Home
HashiCorp
Vault-Associate Exam Questions

HashiCorp Vault-Associate Practice Exam Questions & Answers

7 Free Questions Last reviewed October 29, 2026 Prepared & Reviewed by the ValidExamDumps Editorial Team

Exam details Free questions Study guide FAQ

57 Practice Questions (Our Bank)

90 minutes Exam Duration

70% Passing Score

USD 70 Official Exam Fee

Exam Facts

HashiCorp Vault-Associate Exam Details

Key details for this exam, checked against the published exam outline

Exam Code: Vault-Associate
Full Name: HashiCorp Certified: Vault Associate (002)
Issuing Body: HashiCorp
Question Format (Our Bank): Multiple Choice, Hotspot
Delivery: Online proctored or at testing facilities
Eligibility: Six months of practical Vault experience recommended, though not strictly required
Full Question Set: 57 questions Get All Questions

Practice Questions

Free Vault-Associate Practice Questions

Each question shows the correct answer and an explanation of why it is right

ValidExamDumps Editorial Team Every question and its answer is checked by our Vault-Associate exam preparation team, who also write the explanation shown with each one. How we research and review these pages

Question 1 Domain 2 2 Create Vault policies

What environment variable overrides the CLI's default Vault server address?

AVAULT_ADDR

BVAULT_HTTP_ADORESS

CVAULT_ADDRESS

DVAULT _HTTPS_ ADDRESS

Correct Answer B

Explanation

The environment variable VAULT_ADDR overrides the CLI's default Vault server address. The VAULT_ADDR environment variable specifies the address of the Vault server that is used to communicate with Vault from other applications or processes. By setting this variable, you can avoid hard-coding the Vault server address in your code or configuration files, and you can also use different addresses for different environments or scenarios. For example, you can use a local development server for testing purposes, and a production server for deploying your application.Reference:Commands (CLI) | Vault | HashiCorp Developer,Vault Agent - secrets as environment variables | Vault | HashiCorp Developer

Question 2 Domain 2 2 Create Vault policies

Which of the following describes usage of an identity group?

ALimit the policies that would otherwise apply to an entity in the group

BWhen they want to revoke the credentials for a whole set of entities simultaneously

CAudit token usage

DConsistently apply the same set of policies to a collection of entities

Correct Answer D

Explanation

An identity group is a collection of entities that share some common attributes. An identity group can have one or more policies attached to it, which are inherited by all the members of the group. An identity group can also have subgroups, which can further refine the policies and attributes for a subset of entities.

One of the use cases of an identity group is to consistently apply the same set of policies to a collection of entities. For example, an organization may have different teams or departments, such as engineering, sales, or marketing. Each team may have its own identity group, with policies that grant access to the secrets and resources that are relevant to their work. By creating an identity group for each team, the organization can ensure that the entities belonging to each team have the same level of access and permissions, regardless of which authentication method they use to log in to Vault.Reference:Identity: entities and groups | Vault | HashiCorp Developer,vault_identity_group | Resources | hashicorp/vault | Terraform | Terraform Registry

Question 3 Domain 6 6 Utilize Vault CLI

Which of the following cannot define the maximum time-to-live (TTL) for a token?

ABy the authentication method t natively provide a method of expiring credentials

BBy the client system f credentials leaking

CBy the mount endpoint configuration very password used

DA parent token TTL e password rotation tools and practices

ESystem max TTL

Correct Answer B

Explanation

The maximum time-to-live (TTL) for a token is defined by the lowest value among the following factors:

The authentication method that issued the token. Each auth method can have a default and a maximum TTL for the tokens it generates. These values can be configured by the auth method's mount options or by the auth method's specific endpoints.

The mount endpoint configuration that the token is accessing. Each secrets engine can have a default and a maximum TTL for the leases it grants. These values can be configured by the secrets engine's mount options or by the secrets engine's specific endpoints.

A parent token TTL. If a token is created by another token, it inherits the remaining TTL of its parent token, unless the parent token has an infinite TTL (such as the root token). A child token cannot outlive its parent token.

System max TTL. This is a global limit for all tokens and leases in Vault. It can be configured by the system backend's max_lease_ttl option.

The client system that uses the token cannot define the maximum TTL for the token, as this is determined by Vault's configuration and policies. The client system can only request a specific TTL for the token, but this request is subject to the limits imposed by the factors above.

Get the complete Vault-Associate question set $20~~$40~~

Get Full Access

Question 4 Domain 2 2 Create Vault policies

Which of the following statements describe the CLI command below?

S vault login -method-1dap username-mitche11h

AGenerates a token which is response wrapped

BYou will be prompted to enter the password

CBy default the generated token is valid for 24 hours

DFails because the password is not provided

Correct Answer A

Explanation

The CLI command vault login -method ldap username=mitchellh generates a token that is response wrapped. This means that the token contains a base64-encoded response wrapper, which is a JSON object that contains information about the token, such as its policies, metadata, and expiration time. The response wrapper is used to verify the authenticity and integrity of the token, and to prevent replay attacks. The response wrapper also allows Vault to automatically renew the token when it expires, or to revoke it if it is compromised. The -method ldap option specifies that the authentication method is LDAP, which requires a username and password to be provided. The username mitchellh is an example of an LDAP user name, and the password will be hidden when entered.Reference:Vault CLI Reference | Vault | HashiCorp Developer,Vault CLI Reference | Vault | HashiCorp Developer

Question 5 Domain 10 10 Explain encryption as a service

To give a role the ability to display or output all of the end points under the /secrets/apps/* end point it would need to have which capability set?

Aupdate

Bread

Csudo

Dlist

ENone of the above

Correct Answer C

Explanation

To give a role the ability to display or output all of the end points under the /secrets/apps/* end point, it would need to have the list capability set. The list capability allows a role to perform any operation on any path in Vault, including reading, writing, deleting, and listing. The list capability is required for roles that need to access sensitive data or perform administrative tasks in Vault. The other capabilities are not relevant for this scenario, as they only allow specific operations on specific paths or secrets engines.Reference:Policies | Vault | HashiCorp Developer,token capabilities - Command | Vault | HashiCorp Developer

Question 6 Domain 6 6 Utilize Vault CLI

Vault supports which type of configuration for source limited token?

ACloud-bound tokens

BDomain-bound tokens

CCIDR-bound tokens

DCertificate-bound tokens

Correct Answer C

Explanation

Vault supports CIDR-bound tokens, which are tokens that can only be used from a specific set of IP addresses or network ranges. This is a way to limit the scope and exposure of a token in case it is compromised or leaked. CIDR-bound tokens can be created by specifying the bound_cidr_list parameter when creating or updating a token role, or by using the -bound-cidr option when creating a token using the vault token create command. CIDR-bound tokens can also be created by some auth methods, such as AWS or Kubernetes, that can automatically bind the tokens to the source IP or network of the client.Reference:Token - Auth Methods | Vault | HashiCorp Developer,vault token create - Command | Vault | HashiCorp Developer

Question 7 Domain 9 9 Explain Vault architecture

What command creates a secret with the key "my-password" and the value "53cr3t" at path "my-secrets" within the KV secrets engine mounted at "secret"?

Avault kv put secret/my-secrets/my-password 53cr3t

Bvault kv write secret/my-secrets/my-password 53cr3t

Cvault kv write 53cr3t my-secrets/my-password

Dvault kv put secret/my-secrets y-password-53cr3t

Correct Answer A

Explanation

The vault kv put command writes the data to the given path in the K/V secrets engine. The command requires the mount path of the K/V secrets engine, the secret path, and the key-value pair to store. The mount path can be specified with the -mount flag or as part of the secret path. The key-value pair can be given as an argument or read from a file or stdin. The correct syntax for the command is:

vault kv put -mount=secret my-secrets/my-password 53cr3t

vault kv put secret/my-secrets my-password=53cr3t

The other options are incorrect because they use the deprecated vault kv write command, or they have the wrong order or format of the arguments.Reference: https://developer.hashicorp.com/vault/docs/commands/kv/put3, https://developer.hashicorp.com/vault/docs/commands/kv4

Full Access

Get the complete Vault-Associate question set

Starting from 50% OFF

$20 ~~$40~~

57 questions covering all exam domains
Correct answers with explanations, like the free questions above
PDF and online practice test
90 days of free updates

Get Full Access

One-time paymentInstant download

Study Guide

What the HashiCorp Vault-Associate Exam Covers

Exam domains verified against the Official HashiCorp Vault-Associate exam guide, last checked October 2026.

Domain 1 1 Compare authentication methods

Understand the range of authentication methods Vault supports and make selections that match your use case. Learn to differentiate between human-centric methods like LDAP and GitHub, and machine-oriented methods like AWS IAM and Kubernetes auth. The right auth method determines how identities establish trust with Vault.

Domain 2 2 Create Vault policies

Master Vault's policy language to grant and restrict access to secrets and API endpoints. Policies define what authenticated users can do. Build policies that express your organization's access rules using path-based restrictions and fine-grained capability controls.

Sample questions from this domain above Q1 Q2 Q4

Domain 3 3 Assess Vault tokens

Tokens are Vault's core authentication mechanism. Learn the token lifecycle from generation through expiration and revocation. Understand the differences between service tokens for long-lived automation and batch tokens for one-time operations. Master concepts like accessors, time-to-live, and orphaned tokens.

Domain 4 4 Manage Vault leases

Secrets returned by Vault come with a lease that defines how long they are valid. You must be able to renew leases to extend validity and revoke them when they are no longer needed. Lease IDs uniquely identify each secret instance and track its lifecycle.

Domain 5 5 Compare and configure Vault secrets engines

Secrets engines are Vault's plugins for managing different types of secrets. Learn to choose between dynamic secrets that Vault generates on-the-fly and static secrets stored directly. The transit engine provides encryption as a service. Each engine solves different secrets management problems.

Domain 6 6 Utilize Vault CLI

The command-line interface is how operators interact with Vault in scripts and automation. You must be able to authenticate, configure auth methods and policies, enable secret engines, retrieve secrets, and set environment variables. The CLI mirrors the capabilities of the Vault API.

Sample questions from this domain above Q3 Q6

Domain 7 7 Utilize Vault UI

The web interface provides a graphical way to interact with Vault for authentication, configuration, and secret access. The UI is useful for exploration and administration tasks. You need to be comfortable performing the same operations you can do from the CLI, but through the browser interface.

Domain 8 8 Be aware of the Vault API

Vault's REST API is the foundation that both the CLI and UI use. You should understand how to authenticate and retrieve secrets using HTTP clients like Curl. The API is language-agnostic and powers integrations with other tools.

Domain 9 9 Explain Vault architecture

Understand how Vault works internally from encryption at rest to the high-availability cluster topology. Learn about storage backends, the Vault agent for client-side integration, secrets caching, seal and unseal mechanisms, identity and group management, Shamir secret sharing, replication, response wrapping, and why short-lived dynamic secrets are valuable.

Sample question from this domain above Q7

Domain 10 10 Explain encryption as a service

The transit secret engine provides encryption, decryption, and key rotation without your applications ever seeing the key material. You configure the transit engine, then use Vault to encrypt data at rest and decrypt it on retrieval. This pattern lets your applications stay encryption-aware without managing keys directly.

Sample question from this domain above Q5

FAQ

Vault-Associate Exam FAQ

Common questions about the exam itself

How much hands-on Vault experience do I need before taking the Vault Associate exam?

HashiCorp recommends six months of practical experience using Vault in real environments, though you can prepare by working through the exam objectives in a personal demo setup. Most candidates find the exam more approachable with some operational exposure to Vault, whether in development, testing, or production.

How long is the Vault Associate exam and how many questions does it have?

You have 90 minutes to answer 57 questions in a multiple-choice and multiple-select format. This timing works out to about one and a half minutes per question on average, so you should be familiar with the exam topics well enough to answer without spending excessive time on any single question.

What is the passing score for Vault Associate?

You need to score 70 percent or higher to pass. This means you must answer roughly 40 out of 57 questions correctly, leaving some room for questions you find difficult.

Is the Vault Associate certification hard to pass and why?

The exam tests both conceptual knowledge and practical familiarity with Vault's CLI, UI, and API. Candidates struggle most with the authentication methods domain, where the differences between LDAP, GitHub, AppRole, AWS IAM, and Kubernetes auth matter deeply for choosing the right approach. Success comes from both reading documentation and having worked with these methods in practice.

How long does it typically take to prepare for the Vault Associate exam?

If you already have six months of Vault experience, you might need only two to four weeks of focused study to review objectives you haven't encountered. Without prior experience, most people need two to three months to build enough familiarity with Vault's core concepts and hands-on operations.

Can I take the Vault Associate exam online or do I have to go to a test center?

You can take it either way. HashiCorp offers both online proctored exams and exams at physical testing facilities. The online option is more convenient if you have a quiet space and stable internet connection, though you must allow proctoring software to monitor your screen and webcam.

How long is the Vault Associate certification valid after I pass?

Your certification is valid for three years from the date you pass. After three years, you must either pass the Vault Associate exam again or pass the more advanced Vault Operations Professional exam to renew your credential.

What job roles are a good fit for the Vault Associate certification?

The certification targets cloud engineers who specialize in security, development, or operations. It is useful for DevOps engineers, site reliability engineers, security engineers, and infrastructure developers who need to deploy and manage Vault in their organizations.

What comes after Vault Associate in the HashiCorp certification path?

The next step is the Vault Operations Professional exam, which is a hands-on lab-based test for engineers with advanced production experience. You must hold the Vault Associate certification to be well-prepared for the professional exam, which covers deployment, configuration, monitoring, and troubleshooting.

Are there any prerequisites or prior certifications I need before taking Vault Associate?

There are no required prerequisites. However, you should understand basic cloud infrastructure concepts and have familiarity with command-line tools and REST APIs. If you have worked with secrets management, infrastructure automation, or security tooling before, you will find the material more familiar.

Other HashiCorp Exams

Free practice questions for more HashiCorp certification exams

HCVA0-003 Practice Questions HashiCorp Certified: Vault Associate (003) Exam Terraform-Associate-004 Practice Questions HashiCorp Certified: Terraform Associate (004)

All HashiCorp exams

Vault-Associate Full question set $20 ~~$40~~ 50% OFF

Get Full Access