HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #231
Although batch and service tokens share many characteristics, which of the following are true only about batch tokens? (Select three)
- A . Can create child tokens
- B . Are renewable up until the max TTL
- C . Maintain a single fixed TTL
- D . They are valid for either the primary or any secondary clusters
- E . They are not persisted to disk
Correct Answer: C, D, E
C, D, E
Explanation:
Comprehensive and Detailed In-Depth
Batch and service tokens differ in key ways, with these unique to batch tokens:
C. Maintain a single fixed TTL: "Batch tokens maintain a single fixed TTL," non-renewable, unlike service tokens.
D. Valid across clusters: "They are valid for either the primary or any secondary clusters," enhancing flexibility in replicated setups.
E. Not persisted to disk: "Batch tokens are not persisted to disk," reducing exposure risk.
Incorrect Options:
C, D, E
Explanation:
Comprehensive and Detailed In-Depth
Batch and service tokens differ in key ways, with these unique to batch tokens:
C. Maintain a single fixed TTL: "Batch tokens maintain a single fixed TTL," non-renewable, unlike service tokens.
D. Valid across clusters: "They are valid for either the primary or any secondary clusters," enhancing flexibility in replicated setups.
E. Not persisted to disk: "Batch tokens are not persisted to disk," reducing exposure risk.
Incorrect Options:
Question #232
True or False? When encrypting data with the Transit secrets engine, Vault always stores the ciphertext in a dedicated KV store along with the associated encryption key.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
A: Incorrect. Transit doesn’t store ciphertext; it returns it to the client.
B: Correct. The Transit engine performs encryption/decryption without persisting data. Overall Explanation from Vault Docs:
“The Vault Transit secrets engine does NOT store any data… Ciphertext is returned to the caller.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/transit
B
Explanation:
Comprehensive and Detailed in Depth
A: Incorrect. Transit doesn’t store ciphertext; it returns it to the client.
B: Correct. The Transit engine performs encryption/decryption without persisting data. Overall Explanation from Vault Docs:
“The Vault Transit secrets engine does NOT store any data… Ciphertext is returned to the caller.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/transit
Question #233
A developer team requests integration of their legacy application with Vault to encrypt and decrypt data for a backend database. They cannot modify the application for Vault authentication.
What is the best way to achieve this integration?
- A . Enable the Transit secrets engine and configure the secrets engine to send data directly to the legacy app
- B . Have the app team call the Vault API to encrypt and decrypt the required data
- C . Enable and configure the Kubernetes auth method to allow the application to authenticate to Vault using a JWT
- D . Run the Vault Agent on the application server(s) and use the Auto Auth feature to manage the tokens
Correct Answer: D
D
Explanation:
Comprehensive and Detailed In-Depth
The Vault Agent with Auto-Auth is ideal for legacy apps unable to modify for authentication. The Vault documentation states:
"Legacy applications often suffer from the ability to integrate with modern platforms such as Vault. To assist with this, you can use the Vault Agent to authenticate and manage a Vault token automatically. The token is written to a sink (local file) that the application can pick up and use. The Vault Agent Auto Auth feature will manage the lifecycle of the token to ensure there is always a valid token that the application can use."
― Vault Agent Auto Auth
D: Correct. The Agent handles tokens for Transit encryption:
"Running the Vault Agent on the application server(s) and utilizing the Auto Auth feature is the best way to integrate Vault with the legacy application."
― Vault Agent Auto Auth
A: Transit doesn’t send data directly.
B: Requires app modification, not feasible.
C: Kubernetes auth requires app changes and Kubernetes context.
Reference: Vault Agent Auto Auth Vault Secrets: Transit
D
Explanation:
Comprehensive and Detailed In-Depth
The Vault Agent with Auto-Auth is ideal for legacy apps unable to modify for authentication. The Vault documentation states:
"Legacy applications often suffer from the ability to integrate with modern platforms such as Vault. To assist with this, you can use the Vault Agent to authenticate and manage a Vault token automatically. The token is written to a sink (local file) that the application can pick up and use. The Vault Agent Auto Auth feature will manage the lifecycle of the token to ensure there is always a valid token that the application can use."
― Vault Agent Auto Auth
D: Correct. The Agent handles tokens for Transit encryption:
"Running the Vault Agent on the application server(s) and utilizing the Auto Auth feature is the best way to integrate Vault with the legacy application."
― Vault Agent Auto Auth
A: Transit doesn’t send data directly.
B: Requires app modification, not feasible.
C: Kubernetes auth requires app changes and Kubernetes context.
Reference: Vault Agent Auto Auth Vault Secrets: Transit
Question #234
Your Azure Subscription ID is stored in Vault and you need to retrieve it via Vault API for an automated job. The Subscription ID is stored at secret/cloud/azure/subscription. The secret is stored on a KV Version 2 secrets engine.
What curl command below would successfully retrieve the latest version of the secret?
- A . curl https://vault.krausen.com:8200/v1/secret/data/cloud/azure/subscription
- B . curl –header "X-Vault-Token: hvs.CbzCNJCVWt63jyzyaJakgDwz" https://vault.krausen.com:8200/v1/secret/cloud/azure/subscription
- C . curl –header "X-Vault-Token: hvs.CbzCNJCVWt63jyzyaJakgDwz" https://vault.krausen.com:8200/v1/secret/data/cloud/azure/subscription
- D . curl –header "X-Vault-Token: hvs.CbzCNJCVWt63jyzyaJakgDwz" https://vault.krausen.com:8200/secret/data/cloud/azure/subscription/latest
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
For a KV v2 secrets engine, the API path to retrieve a secret’s data is /v1/<mount>/data/<path>. Here, the mount is secret/, and the path is cloud/azure/subscription, making the correct endpoint /v1/secret/data/cloud/azure/subscription. Authentication requires the X-Vault-Token header with a valid token.
Option C matches this exactly and retrieves the latest version by default, as per KV v2 API behavior.
Option A lacks the token.
Option B omits the /data/ segment, invalid for KV v2.
Option D adds /latest, which isn’t a valid KV v2 endpoint. The KV v2 API docs confirm this structure.
Reference: KV v2 API Docs
Vault API Overview
C
Explanation:
Comprehensive and Detailed In-Depth
For a KV v2 secrets engine, the API path to retrieve a secret’s data is /v1/<mount>/data/<path>. Here, the mount is secret/, and the path is cloud/azure/subscription, making the correct endpoint /v1/secret/data/cloud/azure/subscription. Authentication requires the X-Vault-Token header with a valid token.
Option C matches this exactly and retrieves the latest version by default, as per KV v2 API behavior.
Option A lacks the token.
Option B omits the /data/ segment, invalid for KV v2.
Option D adds /latest, which isn’t a valid KV v2 endpoint. The KV v2 API docs confirm this structure.
Reference: KV v2 API Docs
Vault API Overview
Question #235
In Vault, there are two main types of tokens, batch and service.
Which of the following is true about the renewable capabilities of each?
- A . Batch tokens cannot be renewed, but service can be renewed up to the max TTL
- B . Tokens cannot be renewed without reauthenticating to Vault
- C . Service tokens cannot be renewed, but batch can be renewed up to the max TTL
- D . Both batch and service tokens can be renewed up to the max TTL
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
Token renewability differs:
A
Explanation:
Comprehensive and Detailed In-Depth
Token renewability differs:
Question #236
You can build a high availability Vault cluster with any storage backend.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Not all storage backends support high availability mode for Vault. Only the storage backends that support locking can enable Vault to run in a multi-server mode where one server is active and the others are standby. Some examples of storage backends that support high availability mode are Consul, Integrated Storage, and ZooKeeper. Some examples of storage backends that do not support high availability mode are Filesystem, MySQL, and PostgreSQL.
Reference: https://developer.hashicorp.com/vault/docs/concepts/ha1, https://developer.hashicorp.com/vault/docs/configuration/storage2
B
Explanation:
Not all storage backends support high availability mode for Vault. Only the storage backends that support locking can enable Vault to run in a multi-server mode where one server is active and the others are standby. Some examples of storage backends that support high availability mode are Consul, Integrated Storage, and ZooKeeper. Some examples of storage backends that do not support high availability mode are Filesystem, MySQL, and PostgreSQL.
Reference: https://developer.hashicorp.com/vault/docs/concepts/ha1, https://developer.hashicorp.com/vault/docs/configuration/storage2
Question #237
How does the instance updates feature work when using the Vault Secrets Operator?
- A . By monitoring the Vault audit logs to watch for changes to the target path
- B . By constantly validating the current secret stored in Vault
- C . By continuously launching an init container to check for updates
- D . By subscribing to event notifications from Vault
Correct Answer: D
D
Explanation:
Comprehensive and Detailed In-Depth
The Vault Secrets Operator (VSO) uses event notifications for instant updates. The Vault documentation states:
"Vault Secrets Operator (VSO) supports instant updates for VaultStaticSecrets by subscribing to event notifications from Vault. This allows the Vault Secrets Operator to receive real-time updates and
changes to secrets, ensuring that the application always has access to the latest secret values without the need for manual intervention."
― Vault Secrets Operator: Instant Updates
D: Correct. Subscribing to Vault’s event notifications enables real-time updates.
A: Audit logs track actions, not real-time updates.
B: Constant validation isn’t the mechanism; it’s notification-driven.
C: Continuous init containers are inefficient and not used by VSO.
Reference: Vault Secrets Operator: Instant Updates
D
Explanation:
Comprehensive and Detailed In-Depth
The Vault Secrets Operator (VSO) uses event notifications for instant updates. The Vault documentation states:
"Vault Secrets Operator (VSO) supports instant updates for VaultStaticSecrets by subscribing to event notifications from Vault. This allows the Vault Secrets Operator to receive real-time updates and
changes to secrets, ensuring that the application always has access to the latest secret values without the need for manual intervention."
― Vault Secrets Operator: Instant Updates
D: Correct. Subscribing to Vault’s event notifications enables real-time updates.
A: Audit logs track actions, not real-time updates.
B: Constant validation isn’t the mechanism; it’s notification-driven.
C: Continuous init containers are inefficient and not used by VSO.
Reference: Vault Secrets Operator: Instant Updates
Question #238
Which of the following describes usage of an identity group?
- A . Limit the policies that would otherwise apply to an entity in the group
- B . When they want to revoke the credentials for a whole set of entities simultaneously
- C . Audit token usage
- D . Consistently apply the same set of policies to a collection of entities
Correct Answer: D
D
Explanation:
An identity group is a collection of entities that share some common attributes. An identity group can have one or more policies attached to it, which are inherited by all the members of the group. An identity group can also have subgroups, which can further refine the policies and attributes for a subset of entities.
One of the use cases of an identity group is to consistently apply the same set of policies to a collection of entities. For example, an organization may have different teams or departments, such as engineering, sales, or marketing. Each team may have its own identity group, with policies that grant access to the secrets and resources that are relevant to their work. By creating an identity group for each team, the organization can ensure that the entities belonging to each team have the same level of access and permissions, regardless of which authentication method they use to log in to
Vault.
Reference: Identity: entities and groups | Vault | HashiCorp Developer, vault_identity_group | Resources | hashicorp/vault | Terraform | Terraform Registry
D
Explanation:
An identity group is a collection of entities that share some common attributes. An identity group can have one or more policies attached to it, which are inherited by all the members of the group. An identity group can also have subgroups, which can further refine the policies and attributes for a subset of entities.
One of the use cases of an identity group is to consistently apply the same set of policies to a collection of entities. For example, an organization may have different teams or departments, such as engineering, sales, or marketing. Each team may have its own identity group, with policies that grant access to the secrets and resources that are relevant to their work. By creating an identity group for each team, the organization can ensure that the entities belonging to each team have the same level of access and permissions, regardless of which authentication method they use to log in to
Vault.
Reference: Identity: entities and groups | Vault | HashiCorp Developer, vault_identity_group | Resources | hashicorp/vault | Terraform | Terraform Registry
Question #239
You are the primary Vault operator. During a routine audit, an auditor requested the ability to display all secrets under a specific path in Vault without seeing the actual stored data.
Which policy permits the auditor to display the stored secrets without revealing their contents?
- A . path "kv/apps/production/" { capabilities = ["list"] }
- B . path "kv/apps/+/" { capabilities = ["list"] }
- C . path "kv/+/production" { capabilities = ["list"] }
- D . path "kv/apps/*" { capabilities = ["list", "read"] }
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
The list capability allows viewing secret names without data. The Vault documentation states:
"The list capability is required to list keys at a path without necessarily being able to read the data at those paths. The + symbol is a directory replacement and ANY value would be permitted in that path segment."
― Vault Policies: Capabilities
― Vault Policies: Policy Syntax
C: Correct. Lists all secrets under kv/<anything>/production:
"This policy allows the auditor to list all secrets under the specified path kv/+/production without being able to read the actual stored data."
― Vault Policies: Capabilities
A, B: Too narrow, missing some secrets.
D: Includes read, exposing data.
Reference: Vault Policies: Capabilities
Vault Policies: Policy Syntax
C
Explanation:
Comprehensive and Detailed In-Depth
The list capability allows viewing secret names without data. The Vault documentation states:
"The list capability is required to list keys at a path without necessarily being able to read the data at those paths. The + symbol is a directory replacement and ANY value would be permitted in that path segment."
― Vault Policies: Capabilities
― Vault Policies: Policy Syntax
C: Correct. Lists all secrets under kv/<anything>/production:
"This policy allows the auditor to list all secrets under the specified path kv/+/production without being able to read the actual stored data."
― Vault Policies: Capabilities
A, B: Too narrow, missing some secrets.
D: Includes read, exposing data.
Reference: Vault Policies: Capabilities
Vault Policies: Policy Syntax
Question #240
Which of the following best describes the function of the Vault Secrets Operator in a Kubernetes environment?
- A . It replaces the Kubernetes secrets API entirely and operates purely as a certificate authority for all workloads.
- B . It is a standalone Vault server that automatically applies security policies and rotates root tokens.
- C . It continuously reconciles and synchronizes secrets from Vault to Kubernetes, ensuring secrets are always updated
- D . It provides an interface to dynamically provision Kubernetes clusters through Vault’s infrastructure secrets.
Correct Answer: C
C
Explanation:
Comprehensive and Detailed in Depth
The Vault Secrets Operator (VSO) enhances secrets management in Kubernetes. The HashiCorp Vault documentation states: "The Vault Secrets Operator operates by watching for changes to its supported set of Custom Resource Definitions (CRD). Each CRD provides the specification required to allow the operator to synchronize from one of the supported sources for secrets to a Kubernetes Secret. The operator writes the source secret data directly to the destination Kubernetes Secret, ensuring that any changes made to the source are replicated to the destination over its lifetime."
It further explains: "In this way, an application only needs to have access to the destination secret in order to make use of the secret data contained within." This aligns with C: "It continuously reconciles and synchronizes secrets from Vault to Kubernetes, ensuring secrets are always updated."
Option A is false―it augments, not replaces, the Kubernetes Secrets API and isn’t a CA.
Option B is incorrect―
it’s not a Vault server but an operator.
Option D is wrong―it syncs secrets, not provisions clusters.
Thus, C is correct.
Reference: HashiCorp Vault Documentation – Vault Secrets Operator
C
Explanation:
Comprehensive and Detailed in Depth
The Vault Secrets Operator (VSO) enhances secrets management in Kubernetes. The HashiCorp Vault documentation states: "The Vault Secrets Operator operates by watching for changes to its supported set of Custom Resource Definitions (CRD). Each CRD provides the specification required to allow the operator to synchronize from one of the supported sources for secrets to a Kubernetes Secret. The operator writes the source secret data directly to the destination Kubernetes Secret, ensuring that any changes made to the source are replicated to the destination over its lifetime."
It further explains: "In this way, an application only needs to have access to the destination secret in order to make use of the secret data contained within." This aligns with C: "It continuously reconciles and synchronizes secrets from Vault to Kubernetes, ensuring secrets are always updated."
Option A is false―it augments, not replaces, the Kubernetes Secrets API and isn’t a CA.
Option B is incorrect―
it’s not a Vault server but an operator.
Option D is wrong―it syncs secrets, not provisions clusters.
Thus, C is correct.
Reference: HashiCorp Vault Documentation – Vault Secrets Operator