HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 21,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 21,2026
Question #21
A MySQL server has been deployed on Google Cloud Platform (GCP) to support a legacy application. You want to generate dynamic credentials against this MySQL server rather than use static credentials.
What Vault secrets engine would you use to accomplish this?
- A . The GCP secrets engine
- B . The Identity secrets engine
- C . The database secrets engine
- D . The Cubbyhole secrets engine
Correct Answer: C
C
Explanation:
Comprehensive and Detailed In-Depth
The Database secrets engine generates dynamic credentials for databases like MySQL, regardless of the platform. The Vault documentation states:
"Regardless of where a database server is deployed, you can use the database secrets engine to generate dynamic credentials against it. It doesn’t matter what platform that server is deployed on, you would still use the database secrets engine. The database secrets engine generates database credentials dynamically based on configured roles."
― Vault Secrets: Databases
C: Correct. The database engine supports MySQL:
"Supported databases include PostgreSQL, MySQL, MongoDB, and more."
― Vault Secrets: Databases
A: GCP engine is for GCP services, not databases.
B: Identity engine manages identities, not credentials.
D: Cubbyhole is for temporary storage, not dynamic credentials.
Reference: Vault Secrets: Databases
C
Explanation:
Comprehensive and Detailed In-Depth
The Database secrets engine generates dynamic credentials for databases like MySQL, regardless of the platform. The Vault documentation states:
"Regardless of where a database server is deployed, you can use the database secrets engine to generate dynamic credentials against it. It doesn’t matter what platform that server is deployed on, you would still use the database secrets engine. The database secrets engine generates database credentials dynamically based on configured roles."
― Vault Secrets: Databases
C: Correct. The database engine supports MySQL:
"Supported databases include PostgreSQL, MySQL, MongoDB, and more."
― Vault Secrets: Databases
A: GCP engine is for GCP services, not databases.
B: Identity engine manages identities, not credentials.
D: Cubbyhole is for temporary storage, not dynamic credentials.
Reference: Vault Secrets: Databases
Question #22
What can be used to limit the scope of a credential breach?
- A . Storage of secrets in a distributed ledger
- B . Enable audit logging
- C . Use of a short-lived dynamic secrets
- D . Sharing credentials between applications
Correct Answer: C
C
Explanation:
Using a short-lived dynamic secrets can help limit the scope of a credential breach by reducing the exposure time of the secrets. Dynamic secrets are generated on-demand by Vault and automatically revoked when they are no longer needed. This way, the credentials are not stored in plain text or in a static database, and they can be rotated frequently to prevent unauthorized access. Dynamic secrets also provide encryption as a service, which means that they perform cryptographic operations on data in-transit without storing any data. This adds an extra layer of security and reduces the risk of data leakage or tampering.
Reference: Dynamic secrets | Vault | HashiCorp Developer, What are dynamic secrets and why do I need them? – HashiCorp
C
Explanation:
Using a short-lived dynamic secrets can help limit the scope of a credential breach by reducing the exposure time of the secrets. Dynamic secrets are generated on-demand by Vault and automatically revoked when they are no longer needed. This way, the credentials are not stored in plain text or in a static database, and they can be rotated frequently to prevent unauthorized access. Dynamic secrets also provide encryption as a service, which means that they perform cryptographic operations on data in-transit without storing any data. This adds an extra layer of security and reduces the risk of data leakage or tampering.
Reference: Dynamic secrets | Vault | HashiCorp Developer, What are dynamic secrets and why do I need them? – HashiCorp
Question #23
Where does the Vault Agent store its cache?
- A . In a file encrypted using the Vault transit secret engine
- B . In the Vault key/value store
- C . In an unencrypted file
- D . In memory
Correct Answer: D
D
Explanation:
The Vault Agent stores its cache in memory, which means that it does not persist the cached tokens and secrets to disk or any other storage backend. This makes the cache more secure and performant, as it avoids exposing the sensitive data to potential attackers or unauthorized access. However, this also means that the cache is volatile and will be lost if the agent process is terminated or restarted. To mitigate this, the agent can optionally use a persistent cache file to restore the tokens and leases from a previous agent process. The persistent cache file is encrypted using a key derived from the agent’s auto-auth token and a nonce, and it is stored in a user-specified location on disk.
Reference: Caching – Vault Agent | Vault | HashiCorp Developer, Vault Agent Persistent Caching
| Vault | HashiCorp Developer
D
Explanation:
The Vault Agent stores its cache in memory, which means that it does not persist the cached tokens and secrets to disk or any other storage backend. This makes the cache more secure and performant, as it avoids exposing the sensitive data to potential attackers or unauthorized access. However, this also means that the cache is volatile and will be lost if the agent process is terminated or restarted. To mitigate this, the agent can optionally use a persistent cache file to restore the tokens and leases from a previous agent process. The persistent cache file is encrypted using a key derived from the agent’s auto-auth token and a nonce, and it is stored in a user-specified location on disk.
Reference: Caching – Vault Agent | Vault | HashiCorp Developer, Vault Agent Persistent Caching
| Vault | HashiCorp Developer
Question #24
Which auth method is ideal for machine-to-machine authentication?
- A . Okta
- B . UserPass
- C . GitHub
- D . AppRole
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
For machine-to-machine authentication, AppRole is the ideal method. The HashiCorp Vault documentation states: "Although it’s not the only method for applications, the ideal method for machine-to-machine authentication is AppRole. The other options are frequently reserved for human access." AppRole allows machines or services to authenticate using a role ID and secret ID, providing a secure, automated approach without human intervention.
The documentation elaborates: "The AppRole auth method provides a workflow tailored to machine-to-machine authentication. It allows applications to authenticate with Vault-defined roles and retrieve a token." Okta, UserPass, and GitHub are better suited for human users, not automated systems. Thus, D (AppRole) is correct.
Reference: HashiCorp Vault Documentation – AppRole Auth Method
D
Explanation:
Comprehensive and Detailed in Depth
For machine-to-machine authentication, AppRole is the ideal method. The HashiCorp Vault documentation states: "Although it’s not the only method for applications, the ideal method for machine-to-machine authentication is AppRole. The other options are frequently reserved for human access." AppRole allows machines or services to authenticate using a role ID and secret ID, providing a secure, automated approach without human intervention.
The documentation elaborates: "The AppRole auth method provides a workflow tailored to machine-to-machine authentication. It allows applications to authenticate with Vault-defined roles and retrieve a token." Okta, UserPass, and GitHub are better suited for human users, not automated systems. Thus, D (AppRole) is correct.
Reference: HashiCorp Vault Documentation – AppRole Auth Method
Question #25
To protect the sensitive data stored in Vault, what key is used to encrypt the data before it is written to the storage backend?
- A . Recovery key
- B . Encryption key
- C . Unseal key
- D . Root key
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
Vault encrypts all data before writing it to the storage backend using an encryption key within its cryptographic barrier. This key, stored in a keyring, is itself encrypted by the master key (split into unseal keys). The recovery key (A) is for emergency recovery, not data encryption. Unseal keys (C) unlock the master key, not encrypt data directly. The root key (D) isn’t a term used in Vault’s encryption flow; the master key is the closest analog, but it protects the encryption key, not the data itself. The architecture docs clarify the encryption key’s role.
Reference: Vault Architecture
Keyring Details
B
Explanation:
Comprehensive and Detailed In-Depth
Vault encrypts all data before writing it to the storage backend using an encryption key within its cryptographic barrier. This key, stored in a keyring, is itself encrypted by the master key (split into unseal keys). The recovery key (A) is for emergency recovery, not data encryption. Unseal keys (C) unlock the master key, not encrypt data directly. The root key (D) isn’t a term used in Vault’s encryption flow; the master key is the closest analog, but it protects the encryption key, not the data itself. The architecture docs clarify the encryption key’s role.
Reference: Vault Architecture
Keyring Details
Question #26
Suzy is a Vault user that needs to create and replace values at the path secrets/automation/apps/chef. Does the following policy permit her the permissions to do so?
text
CollapseWrapCopy
path "secrets/automation/apps/chef" {
capabilities = ["create", "read", "list"]
}
- A . No, the policy would deny Suzy from performing certain actions
- B . Yes, the policy has appropriate permissions
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
The policy grants specific capabilities, but not all required for Suzy’s needs:
A
Explanation:
Comprehensive and Detailed In-Depth
The policy grants specific capabilities, but not all required for Suzy’s needs:
Question #27
Which two characters can be used when writing a policy to reflect a wildcard or path segment? (Select two)
- A . The ampersand &
- B . The at symbol @
- C . The splat character *
- D . A dollar sign $
- E . The pound symbol #
- F . The plus symbol +
Correct Answer: C, F
C, F
Explanation:
Comprehensive and Detailed in Depth
Vault policies use specific characters for wildcards and path segments. The HashiCorp Vault documentation states: "The plus sign (+) can be used to denote a path segment and can be used in the middle of a path. The splat (*) can be used as a wildcard but can only be used at the very end of a path." These are the only characters designated for such purposes in policy syntax.
The docs add: "For example, secret/data/* matches all paths under secret/data/, while secret/+/foo matches a single segment like secret/bar/foo." &, @, $, and # have no special meaning in Vault policies. Thus, C (*) and F (+) are correct.
Reference: HashiCorp Vault Documentation – Policies: Policy Syntax
C, F
Explanation:
Comprehensive and Detailed in Depth
Vault policies use specific characters for wildcards and path segments. The HashiCorp Vault documentation states: "The plus sign (+) can be used to denote a path segment and can be used in the middle of a path. The splat (*) can be used as a wildcard but can only be used at the very end of a path." These are the only characters designated for such purposes in policy syntax.
The docs add: "For example, secret/data/* matches all paths under secret/data/, while secret/+/foo matches a single segment like secret/bar/foo." &, @, $, and # have no special meaning in Vault policies. Thus, C (*) and F (+) are correct.
Reference: HashiCorp Vault Documentation – Policies: Policy Syntax
Question #28
Which statement best explains the role and usage of storage backends in HashiCorp Vault?
- A . They store Vault’s persistent data, affecting the scalability and performance of managing Vault.
- B . They handle the encryption of all secrets so that Vault remains completely stateless.
- C . They store only ephemeral tokens, ensuring no persistent data is ever saved.
- D . They store only unseal keys, while all secret data remains in Vault’s memory.
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
Storage backends in Vault are responsible for storing persistent data, impacting its operation. The HashiCorp Vault documentation states: "The storage stanza configures the storage backend, which represents the location for the durable storage of Vault’s information. Each backend has pros, cons, advantages, and trade-offs. For example, some backends support high availability while others provide a more robust backup and restoration process." This includes secrets, policies, and audit logs, affecting scalability and performance.
The docs add: "Vault uses a storage backend to persist its encrypted data, configuration, and metadata." Option B is incorrect as encryption is handled by Vault, not the backend. C and D are wrong―backends store all persistent data, not just tokens or unseal keys. Thus, A is correct.
Reference: HashiCorp Vault Documentation – Storage Backends
A
Explanation:
Comprehensive and Detailed in Depth
Storage backends in Vault are responsible for storing persistent data, impacting its operation. The HashiCorp Vault documentation states: "The storage stanza configures the storage backend, which represents the location for the durable storage of Vault’s information. Each backend has pros, cons, advantages, and trade-offs. For example, some backends support high availability while others provide a more robust backup and restoration process." This includes secrets, policies, and audit logs, affecting scalability and performance.
The docs add: "Vault uses a storage backend to persist its encrypted data, configuration, and metadata." Option B is incorrect as encryption is handled by Vault, not the backend. C and D are wrong―backends store all persistent data, not just tokens or unseal keys. Thus, A is correct.
Reference: HashiCorp Vault Documentation – Storage Backends
Question #29
What are the primary benefits of running Vault in a production deployment over dev server mode (select two)?
- A . Faster deployment
- B . Persistent storage
- C . Ability to enable auth methods
- D . Encryption via TLS
Correct Answer: B, D
B, D
Explanation:
Comprehensive and Detailed in Depth
A: Dev mode is faster to deploy; incorrect.
B: Production uses persistent storage vs. dev’s in-memory. Correct.
C: Auth methods work in both modes. Incorrect.
D: Production enables TLS; dev uses plaintext. Correct.
Overall Explanation from Vault Docs:
“Dev server mode stores data in memory… Production mode supports persistent storage and TLS encryption.”
Reference: https://developer.hashicorp.com/vault/docs/concepts/dev-server
B, D
Explanation:
Comprehensive and Detailed in Depth
A: Dev mode is faster to deploy; incorrect.
B: Production uses persistent storage vs. dev’s in-memory. Correct.
C: Auth methods work in both modes. Incorrect.
D: Production enables TLS; dev uses plaintext. Correct.
Overall Explanation from Vault Docs:
“Dev server mode stores data in memory… Production mode supports persistent storage and TLS encryption.”
Reference: https://developer.hashicorp.com/vault/docs/concepts/dev-server
Question #30
The vault lease renew command increments the lease time from:
- A . The current time
- B . The end of the lease
Correct Answer: A
A
Explanation:
The vault lease renew command increments the lease time from the current time, not the end of the lease. This means that the user can request a specific amount of time they want remaining on the lease, termed the increment. This is not an increment at the end of the current TTL; it is an increment from the current time. For example, vault lease renew -increment=3600 my-lease-id would request that the TTL of the lease be adjusted to 1 hour (3600 seconds) from now. Having the increment be rooted at the current time instead of the end of the lease makes it easy for users to reduce the length of leases if they don’t actually need credentials for the full possible lease period, allowing those credentials to expire sooner and resources to be cleaned up earlier. The requested increment is completely advisory. The backend in charge of the secret can choose to completely ignore it1.
Reference: Lease, Renew, and Revoke | Vault | HashiCorp Developer
A
Explanation:
The vault lease renew command increments the lease time from the current time, not the end of the lease. This means that the user can request a specific amount of time they want remaining on the lease, termed the increment. This is not an increment at the end of the current TTL; it is an increment from the current time. For example, vault lease renew -increment=3600 my-lease-id would request that the TTL of the lease be adjusted to 1 hour (3600 seconds) from now. Having the increment be rooted at the current time instead of the end of the lease makes it easy for users to reduce the length of leases if they don’t actually need credentials for the full possible lease period, allowing those credentials to expire sooner and resources to be cleaned up earlier. The requested increment is completely advisory. The backend in charge of the secret can choose to completely ignore it1.
Reference: Lease, Renew, and Revoke | Vault | HashiCorp Developer