Vault Associate

Last checked October 22, 2026 against the official HashiCorp exam page.

1. Question 1Vault Concepts and Architecture

   Why does Vault use a seal mechanism?

   1. ATo encrypt each secret with a different user's password on every request that Vault receives from clients
   2. BTo lock the Vault user interface whenever no user is signed in, for display purposes only on the screen
   3. CTo prevent the storage backend from being backed up by the operations team as part of routine work
   4. DTo protect the master key that encrypts Vault's data at rest, so the data cannot be read until Vault is unsealed
   Show answer and explanationHide answer

   Correct answer: D

   The seal protects the master key that encrypts data at rest, so storage cannot be read without unsealing. The UI lock, backup prevention and per-user request encryption are not what the seal does.

2. Question 2Policies and Operations

   Which policy capability allows a token to read a secret at a given path?

   1. AThe read capability on that path, granted through an HCL policy attached to the token
   2. BThe sudo capability on the root path, which grants reads on every path in the cluster by default
   3. CThe list capability on the audit path, which allows the token to read the secret values as they are logged
   4. DThe deny capability on the secret path, which grants read access when it is applied together with the root policy
   Show answer and explanationHide answer

   Correct answer: A

   The read capability on the path, granted by an attached HCL policy, allows reading. Sudo, list on audit paths and deny do not grant reads in those ways.

3. Question 3Secrets Engines and Leases

   Which secrets engine generates short-lived database credentials that expire automatically?

   1. AThe database secrets engine, which creates short-lived credentials for the database on request
   2. BThe KV secrets engine, which stores the database password as a static value that never changes over time
   3. CThe transit secrets engine, which encrypts the database rows with a key that is rotated on a monthly schedule
   4. DThe PKI secrets engine, which issues certificates for the database servers used by the application each day
   Show answer and explanationHide answer

   Correct answer: A

   The database secrets engine creates short-lived dynamic credentials. KV stores static values, transit encrypts data and PKI issues certificates.

4. Question 4Authentication and Tokens

   Which auth method suits applications on Kubernetes that need secrets without storing a static credential?

   1. AAn unauthenticated endpoint that returns secrets to any caller on the cluster network without any check
   2. BA shared username and password written into the container image, which every pod uses to sign in
   3. CA root token copied into each pod's configuration file during the deployment of the application
   4. DThe Kubernetes auth method, which validates the pod's service account token with the cluster
   Show answer and explanationHide answer

   Correct answer: D

   The Kubernetes auth method validates the pod's service account token, avoiding static credentials. Shared passwords, root tokens and unauthenticated endpoints are unsafe.

5. Question 5Vault Concepts and Architecture

   Which storage option gives Vault built-in high availability without an external database?

   1. AA spreadsheet stored on each node, which the client synchronises by hand after every change
   2. BA local file on one server, which is shared with the other nodes through a network drive mount
   3. CAn in-memory cache only, which is lost on every restart of the cluster and is not replicated
   4. DIntegrated Raft storage, which replicates Vault data across the nodes of the cluster
   Show answer and explanationHide answer

   Correct answer: D

   Integrated Raft storage replicates data across cluster nodes for high availability without an external database. A single file, memory-only storage and spreadsheets do not provide replicated HA.