Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Vault is configured with the oidc auth method and you need to log in using the CLI. What command would you use to authenticate so you can make configuration changes to Vault?
Comprehensive and Detailed In-Depth
To authenticate via the OIDC auth method using the CLI, the vault login command with the -method flag is used. The Vault documentation states:
'To authenticate using the CLI, you could use the command vault login and specify the auth method you wish to use by using the -method flag. For example, if you wanted to authenticate using OIDC, you could use vault login -method=oidc [options].'
--- Vault Commands: login
A: vault login -method=oidc username=bryan is correct, specifying the OIDC method and username:
'The correct command to authenticate using the oidc auth method in Vault is vault login -method=oidc username=bryan.'
--- Vault Auth: OIDC
B: vault auth oidc is invalid; auth is not a login command.
C: vault login auth/oidc/users/bryan is incorrect syntax; it mimics an API path, not a CLI command.
D: vault login username=bryan lacks the method specification, defaulting to token auth.
Vault Commands: login
Vault Auth: OIDC
You are using the Vault userpass auth method mounted at auth/userpass. How do you create a new user named "sally" with password "h0wN0wB4r0wnC0w"? This new user will need the power-users policy.
A.
B.
C.
D.
To create a new user named ''sally'' with password ''h0wN0wB4r0wnC0w'' and the power-users policy, you would use the Vault userpass auth method mounted at auth/userpass. You would use the following command: ''vault write auth/userpass/users/sally password=h0wN0wB4r0wnC0w policies=power-users''. This command would create a new user named ''sally'' with the specified password and policy. Reference:
[Userpass Auth Method | Vault | HashiCorp Developer]
[Create Vault policies | Vault | HashiCorp Developer]
Which Vault secret engine may be used to build your own internal certificate authority?
The Vault secret engine that can be used to build your own internal certificate authority is the PKI secret engine. The PKI secret engine generates dynamic X.509 certificates on-demand, without requiring manual processes of generating private keys and CSRs, submitting to a CA, and waiting for verification and signing. The PKI secret engine can act as a root CA or an intermediate CA, and can issue certificates for various purposes, such as TLS, code signing, email encryption, etc. The PKI secret engine can also manage the certificate lifecycle, such as rotation, revocation, renewal, and CRL generation. The PKI secret engine can also integrate with external CAs, such as Venafi or Entrust, to delegate the certificate issuance and management. Reference: PKI - Secrets Engines | Vault | HashiCorp Developer, Build Your Own Certificate Authority (CA) | Vault - HashiCorp Learn
By default, what TCP port does Vault replication use?
Comprehensive and Detailed in Depth Explanatio n:
Vault replication ensures data consistency across clusters, using a specific port:
A: 8200 - Default HTTP API port, not replication.
B: 8300 - Raft protocol port, not replication.
C: 8201 - Default replication port. Correct.
D: 8301 - Serf protocol port, not replication.
Overall Explanation from Vault Docs:
''Replication occurs on TCP port 8201 by default... distinct from the API (8200) and Raft (8300) ports.''
From the options below, select the benefits of using a batch token over a service token (select four).
Comprehensive and Detailed in Depth Explanatio n:
Batch tokens are lightweight alternatives to service tokens, with trade-offs. Let's analyze:
A: Designed for short-lived, high-performance tasks. Correct.
B: Cannot be root tokens; root status is service-token-specific. Incorrect.
C: Orphan batch tokens work in replication. Correct.
D: No accessors; unique to service tokens. Incorrect.
E: Minimal overhead makes them scalable. Correct.
F: No disk storage reduces cost. Correct.
Overall Explanation from Vault Docs:
''Batch tokens are encrypted blobs... lightweight, scalable, no storage cost, ideal for ephemeral workloads.''
285 questions covering all exam domains, starting from $20
Exam domains verified against: Official HashiCorp HCVA0-003 exam guide, last checked September 2026.
Define the purpose of authentication methods for human and machine identity. Choose authentication methods based on use case, explain differences between human and system authentication, and configure methods using the API, CLI, and UI.
Explain the value and syntax of Vault policies including path specifications and capabilities. Choose policies based on requirements and configure them using the UI and CLI.
Choose between service and batch tokens based on use case. Describe root token uses and lifecycle, token accessors, time-to-live impact, orphaned tokens, and how to create tokens based on need.
Sample question from this domain above: Q4
Explain the purpose of a lease ID and describe how to renew and revoke leases. Understand the lifecycle and management of dynamic secrets through the lease system.
Sample question from this domain above: Q2
Choose a secrets engine based on use case and compare dynamic versus static secrets. Describe transit secrets engine, response wrapping, and enable secrets engines using the API, CLI, and UI.
Sample question from this domain above: Q1
Encrypt and decrypt secrets using the transit secrets engine. Rotate encryption keys and understand encryption as a service patterns.
Describe how Vault encrypts data and explain seal and unseal mechanisms. Configure environment variables and understand auto unseal capabilities.
Explain cluster strategy for self-managed and HashiCorp-managed clusters. Understand storage backends, Shamir secret sharing, disaster recovery and performance replication.
Describe the Vault Agent and Vault Secrets Operator for access management. Understand how to deploy and configure these components in your infrastructure.
Common questions about the exam itself
