HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #281
What command would you use to enable the Kubernetes secrets engine at the path of /k8s-cluster?
- A . vault secrets enable -path=k8s-cluster kubernetes
- B . vault kv put k8s-cluster type=kubernetes
- C . vault write sys/mounts/k8s-cluster
- D . vault secrets enable kubernetes -path=k8s-cluster
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
Correct syntax is:
A
Explanation:
Comprehensive and Detailed In-Depth
Correct syntax is:
Question #282
You are using an orchestrator to deploy a new application. Even though the orchestrator creates a new AppRole secret ID, security requires that only the new application has the combination of the role ID and secret ID.
What feature can you use to meet these requirements?
- A . Have the application authenticate with the role ID to retrieve the secret ID
- B . Use response wrapping and provide the application server with the unwrapping token instead
- C . Use a batch token instead of a traditional service token
- D . Secure the communication between the orchestrator and Vault using TLS
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
A: Exposes the secret ID, violating the requirement. Incorrect.
B: Response wrapping delivers the secret ID in a single-use token, ensuring only the application unwraps it. Correct.
C: Batch tokens don’t address secret ID delivery security. Incorrect.
D: TLS secures communication but doesn’t restrict access to the secret ID. Incorrect.
Overall Explanation from Vault Docs:
“Response wrapping… wraps the secret in a single-use token, ensuring only the intended recipient unwraps it.”
Reference: https://developer.hashicorp.com/vault/tutorials/auth-methods/approle
B
Explanation:
Comprehensive and Detailed in Depth
A: Exposes the secret ID, violating the requirement. Incorrect.
B: Response wrapping delivers the secret ID in a single-use token, ensuring only the application unwraps it. Correct.
C: Batch tokens don’t address secret ID delivery security. Incorrect.
D: TLS secures communication but doesn’t restrict access to the secret ID. Incorrect.
Overall Explanation from Vault Docs:
“Response wrapping… wraps the secret in a single-use token, ensuring only the intended recipient unwraps it.”
Reference: https://developer.hashicorp.com/vault/tutorials/auth-methods/approle
Question #283
Vault operators can create two types of groups in Vault.
What are the two types?
- A . External groups
- B . Security groups
- C . Policy groups
- D . Internal groups
Correct Answer: AD
AD
Explanation:
Comprehensive and Detailed In-Depth
In HashiCorp Vault, operators can create two distinct types of groups within the Identity secrets engine: external groups and internal groups. These groups are used to manage and organize users and policies, facilitating access control and permissions management.
External Groups: These groups are designed to integrate with external identity providers or systems, such as LDAP or OIDC (OpenID Connect). External groups allow Vault to map groups from these external systems to Vault policies, enabling seamless access control for users authenticated via external auth methods. They can be created manually or automatically mapped (e.g., from LDAP group memberships to Vault policies). This is particularly useful when managing users who exist outside of Vault’s internal identity store but need access to Vault resources. The documentation states: "External groups are usually associated with an auth method, such as LDAP or OIDC." Internal Groups: These are created and managed directly within Vault’s identity store. Internal groups are used to organize Vault entities (representing users or machines) and assign policies to them manually. They are ideal for scenarios where user management is entirely within Vault’s ecosystem, without reliance on external identity providers. The documentation explains: "Internal groups are created in the identity store and map to other groups or entities."
Incorrect Options:
Security Groups: This term is not used in Vault’s context for group types. While security is a core concern, "security groups" do not represent a specific category of groups in Vault.
Policy Groups: Policies in Vault define permissions, but there is no concept of "policy groups" as a distinct group type. Policies are attached to groups, not grouped themselves in this manner.
The distinction between external and internal groups enhances flexibility in managing authentication and authorization, aligning with Vault’s design to support both internal and federated identity systems.
Reference: https://developer.hashicorp.com/vault/docs/secrets/identity#external-vs-internal-groups
AD
Explanation:
Comprehensive and Detailed In-Depth
In HashiCorp Vault, operators can create two distinct types of groups within the Identity secrets engine: external groups and internal groups. These groups are used to manage and organize users and policies, facilitating access control and permissions management.
External Groups: These groups are designed to integrate with external identity providers or systems, such as LDAP or OIDC (OpenID Connect). External groups allow Vault to map groups from these external systems to Vault policies, enabling seamless access control for users authenticated via external auth methods. They can be created manually or automatically mapped (e.g., from LDAP group memberships to Vault policies). This is particularly useful when managing users who exist outside of Vault’s internal identity store but need access to Vault resources. The documentation states: "External groups are usually associated with an auth method, such as LDAP or OIDC." Internal Groups: These are created and managed directly within Vault’s identity store. Internal groups are used to organize Vault entities (representing users or machines) and assign policies to them manually. They are ideal for scenarios where user management is entirely within Vault’s ecosystem, without reliance on external identity providers. The documentation explains: "Internal groups are created in the identity store and map to other groups or entities."
Incorrect Options:
Security Groups: This term is not used in Vault’s context for group types. While security is a core concern, "security groups" do not represent a specific category of groups in Vault.
Policy Groups: Policies in Vault define permissions, but there is no concept of "policy groups" as a distinct group type. Policies are attached to groups, not grouped themselves in this manner.
The distinction between external and internal groups enhances flexibility in managing authentication and authorization, aligning with Vault’s design to support both internal and federated identity systems.
Reference: https://developer.hashicorp.com/vault/docs/secrets/identity#external-vs-internal-groups