HashiCorp Certified: Vault Associate (003) practice questions

Question 1

A platform team is decommissioning a legacy secrets engine for a telco billing application and the SRE is asked what data survives the disable operation. Per the Vault secrets engine lifecycle documentation, which option matches?

Accepted Answer

The disable operation deactivates an engine, revokes associated secrets, and permanently removes all stored data from physical storage.

Answer

The disable operation only revokes the engine's leases but leaves the underlying secret material in storage indefinitely.

Answer

The disable operation keeps every stored secret intact and merely stops accepting new requests at the mount path.

Answer

The disable operation moves the engine's data into a hidden namespace so that it can be re-enabled without loss in the future.

Question 2

A security engineer is hardening AppRole for a SaaS multi-tenant secrets workload and needs an enforcement mechanism that automatically expires SecretIDs after a configured time window. Per the Vault AppRole tutorial, which option matches?

Accepted Answer

Administrators can implement additional SecretID lifecycle controls by specifying secret_id_ttl (time-to-live) or secret_id_num_uses parameters, effectively rotating credentials after expiration or usage thresholds.

Answer

SecretIDs in AppRole are explicitly documented as non-expiring static strings and cannot be bounded by any TTL or use-count parameter.

Answer

SecretIDs only expire when the underlying Raft cluster is resealed, so AppRole credentials remain valid indefinitely as long as Vault is unsealed.

Answer

Administrators must reset every RoleID in the role to expire a SecretID because the AppRole engine does not differentiate between the two credentials operationally.

Question 3

An SRE is tasked with rotating Vault's underlying encryption key on a live three-node HA cluster without taking it offline, and must understand how the standby nodes adopt the change. Which statement is correct?

Accepted Answer

The active node performs the rotate online, and the standby nodes use an upgrade key to update their keys without a manual unseal operation.

Answer

Each standby node must be manually unsealed again with a threshold of unseal keys before it can serve the newly rotated encryption key.

Answer

The rotate operation forces the entire cluster to be sealed first, after which every node is re-initialized fresh from the storage backend.

Answer

Rotating the encryption key also regenerates the unseal key shares, immediately invalidating the operator's previously distributed unseal keys.

Question 4

A platform team is being designed for a retail PCI cluster that needs read scaling without inflating the quorum. Per the Vault Integrated Storage documentation, which option matches?

Accepted Answer

Enterprise editions support non-voting nodes which receive full data replication without contributing to quorum calculations, enabling read scaling while maintaining cluster stability.

Answer

Community Vault supports non-voting nodes by default and they are documented as the standard mechanism for read scaling in any deployment.

Answer

Non-voting nodes drop all replicated data immediately after responding to a read and never persist to local disk.

Answer

Non-voting nodes always contribute to the quorum because Raft cannot distinguish their role from voting peers.

Question 5

A sysadmin is authoring an HCL policy and must decide how to discover the exact set of capabilities a particular vault CLI command will require, rather than guessing the path and verbs by hand. Per the Vault ACL policy documentation, which option matches?

Accepted Answer

Run the command with the -output-policy flag, and Vault prints the policy stanza required to perform that operation.

Answer

Run the command with -dry-run, which prints the ACL policy stanza Vault would need without executing the call.

Answer

Run vault policy read on the target path, which returns the capabilities currently mapped to that path's verbs.

Answer

Run the command with -output-curl-string, which returns the minimal capabilities the operation maps onto internally.

Question 6

A platform team is auditing how revocation cascades when a parent Vault token is revoked for a fintech compliance workload. Per the Vault token hierarchy documentation, which option matches?

Accepted Answer

Parent revocation automatically cascades through the entire tree, preventing token holders from escaping revocation through token proliferation.

Answer

Parent revocation only invalidates the parent token's accessor while keeping the parent token itself and all of its descendants active.

Answer

Parent revocation in Vault stops at the immediate child tokens and never propagates beyond the first level of the hierarchy.

Answer

Parent revocation in Vault leaves child tokens fully valid until their individual TTLs expire on their own.

Question 7

A platform team is being designed for a SaaS multi-tenant secrets workload that wants to remove application-level authentication boilerplate. Per the Vault Agent documentation, which option matches?

Accepted Answer

The auto-auth feature automates the process of obtaining and maintaining valid credentials with Vault, handling the initial authentication handshake and managing token renewal cycles for dynamically-generated secrets.

Answer

Vault Agent auto-auth is exclusively a sidecar pattern for Kubernetes and cannot be used in any other deployment environment. The Vault Agent reference makes no mention of this behaviour, and the certification exam treats it as an unsupported configuration that does not appear in the official auto-auth, caching, and templating matrix.

Answer

Vault Agent auto-auth is documented as a manual interactive prompt that requires the application operator to type a password on every startup.

Answer

Vault Agent auto-auth refuses to maintain tokens across renewals and requires the application to call vault token renew itself.

Question 8

A cloud administrator is tasked with keeping the authoritative copies of encryption keys under central governance in Vault while still letting workloads use the native cryptography of AWS KMS, Azure Key Vault, and GCP Cloud KMS. Per the Vault documentation, which engine fits?

Accepted Answer

The Key Management secrets engine, which generates and owns the original keys in Vault, then distributes copies to the supported KMS providers.

Answer

The Transit secrets engine, which performs the encrypt and decrypt calls itself and never distributes copies of its keys out to an external KMS provider.

Answer

The Transform secrets engine, which applies FPE, masking, and tokenization locally but cannot push key material out to a cloud KMS provider for native use.

Answer

Envelope encryption, which hands client applications a DEK and EDK pair but leaves all of the key governance to the calling code rather than to Vault.

Question 9

A platform team is shortening lease durations for a SaaS tenant whose application only needs credentials for a few minutes. Per the Vault lease renewal documentation, which option matches?

Accepted Answer

During renewal, clients can request an increment value described as an increment from the current time rather than an extension beyond the current expiration.

Answer

The renewal increment is always added to the existing expiration time, so the resulting lease duration grows on every renewal.

Answer

The renewal increment is interpreted as an absolute Unix timestamp at which the lease should expire, with no relation to the current time.

Answer

The renewal increment may only ever shrink the lease; expanding the validity window through renewal is forbidden by Vault.

Question 10

An engineer is updating a secret in a Vault KV version 1 mount by writing a JSON object that contains only the one field they changed, expecting the other fields to be preserved. Per the Vault KV v1 documentation, what actually happens to the omitted fields?

Accepted Answer

Vault replaces the entire value with the new write, so the omitted sub-fields are not merged and are lost at that key.

Answer

Vault merges the new field into the existing secret, leaving the previously stored sub-fields untouched at that key.

Answer

Vault rejects the partial write and returns an error until the engineer supplies the complete set of original sub-fields.

Answer

Vault keeps the prior copy as an earlier version, letting the engineer restore the omitted sub-fields from version history.

Question 11

A startup is evaluating the Vault github auth method so its operators can log in from the CLI, and a developer asks whether Vault will run a browser OAuth handshake with GitHub during login. Per the Vault GitHub auth method documentation, which option matches?

Accepted Answer

Vault does not run an OAuth workflow or act as a GitHub app; operators supply a GitHub personal access token to log in.

Answer

Vault registers itself as a GitHub OAuth application and redirects each operator through GitHub's consent screen on login.

Answer

Vault reads operator usernames and passwords from GitHub directly, lowercasing each username before issuing the token.

Answer

Vault requires every operator to present a client TLS certificate that GitHub has counter-signed before granting a token.

Question 12

A platform team is being designed for a SaaS multi-tenant Vault audit pipeline and asks what Vault does if all configured audit devices fail to log a request. Per the Vault request flow documentation, which option matches?

Accepted Answer

If any configured audit device fails to log, Vault blocks the request to prevent unaudited operations (unless specifically configured otherwise).

Answer

If any configured audit device fails to log, Vault always proceeds with the request and merely warns in the operator's stderr.

Answer

If any configured audit device fails to log, Vault automatically rotates the audit device pool and silently retries with an alternative device.

Answer

If any configured audit device fails to log, Vault seals itself and refuses every subsequent operation until manual reset.

Question 13

A platform team is choosing a storage backend for a SaaS multi-tenant secrets deployment in HashiCorp's recommendations. Per the Vault cluster strategy documentation, which option matches?

Accepted Answer

Integrated Storage (Raft) is the recommended backend for most deployments, providing built-in replication and consensus without external dependencies.

Answer

HashiCorp recommends storing Vault data directly in PostgreSQL because it provides ACID guarantees that Raft lacks.

Answer

Consul storage remains the recommended backend for every new Vault deployment as of the latest documentation.

Answer

HashiCorp recommends running Vault on ephemeral local disks with no replication, because durability is handled by application retries.

Question 14

A security engineer is being onboarded to author a first ACL policy for a healthcare HIPAA workload and asks what an empty Vault policy actually grants. Per the Vault policy syntax documentation, which option matches?

Accepted Answer

Vault implements path-based authorization through policies that follow a deny by default model, meaning an empty policy grants no permission in the system.

Answer

An empty Vault policy is equivalent to the root policy and grants unrestricted access until at least one path stanza is added to restrict it.

Answer

An empty Vault policy implicitly grants read on every path inside the same namespace so that operators can bootstrap access to their own credentials.

Answer

Vault policies follow an allow-by-default model and only deny access for paths explicitly enumerated as denied capabilities in the HCL file.

Question 15

A platform team needs to weigh batch tokens against service tokens for a long-lived workload that must renew and create child tokens. Per the Vault token concepts documentation, which option matches?

Accepted Answer

Batch tokens cannot be renewed, cannot create children, and lack accessor support.

Answer

Batch tokens can be renewed indefinitely as long as the parent service token remains valid.

Answer

Batch tokens support both renewal and accessor lookup but cannot create child tokens of their own.

Answer

Batch tokens support child creation and renewal but their disk state is purged after every operation, making them effectively single-use.

HashiCorp Certified: Vault Associate (003)

Sample questions

Sources

Similar exams