (Vault 1.10+), batch tokens are prepended with hvb."
Incorrect Options:
A: hvr prefix is invalid.
D: hvs indicates service token.
Reference: https://developer.hashicorp.com/vault/tutorials/tokens/tokens
BC
Explanation:
Comprehensive and Detailed In-Depth
Batch tokens are identified by:
B, C: "In newer versions of Vault (Vault 1.10+), batch tokens are prepended with hvb."
Incorrect Options:
A: hvr prefix is invalid.
D: hvs indicates service token.
Reference: https://developer.hashicorp.com/vault/tutorials/tokens/tokens
Question #212
True or False? To encrypt existing encrypted data with the latest version of the encryption key, you need to first decrypt it and then request Vault to re-encrypt it with the latest version of the encryption key.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
This statement is false due to Vault’s rewrap feature:
B. False: "You can use the rewrap feature of the transit secrets engine to rewrap the data with the
latest version of the key. This process does not reveal the plaintext data." Rewrapping updates the
encryption key version without decryption.
Incorrect Option:
B
Explanation:
Comprehensive and Detailed In-Depth
This statement is false due to Vault’s rewrap feature:
B. False: "You can use the rewrap feature of the transit secrets engine to rewrap the data with the
latest version of the key. This process does not reveal the plaintext data." Rewrapping updates the
encryption key version without decryption.
Incorrect Option:
Question #213
What is the result of the following Vault command?
$ vault auth enable kubernetes
- A . Allows Vault to access usernames and passwords stored in a Kubernetes cluster
- B . Mounts the Kubernetes auth method to the default path of kubernetes/
- C . Imports Kubernetes secrets to the local KV database
- D . Enables Vault to host an IdP for Kubernetes workloads
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
The command vault auth enable kubernetes enables the Kubernetes authentication method in Vault. The HashiCorp Vault documentation states: "In order to enable auth methods, the command should be vault auth <enable/disable> followed by the name of the auth method." Specifically, for Kubernetes, it explains: "The vault auth enable kubernetes command mounts the Kubernetes auth method to the default path of kubernetes/." This allows Vault to authenticate Kubernetes workloads using their service account tokens at the path auth/kubernetes/.
The documentation elaborates: "Once enabled, the Kubernetes auth method allows clients running in Kubernetes to authenticate with Vault using a Kubernetes Service Account Token. The default mount path is kubernetes/, though additional parameters can specify a different path." Option A is incorrect―Vault doesn’t access usernames/passwords in Kubernetes; it uses tokens.
Option C is wrong―it doesn’t import secrets, only enables authentication.
Option D is false―Vault doesn’t become an Identity Provider (IdP); it authenticates against Kubernetes. Thus, B is correct.
Reference: HashiCorp Vault Documentation – Secrets Enable Command
HashiCorp Vault Documentation – Kubernetes Auth Method
B
Explanation:
Comprehensive and Detailed in Depth
The command vault auth enable kubernetes enables the Kubernetes authentication method in Vault. The HashiCorp Vault documentation states: "In order to enable auth methods, the command should be vault auth <enable/disable> followed by the name of the auth method." Specifically, for Kubernetes, it explains: "The vault auth enable kubernetes command mounts the Kubernetes auth method to the default path of kubernetes/." This allows Vault to authenticate Kubernetes workloads using their service account tokens at the path auth/kubernetes/.
The documentation elaborates: "Once enabled, the Kubernetes auth method allows clients running in Kubernetes to authenticate with Vault using a Kubernetes Service Account Token. The default mount path is kubernetes/, though additional parameters can specify a different path." Option A is incorrect―Vault doesn’t access usernames/passwords in Kubernetes; it uses tokens.
Option C is wrong―it doesn’t import secrets, only enables authentication.
Option D is false―Vault doesn’t become an Identity Provider (IdP); it authenticates against Kubernetes. Thus, B is correct.
Reference: HashiCorp Vault Documentation – Secrets Enable Command
HashiCorp Vault Documentation – Kubernetes Auth Method
Question #214
If Bobby is currently assigned the following policy, what additional policy can be added to ensure Bobby cannot access the data stored at secret/apps/confidential but still read all other secrets? path "secret/apps/*" { capabilities = ["create", "read", "update", "delete", "list"] }
- A . path "secret/apps/confidential" { capabilities = ["deny"] }
- B . path "secret/*" { capabilities = ["read", "deny"] }
- C . path "secret/apps/*" { capabilities = ["deny"] }
- D . path "secret/apps/confidential/*" { capabilities = ["deny"] }
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
A: Denies all access to secret/apps/confidential, overriding the original policy’s permissions. Correct.
B: Applies to all secret/*, overly restrictive and unclear with mixed capabilities. Incorrect.
C: Denies all secret/apps/*, blocking more than required. Incorrect.
D: Denies subpaths under confidential, not the path itself. Incorrect. Overall Explanation from Vault Docs:
“A deny capability takes precedence over any allow… Use it to restrict specific paths.”
Reference: https://developer.hashicorp.com/vault/docs/concepts/policies#capabilities
A
Explanation:
Comprehensive and Detailed in Depth
A: Denies all access to secret/apps/confidential, overriding the original policy’s permissions. Correct.
B: Applies to all secret/*, overly restrictive and unclear with mixed capabilities. Incorrect.
C: Denies all secret/apps/*, blocking more than required. Incorrect.
D: Denies subpaths under confidential, not the path itself. Incorrect. Overall Explanation from Vault Docs:
“A deny capability takes precedence over any allow… Use it to restrict specific paths.”
Reference: https://developer.hashicorp.com/vault/docs/concepts/policies#capabilities
Question #215
By default, what methods of authentication does Vault support? (Select four)
- A . SSH
- B . Kubernetes
- C . VMware
- D . LDAP
- E . AppRole
- F . JWT
Correct Answer: B, D, E, F
B, D, E, F
Explanation:
Comprehensive and Detailed In-Depth
Vault supports multiple auth methods by default.
The Vault documentation states:
"Auth methods are the components in Vault that perform authentication and are responsible for assigning identity and a set of policies to a user. Available auth methods include AppRole, JWT/OIDC, Kubernetes, LDAP, and more."
― Vault Auth Methods
B: Kubernetes is supported:
"Kubernetes authentication method in Vault allows Kubernetes service accounts to authenticate with Vault."
― Vault Auth: Kubernetes
D: LDAP is supported:
"LDAP authentication method allows users to authenticate against an LDAP directory."
― Vault Auth: LDAP
E: AppRole is supported:
"AppRole authentication method in Vault allows machines or applications to authenticate with Vault."
― Vault Auth: AppRole
F: JWT is supported:
"JWT authentication method in Vault allows users to authenticate using JSON Web Tokens (JWT)."
― Vault Auth: JWT
A: SSH is a secrets engine, not an auth method.
C: VMware is not a default auth method.
Reference: Vault Auth Methods
B, D, E, F
Explanation:
Comprehensive and Detailed In-Depth
Vault supports multiple auth methods by default.
The Vault documentation states:
"Auth methods are the components in Vault that perform authentication and are responsible for assigning identity and a set of policies to a user. Available auth methods include AppRole, JWT/OIDC, Kubernetes, LDAP, and more."
― Vault Auth Methods
B: Kubernetes is supported:
"Kubernetes authentication method in Vault allows Kubernetes service accounts to authenticate with Vault."
― Vault Auth: Kubernetes
D: LDAP is supported:
"LDAP authentication method allows users to authenticate against an LDAP directory."
― Vault Auth: LDAP
E: AppRole is supported:
"AppRole authentication method in Vault allows machines or applications to authenticate with Vault."
― Vault Auth: AppRole
F: JWT is supported:
"JWT authentication method in Vault allows users to authenticate using JSON Web Tokens (JWT)."
― Vault Auth: JWT
A: SSH is a secrets engine, not an auth method.
C: VMware is not a default auth method.
Reference: Vault Auth Methods
Question #216
Which statement most accurately describes how the response wrapping feature functions in Vault?
- A . Vault takes the response it would have sent to an HTTP client and instead inserts it into the cubbyhole of a single-use token, returning that single-use token instead.
- B . Vault encrypts the response with a dedicated key and sends it directly to the client, never storing it on the server or using single-use tokens for additional security.
- C . Vault divides the response into separate parts and stores each part in different tokens, requiring all tokens to be combined before disclosing the secret to the requesting client.
- D . Vault duplicates the response within a persistent token and allows multiple unwraps, ensuring that any user with the correct token can retrieve the secret repeatedly without time restrictions.
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
The response wrapping feature in Vault functions by securing responses in a single-use token’s cubbyhole. The HashiCorp Vault documentation states: "To help address this problem, Vault includes a feature called response wrapping. When requested, Vault can take the response it would have sent to an HTTP client and instead insert it into the cubbyhole of a single-use token, returning that single-use token instead." This ensures the response is accessible only once by the intended recipient.
The docs further explain: "Logically speaking, the response is wrapped by the token, and retrieving it requires an unwrap operation against this token. Functionally speaking, the token provides authorization to use an encryption key from Vault’s keyring to decrypt the data." Options B, C, and D misrepresent this process―no dedicated key encryption, no splitting into multiple tokens, and no persistent multi-use tokens occur. Thus, A is correct.
Reference: HashiCorp Vault Documentation – Response Wrapping
A
Explanation:
Comprehensive and Detailed in Depth
The response wrapping feature in Vault functions by securing responses in a single-use token’s cubbyhole. The HashiCorp Vault documentation states: "To help address this problem, Vault includes a feature called response wrapping. When requested, Vault can take the response it would have sent to an HTTP client and instead insert it into the cubbyhole of a single-use token, returning that single-use token instead." This ensures the response is accessible only once by the intended recipient.
The docs further explain: "Logically speaking, the response is wrapped by the token, and retrieving it requires an unwrap operation against this token. Functionally speaking, the token provides authorization to use an encryption key from Vault’s keyring to decrypt the data." Options B, C, and D misrepresent this process―no dedicated key encryption, no splitting into multiple tokens, and no persistent multi-use tokens occur. Thus, A is correct.
Reference: HashiCorp Vault Documentation – Response Wrapping
Question #217
What API endpoint is used to enable and configure a secrets engine?
- A . /v1/sys/init
- B . /v1/sys/mounts
- C . /v1/sys/config
- D . /v1/sys/plugins/catalog
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
The correct API endpoint for managing secrets engines is:
B. /v1/sys/mounts: "The /sys/mounts endpoint is used to manage secrets engines in Vault." It enables and configures secrets engines by mounting them at specific paths, per the documentation.
Incorrect Options:
B
Explanation:
Comprehensive and Detailed In-Depth
The correct API endpoint for managing secrets engines is:
B. /v1/sys/mounts: "The /sys/mounts endpoint is used to manage secrets engines in Vault." It enables and configures secrets engines by mounting them at specific paths, per the documentation.
Incorrect Options:
Question #218
Your DevOps team would like to provision VMs in GCP via a CICD pipeline. They would like to integrate Vault to protect the credentials used by the tool.
Which secrets engine would you recommend?
- A . Google Cloud Secrets Engine
- B . Identity secrets engine
- C . Key/Value secrets engine version 2
- D . SSH secrets engine
Correct Answer: A
A
Explanation:
The Google Cloud Secrets Engine is the best option for the DevOps team to provision VMs in GCP via a CICD pipeline and integrate Vault to protect the credentials used by the tool. The Google Cloud Secrets Engine can dynamically generate GCP service account keys or OAuth tokens based on IAM policies, which can be used to authenticate and authorize the CICD tool to access GCP resources. The credentials are automatically revoked when they are no longer used or when the lease expires, ensuring that the credentials are short-lived and secure. The DevOps team can configure rolesets or static accounts in Vault to define the scope and permissions of the credentials, and use the Vault API or CLI to request credentials on demand. The Google Cloud Secrets Engine also supports generating access tokens for impersonated service accounts, which can be useful for delegating access to other service accounts without storing or managing their keys1.
The Identity Secrets Engine is not a good option for this use case, because it does not generate GCP credentials, but rather generates identity tokens that can be used to access other Vault secrets engines or namespaces2. The Key/Value Secrets Engine version 2 is also not a good option, because it does not generate dynamic credentials, but rather stores and manages static secrets that the user provides3. The SSH Secrets Engine is not a good option either, because it does not generate GCP credentials, but rather generates SSH keys or OTPs that can be used to access remote hosts via SSH4.
Reference: Google Cloud – Secrets Engines | Vault | HashiCorp Developer Identity – Secrets Engines | Vault | HashiCorp Developer KV – Secrets Engines | Vault | HashiCorp Developer
SSH – Secrets Engines | Vault | HashiCorp Developer
A
Explanation:
The Google Cloud Secrets Engine is the best option for the DevOps team to provision VMs in GCP via a CICD pipeline and integrate Vault to protect the credentials used by the tool. The Google Cloud Secrets Engine can dynamically generate GCP service account keys or OAuth tokens based on IAM policies, which can be used to authenticate and authorize the CICD tool to access GCP resources. The credentials are automatically revoked when they are no longer used or when the lease expires, ensuring that the credentials are short-lived and secure. The DevOps team can configure rolesets or static accounts in Vault to define the scope and permissions of the credentials, and use the Vault API or CLI to request credentials on demand. The Google Cloud Secrets Engine also supports generating access tokens for impersonated service accounts, which can be useful for delegating access to other service accounts without storing or managing their keys1.
The Identity Secrets Engine is not a good option for this use case, because it does not generate GCP credentials, but rather generates identity tokens that can be used to access other Vault secrets engines or namespaces2. The Key/Value Secrets Engine version 2 is also not a good option, because it does not generate dynamic credentials, but rather stores and manages static secrets that the user provides3. The SSH Secrets Engine is not a good option either, because it does not generate GCP credentials, but rather generates SSH keys or OTPs that can be used to access remote hosts via SSH4.
Reference: Google Cloud – Secrets Engines | Vault | HashiCorp Developer Identity – Secrets Engines | Vault | HashiCorp Developer KV – Secrets Engines | Vault | HashiCorp Developer
SSH – Secrets Engines | Vault | HashiCorp Developer
Question #219
When a lease is created, what actions can be performed by using only the lease ID? (Choose two)
- A . Renew the lease
- B . Revoke the lease
- C . Extend the max TTL for the lease
- D . Authenticate using the lease ID
Correct Answer: AB
AB
Explanation:
Comprehensive and Detailed In-Depth
A lease ID in Vault identifies a lease associated with dynamic secrets, allowing specific management actions:
AB
Explanation:
Comprehensive and Detailed In-Depth
A lease ID in Vault identifies a lease associated with dynamic secrets, allowing specific management actions:
Question #220
You are planning to deploy a new Vault cluster for your organization and notice that Vault supports a
wide variety of storage backends. You need high availability since you will have multiple applications relying on the Vault service.
When building your cluster, can you choose any of the available storage backends?
- A . Yes, because all backends provide similar functionality
- B . No, because not all storage backends provide similar functionality
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
Vault supports various storage backends (e.g., Consul, Raft, DynamoDB), but not all provide high availability (HA). HA ensures that Vault remains operational across multiple nodes, with automatic failover if a node fails―an essential feature for applications relying on Vault. The Vault documentation lists each backend’s capabilities, noting that only certain ones (e.g., Consul, Raft Integrated Storage, etcd) support HA through features like leader election and data replication.
Others, like Filesystem or MySQL, don’t support HA natively, making them unsuitable for this requirement. Thus, you cannot choose any backend arbitrarily; the choice must align with HA needs, disproving option A and confirming option B.
Reference: Storage Backends Overview
HA Considerations
B
Explanation:
Comprehensive and Detailed In-Depth
Vault supports various storage backends (e.g., Consul, Raft, DynamoDB), but not all provide high availability (HA). HA ensures that Vault remains operational across multiple nodes, with automatic failover if a node fails―an essential feature for applications relying on Vault. The Vault documentation lists each backend’s capabilities, noting that only certain ones (e.g., Consul, Raft Integrated Storage, etcd) support HA through features like leader election and data replication.
Others, like Filesystem or MySQL, don’t support HA natively, making them unsuitable for this requirement. Thus, you cannot choose any backend arbitrarily; the choice must align with HA needs, disproving option A and confirming option B.
Reference: Storage Backends Overview
HA Considerations