HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 21,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 21,2026
Question #31
You are configuring your application to retrieve a new PKI certificate upon provisioning. The Vault admins have given you an AppRole role-id and secret-id to inject into the CI/CD pipeline job that provisions your app. The application uses the credentials to successfully authenticate to Vault using the API.
Which of the following is true about the step next required after authenticating to Vault?
- A . The client token needs to be retrieved from the API response before requesting the new PKI certificate
- B . The initial API response should include the new PKI certificate and no further action is required
- C . The app still needs to use the role-id and secret-id to request the new PKI certificate via API
- D . Now that the app is authenticated, it can simply make another API request for the PKI certificate
Correct Answer: A
A
Explanation:
Comprehensive and Detailed In-Depth
After authenticating with AppRole using the role-id and secret-id via the API (e.g., POST /v1/auth/approle/login), Vault returns a response containing a client_token. This token must be extracted for subsequent requests, such as retrieving a PKI certificate. The Vault documentation states:
"When you use the Vault API to authenticate, the Vault API response will include a client_token that is tied to a specific policy. Once you receive that response, it is up to the user (or application) to parse that response and retrieve the token. Once the token is retrieved, a second API request needs to be sent to Vault to request the new PKI certificate."
― Vault API: AppRole
A: Correct. The client_token from the response (e.g., under .auth.client_token) is required for the next request (e.g., POST /v1/pki/issue/<role>):
"The client token is necessary to make subsequent requests to Vault, including requesting the new PKI certificate."
― Vault API Documentation
B: Incorrect. Authentication doesn’t return a PKI certificate; a separate request is needed.
C: Incorrect. The role-id and secret-id are for authentication, not certificate retrieval: "Authentication and interaction with a secrets engine are separate actions."
― Vault API: AppRole
D: Partially true but vague; it omits the critical step of retrieving the token first.
Reference: Vault API: AppRole
Vault PKI Secrets Engine
A
Explanation:
Comprehensive and Detailed In-Depth
After authenticating with AppRole using the role-id and secret-id via the API (e.g., POST /v1/auth/approle/login), Vault returns a response containing a client_token. This token must be extracted for subsequent requests, such as retrieving a PKI certificate. The Vault documentation states:
"When you use the Vault API to authenticate, the Vault API response will include a client_token that is tied to a specific policy. Once you receive that response, it is up to the user (or application) to parse that response and retrieve the token. Once the token is retrieved, a second API request needs to be sent to Vault to request the new PKI certificate."
― Vault API: AppRole
A: Correct. The client_token from the response (e.g., under .auth.client_token) is required for the next request (e.g., POST /v1/pki/issue/<role>):
"The client token is necessary to make subsequent requests to Vault, including requesting the new PKI certificate."
― Vault API Documentation
B: Incorrect. Authentication doesn’t return a PKI certificate; a separate request is needed.
C: Incorrect. The role-id and secret-id are for authentication, not certificate retrieval: "Authentication and interaction with a secrets engine are separate actions."
― Vault API: AppRole
D: Partially true but vague; it omits the critical step of retrieving the token first.
Reference: Vault API: AppRole
Vault PKI Secrets Engine
Question #32
Which of the following Vault policies will allow a Vault client to read a secret stored at secrets/applications/app01/api_key?
- A . path "secrets/applications/" { capabilities = ["read"] allowed_parameters = { "certificate" = [] } }
- B . path "secrets/*" { capabilities = ["list"] }
- C . path "secrets/applications/+/api_*" { capabilities = ["read"] }
- D . path "secrets/applications/app01/api_key/*" { capabilities = ["update", "list", "read"] }
Correct Answer: C
C
Explanation:
Comprehensive and Detailed in Depth
This question requires identifying a policy that permits reading the secret at secrets/applications/app01/api_key.
Vault policies use paths and capabilities to control access. Let’s evaluate:
A: path "secrets/applications/" { capabilities = ["read"] allowed_parameters = { "certificate" = [] } } This policy allows reading at secrets/applications/, but not deeper paths like secrets/applications/app01/api_key. The allowed_parameters restriction is irrelevant for reading
secrets. Incorrect.
B: path "secrets/*" { capabilities = ["list"] }
The list capability allows listing secrets under secrets/, but not reading their contents. Reading requires the read capability. Incorrect.
C: path "secrets/applications/+/api_*" { capabilities = ["read"] }
The + wildcard matches one segment (e.g., app01), and api_* matches api_key. This policy grants read access to secrets/applications/app01/api_key. Correct.
D: path "secrets/applications/app01/api_key/*" { capabilities = ["update", "list", "read"] }
This policy applies to subpaths under api_key/, not the exact path api_key. It includes read, but the path mismatch makes it incorrect for this specific secret. Overall Explanation from Vault Docs:
“Wildcards (*, +) allow flexible path matching… read capability is required to retrieve secret data.” Option C uses globbing to precisely target the required path.
Reference: https://developer.hashicorp.com/vault/tutorials/policies/policies
C
Explanation:
Comprehensive and Detailed in Depth
This question requires identifying a policy that permits reading the secret at secrets/applications/app01/api_key.
Vault policies use paths and capabilities to control access. Let’s evaluate:
A: path "secrets/applications/" { capabilities = ["read"] allowed_parameters = { "certificate" = [] } } This policy allows reading at secrets/applications/, but not deeper paths like secrets/applications/app01/api_key. The allowed_parameters restriction is irrelevant for reading
secrets. Incorrect.
B: path "secrets/*" { capabilities = ["list"] }
The list capability allows listing secrets under secrets/, but not reading their contents. Reading requires the read capability. Incorrect.
C: path "secrets/applications/+/api_*" { capabilities = ["read"] }
The + wildcard matches one segment (e.g., app01), and api_* matches api_key. This policy grants read access to secrets/applications/app01/api_key. Correct.
D: path "secrets/applications/app01/api_key/*" { capabilities = ["update", "list", "read"] }
This policy applies to subpaths under api_key/, not the exact path api_key. It includes read, but the path mismatch makes it incorrect for this specific secret. Overall Explanation from Vault Docs:
“Wildcards (*, +) allow flexible path matching… read capability is required to retrieve secret data.” Option C uses globbing to precisely target the required path.
Reference: https://developer.hashicorp.com/vault/tutorials/policies/policies
Question #33
Jarrad is an AWS engineer and has provisioned a new EC2 instance running MySQL since his application requires a specific MySQL version. He wants to integrate Vault into his workflow but is new to Vault.
What secrets engine should Jarrad use to integrate this new database running in AWS?
- A . azure
- B . database
- C . kv
- D . aws
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
For integrating a MySQL database on an EC2 instance with Vault, the database secrets engine is the appropriate choice:
B. database: "The ‘database’ secrets engine in Vault is specifically designed for integrating with databases like MySQL." It generates dynamic credentials, manages rotations, and supports MySQL plugins, ideal for Jarrad’s use case. "To manage the database resource, the database secrets engine should be used, specifically with the MySQL plugin." Incorrect Options:
B
Explanation:
Comprehensive and Detailed In-Depth
For integrating a MySQL database on an EC2 instance with Vault, the database secrets engine is the appropriate choice:
B. database: "The ‘database’ secrets engine in Vault is specifically designed for integrating with databases like MySQL." It generates dynamic credentials, manages rotations, and supports MySQL plugins, ideal for Jarrad’s use case. "To manage the database resource, the database secrets engine should be used, specifically with the MySQL plugin." Incorrect Options:
Question #34
When Vault is sealed, which are the only two operations available to a Vault administrator? (Select two)
- A . View the status of Vault
- B . Configure policies
- C . View data stored in the key/value store
- D . Rotate the encryption key
- E . Unseal Vault
- F . Author security policies
Correct Answer: A, E
A, E
Explanation:
Comprehensive and Detailed in Depth
When Vault is sealed, its functionality is severely restricted to protect encrypted data. The HashiCorp Vault documentation states: "While Vault is sealed, the only two options available are viewing the vault status (vault status) and unsealing Vault (vault operator unseal). All the other actions require Vault to be unsealed and the user to be authenticated." This limitation ensures that no operations can access or modify data until the Vault is unsealed, enhancing security.
The documentation under "Shamir Seals" further elaborates: "When Vault is sealed, it knows where its encrypted data is stored but cannot decrypt it because the master key is not in memory. The only available operations are checking the seal status and initiating the unseal process." Thus:
A (View the status of Vault): The vault status command works when sealed, providing details like seal state.
E (Unseal Vault): The vault operator unseal command allows administrators to begin unsealing.
Options like configure policies (B), view data in the key/value store (C), rotate the encryption key (D), and author security policies (F) require an unsealed Vault and authentication, making A and E the correct selections.
Reference: HashiCorp Vault Documentation – Seal Concepts: Shamir Seals
HashiCorp Vault Documentation – Vault Status Command
A, E
Explanation:
Comprehensive and Detailed in Depth
When Vault is sealed, its functionality is severely restricted to protect encrypted data. The HashiCorp Vault documentation states: "While Vault is sealed, the only two options available are viewing the vault status (vault status) and unsealing Vault (vault operator unseal). All the other actions require Vault to be unsealed and the user to be authenticated." This limitation ensures that no operations can access or modify data until the Vault is unsealed, enhancing security.
The documentation under "Shamir Seals" further elaborates: "When Vault is sealed, it knows where its encrypted data is stored but cannot decrypt it because the master key is not in memory. The only available operations are checking the seal status and initiating the unseal process." Thus:
A (View the status of Vault): The vault status command works when sealed, providing details like seal state.
E (Unseal Vault): The vault operator unseal command allows administrators to begin unsealing.
Options like configure policies (B), view data in the key/value store (C), rotate the encryption key (D), and author security policies (F) require an unsealed Vault and authentication, making A and E the correct selections.
Reference: HashiCorp Vault Documentation – Seal Concepts: Shamir Seals
HashiCorp Vault Documentation – Vault Status Command
Question #35
How long does the Transit secrets engine store the resulting ciphertext by default?
- A . 24 hours
- B . 30 days
- C . 32 days
- D . Transit does not store data
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
The Transit secrets engine in Vault is designed for encryption-as-a-service, not data storage.
Let’s evaluate:
Option A: 24 hours
Transit doesn’t store ciphertext, so no TTL applies. Incorrect.
Option B: 30 days
No storage means no 30-day retention. Incorrect.
Option C: 32 days
This aligns with token TTLs, not Transit behavior. Incorrect.
Option D: Transit does not store data
Transit encrypts data and returns the ciphertext to the caller without persisting it in Vault. Correct.
Detailed Mechanics:
When you run vault write transit/encrypt/mykey plaintext=<base64-data>, Vault uses the named key (e.g., mykey) to encrypt the input and returns a response like vault:v1:<ciphertext>. This ciphertext is not stored in Vault’s storage backend (e.g., Consul, Raft); it’s the client’s responsibility to save it (e.g., in a database). This stateless design keeps Vault lightweight and secure, avoiding data retention risks. Real-World Example:
Encrypt a credit card: vault write transit/encrypt/creditcard plaintext=$(base64 <<< "1234-5678-9012-3456"). Response: ciphertext=vault:v1:<data>. You store this in your app’s database; Vault retains nothing.
Overall Explanation from Vault Docs:
“Vault does NOT store any data encrypted via the transit/encrypt endpoint… The ciphertext is returned to the caller for storage elsewhere.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/transit
D
Explanation:
Comprehensive and Detailed in Depth
The Transit secrets engine in Vault is designed for encryption-as-a-service, not data storage.
Let’s evaluate:
Option A: 24 hours
Transit doesn’t store ciphertext, so no TTL applies. Incorrect.
Option B: 30 days
No storage means no 30-day retention. Incorrect.
Option C: 32 days
This aligns with token TTLs, not Transit behavior. Incorrect.
Option D: Transit does not store data
Transit encrypts data and returns the ciphertext to the caller without persisting it in Vault. Correct.
Detailed Mechanics:
When you run vault write transit/encrypt/mykey plaintext=<base64-data>, Vault uses the named key (e.g., mykey) to encrypt the input and returns a response like vault:v1:<ciphertext>. This ciphertext is not stored in Vault’s storage backend (e.g., Consul, Raft); it’s the client’s responsibility to save it (e.g., in a database). This stateless design keeps Vault lightweight and secure, avoiding data retention risks. Real-World Example:
Encrypt a credit card: vault write transit/encrypt/creditcard plaintext=$(base64 <<< "1234-5678-9012-3456"). Response: ciphertext=vault:v1:<data>. You store this in your app’s database; Vault retains nothing.
Overall Explanation from Vault Docs:
“Vault does NOT store any data encrypted via the transit/encrypt endpoint… The ciphertext is returned to the caller for storage elsewhere.”
Reference: https://developer.hashicorp.com/vault/docs/secrets/transit
Question #36
Hanna is working with Vault and has been assigned a namespace called integration, where she stores all her secrets. Hanna configured her application to use the following API request, but the request is failing.
What changes below will help Hanna correctly retrieve the secret? (Select two)
$ curl
–header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag"
–request GET
https://vault.example.com:8200/v1/secret/data/my-secret
- A . $ curl –header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" –request GETintegration https://vault.example.com:8200/v1/secret/data/my-secret
- B . $ curl –header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" –request GET –namespace "integration" https://vault.example.com:8200/v1/secret/data/my-secret
- C . $ curl –header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" –request GET https://vault.example.com:8200/v1/integration/secret/data/my-secret
- D . $ curl –header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" –header "X-Vault-Namespace:integration" –request GET https://vault.example.com:8200/v1/secret/data/my-secret
Correct Answer: CD
CD
Explanation:
Comprehensive and Detailed In-Depth
Vault namespaces require specifying the integration namespace to access secrets:
C. Path-Based: "Modifying the API request URL to include the namespace ‘integration’ before the path to the secret ensures that Hanna is accessing the secret from the correct namespace." The URL https://vault.example.com:8200/v1/integration/secret/data/my-secret correctly prepends the namespace.
D. Header-Based: "Adding the ‘X-Vault-Namespace:integration’ header specifies the namespace where the secrets are stored." This header method keeps the base path unchanged while targeting the integration namespace.
Incorrect Options:
A: Incorrect syntax; integration is malformed. "The API request URL structure is incorrect."
B: –namespace is not a curl flag. "The ‘–namespace’ flag is not a valid option."
"To invoke an API on a specific namespace, you can pass the target namespace in the X-Vault-Namespace header or make the namespace as a part of the API endpoint."
Reference: https://developer.hashicorp.com/vault/docs/enterprise/namespaces
CD
Explanation:
Comprehensive and Detailed In-Depth
Vault namespaces require specifying the integration namespace to access secrets:
C. Path-Based: "Modifying the API request URL to include the namespace ‘integration’ before the path to the secret ensures that Hanna is accessing the secret from the correct namespace." The URL https://vault.example.com:8200/v1/integration/secret/data/my-secret correctly prepends the namespace.
D. Header-Based: "Adding the ‘X-Vault-Namespace:integration’ header specifies the namespace where the secrets are stored." This header method keeps the base path unchanged while targeting the integration namespace.
Incorrect Options:
A: Incorrect syntax; integration is malformed. "The API request URL structure is incorrect."
B: –namespace is not a curl flag. "The ‘–namespace’ flag is not a valid option."
"To invoke an API on a specific namespace, you can pass the target namespace in the X-Vault-Namespace header or make the namespace as a part of the API endpoint."
Reference: https://developer.hashicorp.com/vault/docs/enterprise/namespaces
Question #37
You have deployed an application that needs to encrypt data before writing to a database.
What secrets engine should you use?
- A . Transit
- B . SSH
- C . PKI
- D . TOTP
Correct Answer: A
A
Explanation:
Comprehensive and Detailed in Depth
For encrypting data before writing it to a database, the Transit secrets engine is the appropriate choice. The HashiCorp Vault documentation describes it as handling "cryptographic functions on data in-transit" and notes that it "can be viewed as ‘cryptography as a service’ or ‘encryption as a service.’" It is designed to encrypt data without storing it, making it ideal for applications needing to secure data before storage in an external database. The primary use case is "to encrypt data from applications while still storing that encrypted data in some primary data store."
The SSH secrets engine manages SSH keys and authentication, not data encryption. The PKI secrets engine handles certificate management, not general data encryption. The TOTP secrets engine generates time-based one-time passwords, unrelated to data encryption. Thus, Transit is the correct choice.
Reference: HashiCorp Vault Documentation – Transit Secrets Engine
A
Explanation:
Comprehensive and Detailed in Depth
For encrypting data before writing it to a database, the Transit secrets engine is the appropriate choice. The HashiCorp Vault documentation describes it as handling "cryptographic functions on data in-transit" and notes that it "can be viewed as ‘cryptography as a service’ or ‘encryption as a service.’" It is designed to encrypt data without storing it, making it ideal for applications needing to secure data before storage in an external database. The primary use case is "to encrypt data from applications while still storing that encrypted data in some primary data store."
The SSH secrets engine manages SSH keys and authentication, not data encryption. The PKI secrets engine handles certificate management, not general data encryption. The TOTP secrets engine generates time-based one-time passwords, unrelated to data encryption. Thus, Transit is the correct choice.
Reference: HashiCorp Vault Documentation – Transit Secrets Engine
Question #38
You have enabled the Transit secrets engine and want to start encrypting data to store in Azure Blob storage.
What is the next step that needs to be completed before you can encrypt data? (Select two)
- A . Export the encryption key and upload it to the application server
- B . Enable the Transit secrets engine API
- C . Create an encryption key for the application to use
- D . Write a policy that permits the application to use the encryption key
Correct Answer: C, D
C, D
Explanation:
Comprehensive and Detailed In-Depth
The Transit secrets engine in Vault is designed for encryption as a service, allowing applications to encrypt data without managing keys locally. After enabling the engine, two critical steps are required before encryption can begin: creating an encryption key and defining a policy to allow its use.
Option C: You must create an encryption key using a command like vault write -f
transit/keys/<key_name>. This key is stored in Vault and used for encryption/decryption operations.
Without it, no encryption can occur, as the Transit engine relies on named keys to perform cryptographic operations.
Option D: A policy must be written to grant the application permissions to use the key, such as path "transit/encrypt/<key_name>" { capabilities = ["update"] } and path "transit/decrypt/<key_name>" { capabilities = ["update"] }. Vault’s access control ensures that only authorized entities can perform encryption, making this step essential.
Option A (exporting the key) contradicts Vault’s security model, as keys should remain in Vault, not be exported to application servers.
Option B (enabling the Transit API) is unnecessary, as enabling the engine automatically exposes its API endpoints. The official Transit documentation confirms that key creation and policy configuration are the next steps post-enablement.
Reference: Transit Secrets Engine Tutorial
Transit Secrets Engine Docs
C, D
Explanation:
Comprehensive and Detailed In-Depth
The Transit secrets engine in Vault is designed for encryption as a service, allowing applications to encrypt data without managing keys locally. After enabling the engine, two critical steps are required before encryption can begin: creating an encryption key and defining a policy to allow its use.
Option C: You must create an encryption key using a command like vault write -f
transit/keys/<key_name>. This key is stored in Vault and used for encryption/decryption operations.
Without it, no encryption can occur, as the Transit engine relies on named keys to perform cryptographic operations.
Option D: A policy must be written to grant the application permissions to use the key, such as path "transit/encrypt/<key_name>" { capabilities = ["update"] } and path "transit/decrypt/<key_name>" { capabilities = ["update"] }. Vault’s access control ensures that only authorized entities can perform encryption, making this step essential.
Option A (exporting the key) contradicts Vault’s security model, as keys should remain in Vault, not be exported to application servers.
Option B (enabling the Transit API) is unnecessary, as enabling the engine automatically exposes its API endpoints. The official Transit documentation confirms that key creation and policy configuration are the next steps post-enablement.
Reference: Transit Secrets Engine Tutorial
Transit Secrets Engine Docs
Question #39
What command can be used to revoke all leases associated with a database role named prod-mysql?
- A . vault lease revoke database/role/prod-mysql
- B . vault lease revoke -prefix database/creds/prod-mysql
- C . vault revoke database/role/prod-mysql
- D . vault lease revoke database/creds/prod-mysql
Correct Answer: B
B
Explanation:
Comprehensive and Detailed In-Depth
To revoke all leases tied to a specific database role like prod-mysql, the correct command leverages the -prefix flag:
B. vault lease revoke -prefix database/creds/prod-mysql: This command revokes all leases with the prefix database/creds/prod-mysql, which corresponds to credentials generated by the prod-mysql role in the database secrets engine. "To immediately revoke all leases associated with a specific role, the user can run the command vault lease revoke -prefix database/creds/prod-mysql," ensuring targeted revocation without affecting other roles.
Incorrect Options:
B
Explanation:
Comprehensive and Detailed In-Depth
To revoke all leases tied to a specific database role like prod-mysql, the correct command leverages the -prefix flag:
B. vault lease revoke -prefix database/creds/prod-mysql: This command revokes all leases with the prefix database/creds/prod-mysql, which corresponds to credentials generated by the prod-mysql role in the database secrets engine. "To immediately revoke all leases associated with a specific role, the user can run the command vault lease revoke -prefix database/creds/prod-mysql," ensuring targeted revocation without affecting other roles.
Incorrect Options:
Question #40
Which of the following best describes a token accessor?
- A . A value that describes which clients have access to the attached token
- B . Describes the value associated with the token’s TTL
- C . A token used for clients to access Vault secrets engines
- D . A value that acts as a reference to a token which can be used to perform limited actions against the token
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
A token accessor is a unique identifier linked to a token, used for management purposes. The HashiCorp Vault documentation states: "A token accessor is created alongside of each token, and the accessor can be used to perform limited actions against the token, including looking up the token’s properties, renewing the token, and even revoking the token." It acts as a reference, not the token itself, enabling specific operations without exposing the token’s value.
The docs further clarify: "Token accessors provide a way to interact with a token without needing the token itself, enhancing security by limiting direct exposure." Option A misattributes access control, B ties it to TTL (unrelated), and C confuses it with the token. Thus, D accurately describes its role.
Reference: HashiCorp Vault Documentation – Tokens: Token Accessors
D
Explanation:
Comprehensive and Detailed in Depth
A token accessor is a unique identifier linked to a token, used for management purposes. The HashiCorp Vault documentation states: "A token accessor is created alongside of each token, and the accessor can be used to perform limited actions against the token, including looking up the token’s properties, renewing the token, and even revoking the token." It acts as a reference, not the token itself, enabling specific operations without exposing the token’s value.
The docs further clarify: "Token accessors provide a way to interact with a token without needing the token itself, enhancing security by limiting direct exposure." Option A misattributes access control, B ties it to TTL (unrelated), and C confuses it with the token. Thus, D accurately describes its role.
Reference: HashiCorp Vault Documentation – Tokens: Token Accessors