Why does Vault use a seal mechanism?

To protect the master key that encrypts Vault's data at rest, so the data cannot be read until Vault is unsealed

Which policy capability allows a token to read a secret at a given path?

The read capability on that path, granted through an HCL policy attached to the token

Which secrets engine generates short-lived database credentials that expire automatically?

The database secrets engine, which creates short-lived credentials for the database on request

Which auth method suits applications on Kubernetes that need secrets without storing a static credential?

The Kubernetes auth method, which validates the pod's service account token with the cluster

Which storage option gives Vault built-in high availability without an external database?

Integrated Raft storage, which replicates Vault data across the nodes of the cluster

What does an explicit deny in a Vault policy do?

It overrides any allow granted by another policy attached to the same token for that path

What is a lease in Vault?

A time-bound claim on a dynamic secret, which Vault revokes when the lease expires or is revoked

What does a token's TTL define?

How long the token remains valid before it expires and must be renewed or replaced

What is the role of the Vault server in a typical deployment?

It stores and serves secrets, and enforces access through authentication, policies and audit

Which command shows the policies, TTL and other details attached to the current token?

vault token lookup, which displays the token's policies, TTL and other details

Which KV version supports version history and the ability to undelete a secret?

KV version 2, which keeps version history and supports soft delete and undelete of secrets

Which token type is lightweight, not persisted, and cannot be renewed?

Batch tokens, which are lightweight, are not persisted, and cannot be renewed

Which unseal approach removes the need for operators to enter key shares after every restart?

Auto-unseal with a cloud KMS or HSM, which unseals Vault automatically when it starts

Which Vault component records requests and responses to a configured destination, with sensitive values hashed?

An audit device, which logs requests and responses to a configured destination with sensitive values hashed

Which secrets engine provides encryption as a service so that applications do not store their own encryption keys?

The transit secrets engine, which encrypts and decrypts data without storing the data itself in Vault

Which auth methods let people sign in with credentials from an existing corporate directory?

LDAP or OIDC auth methods, which delegate authentication to the directory's identity provider

What does a dev-mode Vault server provide?

A quick, non-production Vault that starts unsealed with an in-memory store, for learning and testing

What does the sudo capability permit in a Vault policy?

Access to paths that are marked as root-protected, granted explicitly in the policy attached to the token

Which secrets engine issues X.509 certificates from a Vault-managed certificate authority?

The PKI secrets engine, which issues and manages X.509 certificates from a CA that Vault manages

In AppRole authentication, which element should be kept secret from the application's code?

The secret ID, which is delivered to the application through a trusted channel at deployment time

Which concept places each secrets engine and auth method at a path that identifies it?

Mount paths, where each secrets engine or auth method is enabled at a path that identifies it

Which TWO are valid policy practices? (Choose two.)

Granting the least privilege needed on specific paths, instead of wildcards that cover all paths

Reviewing policies periodically and removing paths that are no longer used by any token or application

What happens to the credentials issued by a dynamic secret when its lease is revoked?

Vault removes or disables the credentials it issued, so they can no longer be used to access the system

What does a periodic token do?

It can be renewed repeatedly to stay valid, without a maximum lifetime, as long as it is renewed in time

Which TWO statements about Vault's architecture are correct? (Choose two.)

Vault clients communicate with Vault over its HTTP API, and the CLI and UI are clients of that API

Audit devices write a log of requests and responses, with sensitive values hashed in the log entries

Which TWO are correct about Vault's operational tasks? (Choose two.)

Taking regular Raft snapshots so that the cluster's data can be recovered after a failure

Rotating root tokens and revoking old ones after an incident, to limit the exposure of the credentials

Which TWO are benefits of dynamic secrets over static secrets? (Choose two.)

Credentials are unique per request and expire automatically, which limits the exposure of each one

A leaked credential has a short lifetime, which reduces the blast radius of a leak to the system

Which TWO are good practices for token handling? (Choose two.)

Using short TTLs and renewing tokens only while the application still needs access to the secrets

Revoking tokens when a workload no longer needs access, so that leaked tokens stop working promptly

What is the purpose of a Vault unseal key share threshold?

It sets how many of the key shares are required to reconstruct the root key and unseal Vault

Which HCL policy path pattern matches every path under the secret/ mount in a policy?

secret/* with a wildcard, which matches all paths under the secret mount in the policy

All HashiCorp exams

Free Vault Associate practice test: 30 questions with answers

30 original questions for Vault Associate, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions: 30
Full bank: 112 questions
Real exam: 60 min

Vault Associate exam guide: topics, cost and format

All 30 Vault Associate questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Vault Concepts and Architecture (8 questions)

Question 1
Why does Vault use a seal mechanism?
1. ATo encrypt each secret with a different user's password on every request that Vault receives from clients
2. BTo lock the Vault user interface whenever no user is signed in, for display purposes only on the screen
3. CTo prevent the storage backend from being backed up by the operations team as part of routine work
4. DTo protect the master key that encrypts Vault's data at rest, so the data cannot be read until Vault is unsealed
Show answer and explanationHide answer
Correct answer: D
The seal protects the master key that encrypts data at rest, so storage cannot be read without unsealing. The UI lock, backup prevention and per-user request encryption are not what the seal does.
Question 2
Which storage option gives Vault built-in high availability without an external database?
1. AA spreadsheet stored on each node, which the client synchronises by hand after every change
2. BA local file on one server, which is shared with the other nodes through a network drive mount
3. CAn in-memory cache only, which is lost on every restart of the cluster and is not replicated
4. DIntegrated Raft storage, which replicates Vault data across the nodes of the cluster
Show answer and explanationHide answer
Correct answer: D
Integrated Raft storage replicates data across cluster nodes for high availability without an external database. A single file, memory-only storage and spreadsheets do not provide replicated HA.
Question 3
What is the role of the Vault server in a typical deployment?
1. AIt replaces the operating system's file system on each host that runs the applications in the company
2. BIt only provides a web page with documentation for the users of the company's internal applications
3. CIt stores and serves secrets, and enforces access through authentication, policies and audit
4. DIt acts as the DNS resolver for every application in the network, answering name lookups for all services
Show answer and explanationHide answer
Correct answer: C
The Vault server stores and serves secrets and enforces authentication, policy and audit. Documentation pages, file systems and DNS are not its role.
Question 4
Which unseal approach removes the need for operators to enter key shares after every restart?
1. APrinting the unseal keys on paper and taping them to the server rack where the Vault node is installed
2. BDisabling the seal entirely, which leaves the data unprotected at rest in the storage for convenience
3. CAuto-unseal with a cloud KMS or HSM, which unseals Vault automatically when it starts
4. DRestarting Vault only during business hours so that operators are always present to enter the key shares
Show answer and explanationHide answer
Correct answer: C
Auto-unseal with a cloud KMS or HSM unseals Vault automatically on startup. Disabling the seal, taped keys and business-hours restarts are unsafe or do not remove the manual step.
Question 5
What does a dev-mode Vault server provide?
1. AA backup copy of the production secrets, kept for disaster recovery purposes in a separate location
2. BA fully hardened production cluster with high availability and audit enabled by default for production use
3. CA quick, non-production Vault that starts unsealed with an in-memory store, for learning and testing
4. DA load balancer for applications, which reads secrets from the nearest node in the cluster on each request
Show answer and explanationHide answer
Correct answer: C
Dev mode is an unsealed, in-memory, non-production server for learning. It is not hardened, HA or a backup, and it is not a load balancer.
Question 6
Which concept places each secrets engine and auth method at a path that identifies it?
1. AMount paths, where each secrets engine or auth method is enabled at a path that identifies it
2. BCertificates, which store the public keys of each user's device in the secret store for signing purposes
3. CLeases, which define how many users are allowed to sign in to the Vault server at the same time
4. DAudit devices, which decide which secrets engine a request is sent to by default when none is named
Show answer and explanationHide answer
Correct answer: A
Mount paths identify each secrets engine and auth method. Certificates, leases and audit devices serve different purposes.
Question 7
Which TWO statements about Vault's architecture are correct? (Choose two.)
1. AVault clients communicate with Vault over its HTTP API, and the CLI and UI are clients of that API
2. BVault stores secrets in plaintext on disk, so that backups can be read by any operator in the team
3. CEach Vault node holds a different part of every secret, so that no single node can read the secret alone
4. DAudit devices write a log of requests and responses, with sensitive values hashed in the log entries
5. EVault must be connected to the internet to unseal itself on every restart of the server node
Show answer and explanationHide answer
Correct answer: A, D
The CLI and UI are clients of the HTTP API, and audit devices hash sensitive values. Plaintext storage, per-node secret splitting and internet-based unsealing are incorrect.
Question 8
What is the purpose of a Vault unseal key share threshold?
1. AIt sets how many of the key shares are required to reconstruct the root key and unseal Vault
2. BIt sets how many users may sign in to the Vault UI at the same time before the next user is refused access
3. CIt sets how many secrets Vault may return in a single response before it paginates the results for the client
4. DIt sets how many audit devices must be enabled before the cluster is allowed to accept any client requests
Show answer and explanationHide answer
Correct answer: A
The threshold sets how many shares are needed to reconstruct the root key. Sign-in limits, response paging and audit device counts are unrelated.

Policies and Operations (8 questions)

Question 9
Which policy capability allows a token to read a secret at a given path?
1. AThe read capability on that path, granted through an HCL policy attached to the token
2. BThe sudo capability on the root path, which grants reads on every path in the cluster by default
3. CThe list capability on the audit path, which allows the token to read the secret values as they are logged
4. DThe deny capability on the secret path, which grants read access when it is applied together with the root policy
Show answer and explanationHide answer
Correct answer: A
The read capability on the path, granted by an attached HCL policy, allows reading. Sudo, list on audit paths and deny do not grant reads in those ways.
Question 10
What does an explicit deny in a Vault policy do?
1. AIt overrides any allow granted by another policy attached to the same token for that path
2. BIt only logs the attempted access in the audit log and never blocks the request from being processed at all
3. CIt deletes the secret at the path after the first denied request, to prevent any further access to it
4. DIt applies only to the root token, so ordinary tokens are not affected by the deny rule in the policy
Show answer and explanationHide answer
Correct answer: A
An explicit deny overrides allows from any attached policy for that path. It does not merely log, delete secrets, or apply only to root.
Question 11
Which command shows the policies, TTL and other details attached to the current token?
1. Avault status, which displays the policies attached to the token for each secrets engine in the cluster
2. Bvault token lookup, which displays the token's policies, TTL and other details
3. Cvault audit list, which displays the policies that each token used in each request in the audit log
4. Dvault secrets list, which displays the policies that protect each secret stored in the cluster's engines
Show answer and explanationHide answer
Correct answer: B
vault token lookup displays the token's details, including policies and TTL. Status, audit list and secrets list show other information.
Question 12
Which Vault component records requests and responses to a configured destination, with sensitive values hashed?
1. AAn audit device, which logs requests and responses to a configured destination with sensitive values hashed
2. BA lease, which records the time at which each secret was issued and revoked by the cluster for its history
3. CA namespace, which records the requests made by each application team to the Vault server for reporting
4. DA mount path, which records the secrets engine used for each request that is made to the Vault server
Show answer and explanationHide answer
Correct answer: A
An audit device logs requests and responses with sensitive values hashed. Leases, namespaces and mount paths do not record audit logs.
Question 13
What does the sudo capability permit in a Vault policy?
1. AUnlimited access to all secrets and all auth methods in the cluster, without any policy needed to grant it at all
2. BAccess to paths that are marked as root-protected, granted explicitly in the policy attached to the token
3. CThe ability to change the Vault server's operating system package versions on each node as the cluster owner
4. DThe ability to sign in without any authentication method being configured on the cluster's auth paths
Show answer and explanationHide answer
Correct answer: B
Sudo grants access to root-protected paths when explicitly allowed in a policy. It does not grant unlimited access, OS changes or authentication bypass.
Question 14
Which TWO are valid policy practices? (Choose two.)
1. AGranting the least privilege needed on specific paths, instead of wildcards that cover all paths
2. BGiving every application the root policy so that it never fails authorisation during its routine operations
3. CUsing broad wildcards so that new paths are covered automatically, without any review of their needs
4. DReviewing policies periodically and removing paths that are no longer used by any token or application
5. EAttaching the admin policy to every token issued by the cluster, for consistency across the environment
Show answer and explanationHide answer
Correct answer: A, D
Least privilege on specific paths and periodic removal of unused paths keep policies tight. Root for every application, broad wildcards and admin on every token all break least privilege.
Question 15
Which TWO are correct about Vault's operational tasks? (Choose two.)
1. ATaking regular Raft snapshots so that the cluster's data can be recovered after a failure
2. BRunning production Vault in dev mode, because it is faster and has no operational overhead at all
3. CStoring the unseal keys in the same location as the Vault data, for convenience during each restart
4. DRotating root tokens and revoking old ones after an incident, to limit the exposure of the credentials
5. EDeleting audit logs regularly, to save disk space on the Vault nodes in the cluster that run the service
Show answer and explanationHide answer
Correct answer: A, D
Raft snapshots enable recovery, and rotating and revoking root tokens after an incident limits exposure. Dev mode in production, unseal keys with data and deleting audit logs are unsafe.
Question 16
Which HCL policy path pattern matches every path under the secret/ mount in a policy?
1. Asecret/ with no wildcard, which matches every nested path under the mount in the policy as well
2. Bsecret/* with a wildcard, which matches all paths under the secret mount in the policy
3. C*/secret, which matches the secret engine at every mount path name in the cluster for each token
4. Dsecret:all, which is the policy syntax for granting access to every engine at every path in the cluster
Show answer and explanationHide answer
Correct answer: B
The wildcard secret/* matches paths under the mount. Without a wildcard the match is exact, and the other forms are not valid path patterns.

Secrets Engines and Leases (7 questions)

Question 17
Which secrets engine generates short-lived database credentials that expire automatically?
1. AThe database secrets engine, which creates short-lived credentials for the database on request
2. BThe KV secrets engine, which stores the database password as a static value that never changes over time
3. CThe transit secrets engine, which encrypts the database rows with a key that is rotated on a monthly schedule
4. DThe PKI secrets engine, which issues certificates for the database servers used by the application each day
Show answer and explanationHide answer
Correct answer: A
The database secrets engine creates short-lived dynamic credentials. KV stores static values, transit encrypts data and PKI issues certificates.
Question 18
What is a lease in Vault?
1. AA reservation of disk space on the storage backend, which is released automatically when a user logs out
2. BA rental agreement for the Vault server's hardware, which is recorded by the procurement team each year
3. CA contract that grants a user permission to sign in to the Vault UI for a fixed number of days in a year
4. DA time-bound claim on a dynamic secret, which Vault revokes when the lease expires or is revoked
Show answer and explanationHide answer
Correct answer: D
A lease is a time-bound claim on a dynamic secret that Vault revokes at expiry. Hardware rental, UI contracts and disk reservations are not leases.
Question 19
Which KV version supports version history and the ability to undelete a secret?
1. AKV version 1, which keeps the full history of every value and supports soft delete for every secret stored
2. BKV version 2, which keeps version history and supports soft delete and undelete of secrets
3. CKV version 1 with a plugin, which stores each secret in a separate file and allows undelete by copying the file
4. DA transit key, which stores each version of a secret and allows undelete by re-encrypting the old value
Show answer and explanationHide answer
Correct answer: B
KV version 2 keeps version history with soft delete and undelete. KV version 1 has no versioning, and transit keys encrypt data rather than store secret versions.
Question 20
Which secrets engine provides encryption as a service so that applications do not store their own encryption keys?
1. AThe KV secrets engine, which stores the encryption keys as plaintext values that applications read on start
2. BThe transit secrets engine, which encrypts and decrypts data without storing the data itself in Vault
3. CThe database secrets engine, which creates a new key for every query that the application sends to the database
4. DThe PKI secrets engine, which signs every message sent between the applications with its own private key
Show answer and explanationHide answer
Correct answer: B
The transit engine performs encryption and decryption without storing the data, so applications need not hold keys. The other engines store secrets, create database credentials or issue certificates.
Question 21
Which secrets engine issues X.509 certificates from a Vault-managed certificate authority?
1. AThe database secrets engine, which creates a certificate for each database user account when it is created
2. BThe KV secrets engine, which stores certificate files as plaintext values that applications copy at start
3. CThe transit secrets engine, which signs certificates by encrypting their contents with an application key
4. DThe PKI secrets engine, which issues and manages X.509 certificates from a CA that Vault manages
Show answer and explanationHide answer
Correct answer: D
The PKI secrets engine issues and manages X.509 certificates. KV, transit and database engines do not act as certificate authorities.
Question 22
What happens to the credentials issued by a dynamic secret when its lease is revoked?
1. AVault removes or disables the credentials it issued, so they can no longer be used to access the system
2. BNothing happens to the credentials, because revocation only affects the lease record in Vault's own database
3. CThe credentials are copied to the lease holder's personal folder, so that the holder keeps access after revocation
4. DThe credentials are renewed automatically for another full TTL, so that access is never interrupted by revocation
Show answer and explanationHide answer
Correct answer: A
Revoking a lease removes or disables the credentials it issued. Leaving them active, copying them and auto-renewing all defeat revocation.
Question 23
Which TWO are benefits of dynamic secrets over static secrets? (Choose two.)
1. ACredentials are unique per request and expire automatically, which limits the exposure of each one
2. BCredentials never change, so applications never need to be updated when a secret is rotated in the system
3. CAccess is only possible for root users, which keeps the dynamic secrets limited to the administrators
4. DThe same password is shared across all clients, which simplifies the rotation of the shared credential
5. EA leaked credential has a short lifetime, which reduces the blast radius of a leak to the system
Show answer and explanationHide answer
Correct answer: A, E
Unique, automatically expiring credentials limit exposure, and short lifetimes reduce the blast radius of a leak. Static credentials, root-only access and shared passwords are the opposite of dynamic secret benefits.

Authentication and Tokens (7 questions)

Question 24
Which auth method suits applications on Kubernetes that need secrets without storing a static credential?
1. AAn unauthenticated endpoint that returns secrets to any caller on the cluster network without any check
2. BA shared username and password written into the container image, which every pod uses to sign in
3. CA root token copied into each pod's configuration file during the deployment of the application
4. DThe Kubernetes auth method, which validates the pod's service account token with the cluster
Show answer and explanationHide answer
Correct answer: D
The Kubernetes auth method validates the pod's service account token, avoiding static credentials. Shared passwords, root tokens and unauthenticated endpoints are unsafe.
Question 25
What does a token's TTL define?
1. AThe number of characters in the token string, which determines how hard the token is to guess
2. BThe number of secrets the token is allowed to read in a single session before it is locked out
3. CHow long the token remains valid before it expires and must be renewed or replaced
4. DThe number of Vault nodes the token may contact during one request before it is refused by the cluster
Show answer and explanationHide answer
Correct answer: C
TTL defines how long a token remains valid before renewal or replacement. Secret counts, string length and node counts are not TTL.
Question 26
Which token type is lightweight, not persisted, and cannot be renewed?
1. ARoot tokens, which are persisted forever and can be renewed indefinitely by any user on the cluster
2. BBatch tokens, which are lightweight, are not persisted, and cannot be renewed
3. CPeriodic tokens, which are persisted and renewed automatically on a schedule set by the administrator
4. DService tokens with the longest TTL available, which are renewed automatically by the storage backend
Show answer and explanationHide answer
Correct answer: B
Batch tokens are lightweight, non-persisted and non-renewable, suited to short workloads. Root, periodic and long-TTL service tokens are persisted and renewable.
Question 27
Which auth methods let people sign in with credentials from an existing corporate directory?
1. AA static list of IP addresses, which are allowed to read secrets whether or not their users are authenticated
2. BThe root token, which is shared by the whole company so that every employee can sign in with it
3. CLDAP or OIDC auth methods, which delegate authentication to the directory's identity provider
4. DThe token accessor, which is printed on each employee's badge so that the badge can be scanned at the door
Show answer and explanationHide answer
Correct answer: C
LDAP and OIDC delegate authentication to a directory or identity provider. Shared root tokens, IP lists and badge accessors are not directory authentication.
Question 28
In AppRole authentication, which element should be kept secret from the application's code?
1. AThe name of the secrets engine that the application reads, which is listed in its configuration file
2. BThe role ID, which is embedded in the source code of the application for its routine sign-in each time
3. CThe secret ID, which is delivered to the application through a trusted channel at deployment time
4. DThe URL of the Vault server, which is published openly in the application's documentation for developers
Show answer and explanationHide answer
Correct answer: C
The secret ID is the sensitive part, delivered through a trusted channel. The role ID is not treated as the secret, and the engine name and server URL are not secret.
Question 29
What does a periodic token do?
1. AIt expires once at a fixed time each day and cannot be renewed by any process under any circumstances
2. BIt can be renewed repeatedly to stay valid, without a maximum lifetime, as long as it is renewed in time
3. CIt is valid only for one request, after which the token is removed from every node in the cluster automatically
4. DIt is shared between all users of the cluster so that the same token serves the whole team at the same time
Show answer and explanationHide answer
Correct answer: B
A periodic token can be renewed repeatedly without a maximum lifetime if renewed in time. Fixed expiry, single-request use and shared tokens do not describe periodic tokens.
Question 30
Which TWO are good practices for token handling? (Choose two.)
1. AUsing short TTLs and renewing tokens only while the application still needs access to the secrets
2. BSharing the root token among the operations team, so that access is quick during emergencies at any hour
3. CStoring tokens in source code so that they are available for every deployment without any extra steps
4. DRevoking tokens when a workload no longer needs access, so that leaked tokens stop working promptly
5. EUsing one token for every application in the environment, to keep the configuration simple to manage
Show answer and explanationHide answer
Correct answer: A, D
Short TTLs with renewal only when needed, and prompt revocation, limit token exposure. Shared root tokens, tokens in code and one token for everything widen the risk.

All 30 Vault Associate questions with answers

Vault Concepts and Architecture (8 questions)

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Policies and Operations (8 questions)

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Secrets Engines and Leases (7 questions)

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Authentication and Tokens (7 questions)

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30