HashiCorp HCVA0-003 Practice Exams
Last updated on Oct 22,2026- Exam Code: HCVA0-003
- Exam Name: HashiCorp Certified: Vault Associate (003)Exam
- Certification Provider: HashiCorp
- Latest update: Oct 22,2026
Question #71
True or False? Once the minimum decryption version is set on an encryption key, older versions of the key are removed from Vault and are no longer available for decryption operations.
- A . True
- B . False
Correct Answer: B
B
Explanation:
Comprehensive and Detailed in Depth
The statement is False. Setting the minimum decryption version does not remove older key versions. The HashiCorp Vault documentation states: "Key versions that are earlier than a key’s specified min_decryption_version get archived, and the rest of the key versions belong to the working set. In an emergency, the min_decryption_version can be moved back to allow for legitimate decryption." Older versions remain available for decryption if needed.
The docs add: "Archiving a key version does not delete it; it simply marks it as outside the active
working set, but Vault retains it for potential use." Thus, older versions are not removed, making B
correct.
Reference: HashiCorp Vault Documentation – Transit Secrets Engine: Working Set Management
B
Explanation:
Comprehensive and Detailed in Depth
The statement is False. Setting the minimum decryption version does not remove older key versions. The HashiCorp Vault documentation states: "Key versions that are earlier than a key’s specified min_decryption_version get archived, and the rest of the key versions belong to the working set. In an emergency, the min_decryption_version can be moved back to allow for legitimate decryption." Older versions remain available for decryption if needed.
The docs add: "Archiving a key version does not delete it; it simply marks it as outside the active
working set, but Vault retains it for potential use." Thus, older versions are not removed, making B
correct.
Reference: HashiCorp Vault Documentation – Transit Secrets Engine: Working Set Management
Question #72
An organization wants to authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret. The only authentication method which they can use in this case is AWS.
- A . True
- B . False
Correct Answer: B
B
Explanation:
The statement is false. An organization can authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret using more than one authentication method. The AWS auth method is one of the options, but not the only one. The AWS auth method supports two types of authentication: ec2 and iam. The ec2 type uses the signed EC2 instance identity document to authenticate the EC2 instance. The iam type uses the AWS Signature v4 algorithm to sign a request to the sts:GetCallerIdentity API and authenticate the IAM principal. However, the organization can also use other auth methods that are compatible with EC2 instances, such as AppRole, JWT/OIDC, or Kubernetes. These methods require the EC2 instance to have some sort of identity material, such as a role ID, a secret ID, a JWT token, or a service account token, that can be used to authenticate to Vault. The identity material can be provisioned to the EC2 instance using various mechanisms, such as user data, metadata service, or cloud-init scripts. The choice of the auth method depends on the use case, the security requirements, and the trade-offs between convenience and control.
Reference: AWS – Auth Methods | Vault | HashiCorp Developer, AppRole – Auth Methods | Vault | HashiCorp Developer, JWT/OIDC – Auth Methods | Vault | HashiCorp Developer, Kubernetes – Auth Methods | Vault | HashiCorp Developer
B
Explanation:
The statement is false. An organization can authenticate an AWS EC2 virtual machine with Vault to access a dynamic database secret using more than one authentication method. The AWS auth method is one of the options, but not the only one. The AWS auth method supports two types of authentication: ec2 and iam. The ec2 type uses the signed EC2 instance identity document to authenticate the EC2 instance. The iam type uses the AWS Signature v4 algorithm to sign a request to the sts:GetCallerIdentity API and authenticate the IAM principal. However, the organization can also use other auth methods that are compatible with EC2 instances, such as AppRole, JWT/OIDC, or Kubernetes. These methods require the EC2 instance to have some sort of identity material, such as a role ID, a secret ID, a JWT token, or a service account token, that can be used to authenticate to Vault. The identity material can be provisioned to the EC2 instance using various mechanisms, such as user data, metadata service, or cloud-init scripts. The choice of the auth method depends on the use case, the security requirements, and the trade-offs between convenience and control.
Reference: AWS – Auth Methods | Vault | HashiCorp Developer, AppRole – Auth Methods | Vault | HashiCorp Developer, JWT/OIDC – Auth Methods | Vault | HashiCorp Developer, Kubernetes – Auth Methods | Vault | HashiCorp Developer
Question #73
When unsealing Vault, each Shamir unseal key should be entered:
- A . Sequentially from one system that all of the administrators are in front of
- B . By different administrators each connecting from different computers
- C . While encrypted with each administrators PGP key
- D . At the command line in one single command
Correct Answer: B
B
Explanation:
When unsealing Vault, each Shamir unseal key should be entered by different administrators each connecting from different computers. This is because the Shamir unseal keys are split into shares that are distributed to trusted operators, and no single operator should have access to more than one share. This way, the unseal process requires the cooperation of a quorum of key holders, and enhances the security and availability of Vault. The unseal keys can be entered via multiple mechanisms from multiple client machines, and the process is stateful. The order of the keys does not matter, as long as the threshold number of keys is reached. The unseal keys should not be entered at the command line in one single command, as this would expose them to the history and compromise the security. The unseal keys should not be encrypted with each administrator’s PGP key, as this would prevent Vault from decrypting them and reconstructing the master key.
Reference: https://developer.hashicorp.com/vault/docs/concepts/seal3, https://developer.hashicorp.com/vault/docs/commands/operator/unseal
B
Explanation:
When unsealing Vault, each Shamir unseal key should be entered by different administrators each connecting from different computers. This is because the Shamir unseal keys are split into shares that are distributed to trusted operators, and no single operator should have access to more than one share. This way, the unseal process requires the cooperation of a quorum of key holders, and enhances the security and availability of Vault. The unseal keys can be entered via multiple mechanisms from multiple client machines, and the process is stateful. The order of the keys does not matter, as long as the threshold number of keys is reached. The unseal keys should not be entered at the command line in one single command, as this would expose them to the history and compromise the security. The unseal keys should not be encrypted with each administrator’s PGP key, as this would prevent Vault from decrypting them and reconstructing the master key.
Reference: https://developer.hashicorp.com/vault/docs/concepts/seal3, https://developer.hashicorp.com/vault/docs/commands/operator/unseal
Question #74
A web application uses Vault’s transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit which of the following statements are true? Choose two correct answers.
- A . You can rotate the encryption key so that the attacker won’t be able to decrypt the data
- B . The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted
- C . The Vault administrator would need to seal the Vault server immediately
- D . Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)
Correct Answer: BD
BD
Explanation:
A web application that uses Vault’s transit secrets engine to encrypt data in-transit can benefit from the following security features:
Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit). This means that the attacker would need to obtain the encryption key from Vault in order to decrypt the data, which is protected by Vault’s authentication and authorization mechanisms. The transit secrets engine does not store the data sent to it, so the attacker cannot access the data from Vault either.
The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted. This means that the web application can periodically change the encryption key used to encrypt the data, and set a minimum decryption version for the key, which prevents older versions of the key from being used to decrypt the data. This way, even if the attacker somehow obtained an old version of the key, they would not be able to decrypt the data that was encrypted with a newer version of the key.
The other statements are not true, because:
You cannot rotate the encryption key so that the attacker won’t be able to decrypt the data. Rotating the key alone does not prevent the attacker from decrypting the data, as they may still have access to the old version of the key that was used to encrypt the data. You need to also move the min_decryption_version forward to invalidate the old version of the key.
The Vault administrator would not need to seal the Vault server immediately. Sealing the Vault server would make it inaccessible to both the attacker and the legitimate users, and would require unsealing it with the unseal keys or the recovery keys. Sealing the Vault server is a last resort option in case of a severe compromise or emergency, and is not necessary in this scenario, as the attacker does not have access to the encryption key or the data in Vault.
Reference: Transit – Secrets Engines | Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp Developer
BD
Explanation:
A web application that uses Vault’s transit secrets engine to encrypt data in-transit can benefit from the following security features:
Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit). This means that the attacker would need to obtain the encryption key from Vault in order to decrypt the data, which is protected by Vault’s authentication and authorization mechanisms. The transit secrets engine does not store the data sent to it, so the attacker cannot access the data from Vault either.
The keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted. This means that the web application can periodically change the encryption key used to encrypt the data, and set a minimum decryption version for the key, which prevents older versions of the key from being used to decrypt the data. This way, even if the attacker somehow obtained an old version of the key, they would not be able to decrypt the data that was encrypted with a newer version of the key.
The other statements are not true, because:
You cannot rotate the encryption key so that the attacker won’t be able to decrypt the data. Rotating the key alone does not prevent the attacker from decrypting the data, as they may still have access to the old version of the key that was used to encrypt the data. You need to also move the min_decryption_version forward to invalidate the old version of the key.
The Vault administrator would not need to seal the Vault server immediately. Sealing the Vault server would make it inaccessible to both the attacker and the legitimate users, and would require unsealing it with the unseal keys or the recovery keys. Sealing the Vault server is a last resort option in case of a severe compromise or emergency, and is not necessary in this scenario, as the attacker does not have access to the encryption key or the data in Vault.
Reference: Transit – Secrets Engines | Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp Developer
Question #75
What is the Vault CLI command to query information about the token the client is currently using?
- A . vault lookup token
- B . vault token lookup
- C . vault lookup self
- D . vault self-lookup
Correct Answer: B
B
Explanation:
The Vault CLI command to query information about the token the client is currently using is vault token lookup. This command displays information about the token or accessor provided as an argument, or the locally authenticated token if no argument is given. The information includes the token ID, accessor, policies, TTL, creation time, and metadata. This command can be useful for debugging and auditing purposes, as well as for renewing or revoking tokens.
Reference: token lookup – Command | Vault | HashiCorp Developer, Tokens | Vault | HashiCorp Developer
B
Explanation:
The Vault CLI command to query information about the token the client is currently using is vault token lookup. This command displays information about the token or accessor provided as an argument, or the locally authenticated token if no argument is given. The information includes the token ID, accessor, policies, TTL, creation time, and metadata. This command can be useful for debugging and auditing purposes, as well as for renewing or revoking tokens.
Reference: token lookup – Command | Vault | HashiCorp Developer, Tokens | Vault | HashiCorp Developer
Question #76
What of the following features are true about batch tokens in Vault? (Select two)
- A . Batch tokens are not persisted (written) to storage
- B . Batch tokens can be renewed
- C . Batch tokens are valid across all clusters when using Vault Enterprise replication
- D . Batch tokens can create child tokens
Correct Answer: A, C
A, C
Explanation:
Comprehensive and Detailed In-Depth
Batch tokens are lightweight tokens in Vault, designed for high-performance use cases.
A: They are not persisted to storage, reducing backend load, as confirmed by the batch token tutorial.
C: In Vault Enterprise with DR Replication, batch tokens are replicated and remain valid across clusters when the secondary is promoted, per replication docs.
B: Batch tokens cannot be renewed; they have a fixed TTL, per the service vs. batch token comparison.
D: They cannot create child tokens, lacking features of service tokens.
Reference: Batch Tokens Tutorial Tokens Docs
A, C
Explanation:
Comprehensive and Detailed In-Depth
Batch tokens are lightweight tokens in Vault, designed for high-performance use cases.
A: They are not persisted to storage, reducing backend load, as confirmed by the batch token tutorial.
C: In Vault Enterprise with DR Replication, batch tokens are replicated and remain valid across clusters when the secondary is promoted, per replication docs.
B: Batch tokens cannot be renewed; they have a fixed TTL, per the service vs. batch token comparison.
D: They cannot create child tokens, lacking features of service tokens.
Reference: Batch Tokens Tutorial Tokens Docs
Question #77
Which scenario most strongly indicates a need to run a self-hosted Vault cluster instead of using HCP Vault Dedicated?
- A . Your organization doesn’t require any custom security policies or intricate network topologies
- B . You want to offload all operational tasks and rely on HashiCorp to manage patching, upgrades, and infrastructure
- C . You prefer a fully managed environment that is readily scalable with minimal configuration overhead
- D . You must maintain specific compliance or custom integration requirements that demand full control over the Vault environment, including infrastructure provisioning and plugin development
Correct Answer: D
D
Explanation:
Comprehensive and Detailed in Depth
HCP Vault Dedicated is a managed service, while self-hosted Vault (Community or Enterprise) requires user management. Let’s evaluate:
A: Simple needs favor HCP Vault’s managed simplicity. Incorrect.
B: Offloading tasks aligns with HCP Vault, not self-hosted. Incorrect.
C: Managed scalability suits HCP Vault. Incorrect.
D: Compliance, custom integrations, and plugin development need full control, only possible with self-hosted Vault. Correct.
Detailed Mechanics:
Self-hosted Vault allows custom plugins, FIPS 140-2 compliance, and specific network configs (e.g., air-gapped setups), unavailable in HCP Vault Dedicated due to its standardized, managed nature. Overall Explanation from Vault Docs:
“Self-managed Vault supports custom requirements… HCP Vault Dedicated offloads operations but limits control.”
Reference: https://developer.hashicorp.com/vault/tutorials/get-started/available-editions
D
Explanation:
Comprehensive and Detailed in Depth
HCP Vault Dedicated is a managed service, while self-hosted Vault (Community or Enterprise) requires user management. Let’s evaluate:
A: Simple needs favor HCP Vault’s managed simplicity. Incorrect.
B: Offloading tasks aligns with HCP Vault, not self-hosted. Incorrect.
C: Managed scalability suits HCP Vault. Incorrect.
D: Compliance, custom integrations, and plugin development need full control, only possible with self-hosted Vault. Correct.
Detailed Mechanics:
Self-hosted Vault allows custom plugins, FIPS 140-2 compliance, and specific network configs (e.g., air-gapped setups), unavailable in HCP Vault Dedicated due to its standardized, managed nature. Overall Explanation from Vault Docs:
“Self-managed Vault supports custom requirements… HCP Vault Dedicated offloads operations but limits control.”
Reference: https://developer.hashicorp.com/vault/tutorials/get-started/available-editions
Question #78
All Vault instances, or clusters, include two built-in policies that are created automatically. Choose the two policies below and the correct information regarding each policy. (Select two)
- A . The root policy is created automatically. This policy provides superuser privileges and cannot be deleted
- B . The admin policy is created automatically. It provides administrative permissions but can be deleted if needed
- C . The default policy is created automatically. This policy can be modified but not deleted
- D . The default policy is created automatically. This policy cannot be modified but it can be deleted
Correct Answer: A, C
A, C
Explanation:
Comprehensive and Detailed In-Depth
Vault automatically creates two built-in policies: root and default.
A: The root policy is created at initialization, granting superuser privileges (full access to all paths and operations). It’s attached to root tokens and cannot be deleted or modified, per the policies documentation.
C: The default policy is also created automatically, providing basic permissions (e.g., token management). It’s attached to all non-root tokens by default, can be modified, but cannot be deleted, as stated in the docs.
B: No admin policy is automatically created; administrative policies must be defined manually.
D: The default policy can be modified, contradicting this option.
Reference: Built-in Policies
A, C
Explanation:
Comprehensive and Detailed In-Depth
Vault automatically creates two built-in policies: root and default.
A: The root policy is created at initialization, granting superuser privileges (full access to all paths and operations). It’s attached to root tokens and cannot be deleted or modified, per the policies documentation.
C: The default policy is also created automatically, providing basic permissions (e.g., token management). It’s attached to all non-root tokens by default, can be modified, but cannot be deleted, as stated in the docs.
B: No admin policy is automatically created; administrative policies must be defined manually.
D: The default policy can be modified, contradicting this option.
Reference: Built-in Policies
Question #79
What are orphan tokens?
- A . Orphan tokens are tokens with a use limit so you can set the number of uses when you create them
- B . Orphan tokens are not children of their parent; therefore, orphan tokens do not expire when their parent does
- C . Orphan tokens are tokens with no policies attached
- D . Orphan tokens do not expire when their own max TTL is reached
Correct Answer: D
D
Explanation:
Orphan tokens are tokens that are root of their own token tree. This means that they do not have any parent token associated with them, and they do not expire when their parent token expires. Orphan tokens are useful for scenarios where you need a short-lived and independent token, such as for testing or debugging purposes. Orphan tokens can also be used to create temporary access tokens for applications or services that need to communicate with Vault without using a long-lived root token.
Reference: Tokens | Vault | HashiCorp Developer, Vault cli: how to create orphan token with role – HashiCorp Discuss
D
Explanation:
Orphan tokens are tokens that are root of their own token tree. This means that they do not have any parent token associated with them, and they do not expire when their parent token expires. Orphan tokens are useful for scenarios where you need a short-lived and independent token, such as for testing or debugging purposes. Orphan tokens can also be used to create temporary access tokens for applications or services that need to communicate with Vault without using a long-lived root token.
Reference: Tokens | Vault | HashiCorp Developer, Vault cli: how to create orphan token with role – HashiCorp Discuss
Question #80
A new application is being provisioned in your environment. The application requires the generation of dynamic credentials against the Oracle database in order to read reporting data.
Which is the best auth method to use to permit the application to authenticate to Vault?
- A . OIDC
- B . GitHub
- C . Userpass
- D . AppRole
Correct Answer: D
D
Explanation:
Comprehensive and Detailed In-Depth
AppRole is optimal for machine authentication. The Vault documentation states:
"AppRole is an auth method that is better suited for machine-to-machine authentication. The AppRole auth method allows machines or applications to authenticate with Vault using a role-specific secret ID and role ID."
― Vault Auth: AppRole
D: Correct. Ideal for dynamic Oracle credentials:
"AppRole is the best auth method to use in this scenario because it allows machines or applications to authenticate with Vault."
― Vault Auth: AppRole
A, B, C: Human-oriented, not machine-suited.
Reference: Vault Auth: AppRole
D
Explanation:
Comprehensive and Detailed In-Depth
AppRole is optimal for machine authentication. The Vault documentation states:
"AppRole is an auth method that is better suited for machine-to-machine authentication. The AppRole auth method allows machines or applications to authenticate with Vault using a role-specific secret ID and role ID."
― Vault Auth: AppRole
D: Correct. Ideal for dynamic Oracle credentials:
"AppRole is the best auth method to use in this scenario because it allows machines or applications to authenticate with Vault."
― Vault Auth: AppRole
A, B, C: Human-oriented, not machine-suited.
Reference: Vault Auth: AppRole