HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #251
How can Vault be used to programmatically obtain a generated code for MFA, somewhat similar to Google Authenticator?
- A . Cubbyhole
- B . The random byte generator
- C . TOTP secrets engine
- D . The identity secrets engine
Correct Answer: C
C
Explanation:
Comprehensive and Detailed in Depth
Vault can generate time-based one-time passwords (TOTP) for multi-factor authentication (MFA), mimicking apps like Google Authenticator. Let’s evaluate:
Option A: Cubbyhole
Cubbyhole is a per-token secret store, not a TOTP generator. It’s for temporary secret storage, not MFA code generation.
Incorrect.
Vault Docs Insight: “Cubbyhole stores secrets tied to a token… no TOTP functionality.” (Different purpose.)
Option B: The random byte generator
Vault’s /sys/tools/random endpoint generates random bytes, not time-based codes synced with a clock (TOTP requirement). It’s for generic randomness, not MFA. Incorrect.
Vault Docs Insight: “Random bytes are not time-based… unsuitable for TOTP.” (Unrelated feature.)
Option C: TOTP secrets engine
The TOTP engine generates and validates TOTP codes (e.g., 6-digit codes every 30s) using a shared secret, just like Google Authenticator. You create a key (vault write totp/keys/my-key) and fetch codes (vault read totp/code/my-key). Perfect for programmatic MFA. Correct.
Vault Docs Insight: “The TOTP secrets engine can act as a TOTP code generator… replacing traditional generators like Google Authenticator.” (Exact match.) Option D: The identity secrets engine
The Identity engine manages user/entity identities and policies, not TOTP codes. It’s for identity management, not MFA generation. Incorrect.
Vault Docs Insight: “Identity engine handles identity data… no TOTP generation.” (Different scope.)
Detailed Mechanics:
Enable: vault secrets enable totp. Create key: vault write totp/keys/my-key issuer=Vault. Get code: vault read totp/code/my-key returns {"data":{"code":"123456"}}. Codes sync with time (RFC 6238), usable in APIs or apps.
Overall Explanation from Vault Docs:
“The TOTP secrets engine can act as a TOTP code generator… It provides an added layer of security since the ability to generate codes is guarded by policies and audited.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/totp
C
Explanation:
Comprehensive and Detailed in Depth
Vault can generate time-based one-time passwords (TOTP) for multi-factor authentication (MFA), mimicking apps like Google Authenticator. Let’s evaluate:
Option A: Cubbyhole
Cubbyhole is a per-token secret store, not a TOTP generator. It’s for temporary secret storage, not MFA code generation.
Incorrect.
Vault Docs Insight: “Cubbyhole stores secrets tied to a token… no TOTP functionality.” (Different purpose.)
Option B: The random byte generator
Vault’s /sys/tools/random endpoint generates random bytes, not time-based codes synced with a clock (TOTP requirement). It’s for generic randomness, not MFA. Incorrect.
Vault Docs Insight: “Random bytes are not time-based… unsuitable for TOTP.” (Unrelated feature.)
Option C: TOTP secrets engine
The TOTP engine generates and validates TOTP codes (e.g., 6-digit codes every 30s) using a shared secret, just like Google Authenticator. You create a key (vault write totp/keys/my-key) and fetch codes (vault read totp/code/my-key). Perfect for programmatic MFA. Correct.
Vault Docs Insight: “The TOTP secrets engine can act as a TOTP code generator… replacing traditional generators like Google Authenticator.” (Exact match.) Option D: The identity secrets engine
The Identity engine manages user/entity identities and policies, not TOTP codes. It’s for identity management, not MFA generation. Incorrect.
Vault Docs Insight: “Identity engine handles identity data… no TOTP generation.” (Different scope.)
Detailed Mechanics:
Enable: vault secrets enable totp. Create key: vault write totp/keys/my-key issuer=Vault. Get code: vault read totp/code/my-key returns {"data":{"code":"123456"}}. Codes sync with time (RFC 6238), usable in APIs or apps.
Overall Explanation from Vault Docs:
“The TOTP secrets engine can act as a TOTP code generator… It provides an added layer of security since the ability to generate codes is guarded by policies and audited.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/totp
Question #252
You need a simple and self-contained HashiCorp Vault cluster deployment with minimal dependencies.
Which storage backend is best suited for this use case, providing all configuration within Vault and avoiding external services?
- A . Local File Storage Backend
- B . Integrated Storage (raft) Backend
- C . Consul Backend
- D . In-Memory Backend
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
For self-contained deployment:
B. Integrated Storage (raft): "The best choice for a simple and self-contained Vault cluster deployment with minimal dependencies." Uses Raft for consistency, no external services needed. Incorrect Options:
A: Less reliable for production.
C: Requires Consul.
D: Non-persistent, for testing.
Reference: https://developer.hashicorp.com/vault/docs/v1.16.x/internals/integrated-storage
B
Explanation:
Comprehensive and Detailed In-Depth
For self-contained deployment:
B. Integrated Storage (raft): "The best choice for a simple and self-contained Vault cluster deployment with minimal dependencies." Uses Raft for consistency, no external services needed. Incorrect Options:
A: Less reliable for production.
C: Requires Consul.
D: Non-persistent, for testing.
Reference: https://developer.hashicorp.com/vault/docs/v1.16.x/internals/integrated-storage
Question #253
What command would have created the token displayed below?
$ vault token lookup hvs.nNeZ2I64ALCxuO7dqQEJGPrO
Key: policies Value: [default dev], num_uses: 5, ttl: 767h59m49s
Key Value
— —–
accessor mfvaVMFgOcXHIeqlRasroSOn
creation_time 1604610457
creation_ttl 768h
- A . vault token create -policy=dev -use-limit=5
- B . vault token create -policy=dev -ttl=768h
- C . vault token create -policy=dev -policy=default -ttl=768h
- D . vault token create -policy=dev
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
A: Matches dev policy and num_uses=5. TTL is system default (768h). Correct.
B: Missing num_uses. Incorrect.
C: Adds default policy explicitly, not needed as it’s implicit. Incorrect.
D: Missing num_uses. Incorrect.
Overall Explanation from Vault Docs:
“vault token create with -policy and -use-limit sets specific attributes… default policy is included implicitly.”
Reference: https://developer.hashicorp.com/vault/docs/commands/token/create#command-options
A
Explanation:
Comprehensive and Detailed in Depth
A: Matches dev policy and num_uses=5. TTL is system default (768h). Correct.
B: Missing num_uses. Incorrect.
C: Adds default policy explicitly, not needed as it’s implicit. Incorrect.
D: Missing num_uses. Incorrect.
Overall Explanation from Vault Docs:
“vault token create with -policy and -use-limit sets specific attributes… default policy is included implicitly.”
Reference: https://developer.hashicorp.com/vault/docs/commands/token/create#command-options
Question #254
When an auth method is disabled all users authenticated via that method lose access.
- A . True
- B . False
Correct Answer: A
A
Explanation:
The statement is true. When an auth method is disabled, all users authenticated via that method lose access. This is because the tokens issued by the auth method are automatically revoked when the auth method is disabled. This prevents the users from performing any operation in Vault using the revoked tokens. To regain access, the users have to authenticate again using a different auth method that is enabled and has the appropriate policies attached.
Reference: Auth Methods | Vault | HashiCorp Developer, auth disable – Command | Vault | HashiCorp Developer
A
Explanation:
The statement is true. When an auth method is disabled, all users authenticated via that method lose access. This is because the tokens issued by the auth method are automatically revoked when the auth method is disabled. This prevents the users from performing any operation in Vault using the revoked tokens. To regain access, the users have to authenticate again using a different auth method that is enabled and has the appropriate policies attached.
Reference: Auth Methods | Vault | HashiCorp Developer, auth disable – Command | Vault | HashiCorp Developer
Question #255
Thomas has authenticated to Vault using the API and has received the following response.
What data must Thomas parse from the response in order to continue making requests to Vault? text
CollapseWrapCopy
{
"request_id": "65897160-fd8b-1f87-c24e-fdba14c9728e",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": null,
"wrap_info": null,
"warnings": null,
"auth": {
"client_token": "hvss.lzrmRe5Y3LMcDRmOttEjWoagd92fD29fxakwej_38djs",
"accessor": "EMX0nv4nr0Y1wXoaN7i0WDW1",
"policies": ["bryan", "default"],
"token_policies": ["bryan", "default"],
"metadata": {"username": "bryan"},
"lease_duration": 2764800,
"renewable": true,
"entity_id": "40e203e8-818e-b6ad-4cb3-0befdbf9b598",
"token_type": "service",
"orphan": true
}
}
- A . accessor
- B . request_id
- C . client_token
- D . entity_id
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
To continue API requests:
C. client_token: "When you authenticate to Vault using the API, the response will include the
client_token, which is required for subsequent responses." This token, found at .auth.client_token,
must be included in the X-Vault-Token header.
Incorrect Options:
C
Explanation:
Comprehensive and Detailed In-Depth
To continue API requests:
C. client_token: "When you authenticate to Vault using the API, the response will include the
client_token, which is required for subsequent responses." This token, found at .auth.client_token,
must be included in the X-Vault-Token header.
Incorrect Options:
Question #256
True or False? The following policy permits a user to read secrets contained in the path
secrets/cloud/apps/jenkins?
text
CollapseWrapCopy
path "secrets/cloud/apps/jenkins/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
The policy’s path syntax determines access:
B. False: "This policy will NOT permit access to secrets stored under secrets/cloud/apps/jenkins." The
wildcard * applies to paths after jenkins/, e.g., secrets/cloud/apps/jenkins/config, but not the exact
path secrets/cloud/apps/jenkins. "Notice that in the policy, the wildcard (*) is AFTER the path
jenkins, and not AT the jenkins path."
Incorrect Option:
B
Explanation:
Comprehensive and Detailed In-Depth
The policy’s path syntax determines access:
B. False: "This policy will NOT permit access to secrets stored under secrets/cloud/apps/jenkins." The
wildcard * applies to paths after jenkins/, e.g., secrets/cloud/apps/jenkins/config, but not the exact
path secrets/cloud/apps/jenkins. "Notice that in the policy, the wildcard (*) is AFTER the path
jenkins, and not AT the jenkins path."
Incorrect Option:
Question #257
Select the two default policies created in Vault. (Select two)
- A . root
- B . user
- C . admin
- D . default
- E . base
- F . vault
Correct Answer: A, D
A, D
Explanation:
Comprehensive and Detailed in Depth
Vault creates two default policies upon initialization: root and default. The HashiCorp Vault documentation states: "Vault creates two default policies, root and default. The root policy cannot be deleted or modified. The default policy is attached to all tokens, by default, however, this action can be modified if needed." The root policy grants unrestricted access for administrative tasks, while the default policy provides basic permissions for all tokens unless overridden.
Policies like user, admin, base, and vault are not default; they must be explicitly created by users if
needed. Thus, A (root) and D (default) are the correct selections.
Reference: HashiCorp Vault Documentation – Policies: Built-in Policies
A, D
Explanation:
Comprehensive and Detailed in Depth
Vault creates two default policies upon initialization: root and default. The HashiCorp Vault documentation states: "Vault creates two default policies, root and default. The root policy cannot be deleted or modified. The default policy is attached to all tokens, by default, however, this action can be modified if needed." The root policy grants unrestricted access for administrative tasks, while the default policy provides basic permissions for all tokens unless overridden.
Policies like user, admin, base, and vault are not default; they must be explicitly created by users if
needed. Thus, A (root) and D (default) are the correct selections.
Reference: HashiCorp Vault Documentation – Policies: Built-in Policies
Question #258
True or False? A token can be renewed up until the max TTL, even if the TTL has been reached.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
This statement is false. In HashiCorp Vault, a token’s ability to be renewed is governed by its TTL (Time To Live) and max TTL (Maximum Time To Live). The TTL represents the current validity period of the token, while the max TTL is the absolute upper limit beyond which the token cannot be extended.
Token Renewal Mechanics: A token can be renewed only if it has not yet expired (i.e., its TTL has not reached zero). Renewal extends the TTL, but this extension cannot exceed the max TTL configured for the token. The documentation clarifies: "A token can be renewed up until the max TTL as long as the token has not expired. If the token expires (hitting the TTL), the token is revoked and is no longer valid." Once the TTL reaches zero, Vault automatically revokes the token, rendering it unusable and ineligible for renewal.
Why False?: The phrase "even if the TTL has been reached" implies that renewal is possible after expiration, which contradicts Vault’s behavior. After the TTL expires, there is no active token to renew because it has been revoked. Renewal must occur within the active TTL window, and the total lifetime (including renewals) cannot exceed the max TTL.
Practical Implication: This ensures that tokens have a finite lifecycle, enhancing security by preventing indefinite use of compromised credentials. For example, a token with a TTL of 1 hour and a max TTL of 24 hours can be renewed multiple times within that 24-hour period, but only if renewed before the 1-hour TTL expires each time.
Reference: https://developer.hashicorp.com/vault/docs/concepts/tokens#token-time-to-live-periodic-tokens-and-explicit-max-ttls
B
Explanation:
Comprehensive and Detailed In-Depth
This statement is false. In HashiCorp Vault, a token’s ability to be renewed is governed by its TTL (Time To Live) and max TTL (Maximum Time To Live). The TTL represents the current validity period of the token, while the max TTL is the absolute upper limit beyond which the token cannot be extended.
Token Renewal Mechanics: A token can be renewed only if it has not yet expired (i.e., its TTL has not reached zero). Renewal extends the TTL, but this extension cannot exceed the max TTL configured for the token. The documentation clarifies: "A token can be renewed up until the max TTL as long as the token has not expired. If the token expires (hitting the TTL), the token is revoked and is no longer valid." Once the TTL reaches zero, Vault automatically revokes the token, rendering it unusable and ineligible for renewal.
Why False?: The phrase "even if the TTL has been reached" implies that renewal is possible after expiration, which contradicts Vault’s behavior. After the TTL expires, there is no active token to renew because it has been revoked. Renewal must occur within the active TTL window, and the total lifetime (including renewals) cannot exceed the max TTL.
Practical Implication: This ensures that tokens have a finite lifecycle, enhancing security by preventing indefinite use of compromised credentials. For example, a token with a TTL of 1 hour and a max TTL of 24 hours can be renewed multiple times within that 24-hour period, but only if renewed before the 1-hour TTL expires each time.
Reference: https://developer.hashicorp.com/vault/docs/concepts/tokens#token-time-to-live-periodic-tokens-and-explicit-max-ttls
Question #259
After setting up a new HashiCorp Vault server with the default configurations, which method can be used to unseal Vault?
- A . Log on to each Vault node and provide the root token
- B . Running vault operator init to regenerate unseal keys and automatically unseal the Vault
- C . Submit a threshold of unseal keys to reconstruct the root key
- D . Restart the Vault service, which will automatically unseal it
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
Unsealing a new Vault:
C. Correct: "When a Vault server is started, it starts in a sealed state. Unsealing is the process of obtaining the plaintext root key necessary to read the decryption key to decrypt the data."
Incorrect Options:
A, B, D: Misrepresent unsealing process.
Reference: https://developer.hashicorp.com/vault/docs/concepts/seal
C
Explanation:
Comprehensive and Detailed In-Depth
Unsealing a new Vault:
C. Correct: "When a Vault server is started, it starts in a sealed state. Unsealing is the process of obtaining the plaintext root key necessary to read the decryption key to decrypt the data."
Incorrect Options:
A, B, D: Misrepresent unsealing process.
Reference: https://developer.hashicorp.com/vault/docs/concepts/seal
Question #260
True or False? To prepare for day-to-day operations, the root token should be safely saved outside of Vault in order to administer Vault.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
The statement is False. Saving the root token outside of Vault for day-to-day operations is not a recommended practice and contradicts Vault’s security principles. The HashiCorp Vault documentation explicitly states: "For day-to-day operations, the root token should be revoked after configuring other auth methods, which admins and Vault clients will use." This is because the root token has unrestricted access to all Vault operations, posing a significant security risk if stored externally and used routinely. Instead, Vault encourages the use of less-privileged tokens or alternative authentication methods post-initialization.
The documentation further elaborates under the "Root Tokens" section: "Root tokens are tokens with an infinite TTL that have the ‘root’ policy attached to them. Because of their power, it is strongly recommended that they be used only as necessary and then immediately revoked when no longer needed." Storing the root token outside Vault increases the risk of compromise, and Vault’s design assumes it is used sparingly―typically only during initial setup―and then replaced with more secure, limited-privilege mechanisms. Thus, the correct operational approach is to revoke the root token after setup, not save it externally, making B (False) the correct answer.
Reference: HashiCorp Vault Documentation – Tokens: Root Tokens
B
Explanation:
Comprehensive and Detailed in Depth
The statement is False. Saving the root token outside of Vault for day-to-day operations is not a recommended practice and contradicts Vault’s security principles. The HashiCorp Vault documentation explicitly states: "For day-to-day operations, the root token should be revoked after configuring other auth methods, which admins and Vault clients will use." This is because the root token has unrestricted access to all Vault operations, posing a significant security risk if stored externally and used routinely. Instead, Vault encourages the use of less-privileged tokens or alternative authentication methods post-initialization.
The documentation further elaborates under the "Root Tokens" section: "Root tokens are tokens with an infinite TTL that have the ‘root’ policy attached to them. Because of their power, it is strongly recommended that they be used only as necessary and then immediately revoked when no longer needed." Storing the root token outside Vault increases the risk of compromise, and Vault’s design assumes it is used sparingly―typically only during initial setup―and then replaced with more secure, limited-privilege mechanisms. Thus, the correct operational approach is to revoke the root token after setup, not save it externally, making B (False) the correct answer.
Reference: HashiCorp Vault Documentation – Tokens: Root Tokens