HashiCorp Certified: Vault Associate (003) HCVA0-003 Exam Questions

Page: 1 / 14
Total 285 questions
Question 1

Christy has created a token and needs to use that token to access Vault. What command can she use to authenticate and access secrets stored in Vault?

$ vault token create -policy=christy

Key Value

--- -----

token hvs.hxDIPd8RPVtxu4AzSGS1lArP

token_accessor AxwxpDs6LbdFQbWGmBDnwIK3

token_duration 24h

token_renewable true

token_policies ["christy" "default"]

identity_policies []

policies ["christy" "default"]



Answer : A

Comprehensive and Detailed in Depth Explanatio n:

To authenticate with a specific token, Christy should use the vault login command with the token value. The HashiCorp Vault documentation states: 'To login with a token, you can use vault login <token> or even vault login -method=token <token> if you like typing more.' For the given token hvs.hxDIPd8RPVtxu4AzSGS1lArP, the command vault login hvs.hxDIPd8RPVtxu4AzSGS1lArP authenticates Christy and stores the token for subsequent CLI use.

The docs provide an example: '```

$ vault login s.sf4vj1rFV5PvQSbrxQFsfbXA

Success! You are now authenticated. The token information displayed below is already stored in the token helper. You do NOT need to run 'vault login' again. Future Vault requests will automatically use this token.

Key Value

token s.sf4vj1rFV5PvQSbrxQFsfbXA

Topic 3, Exam Pool C


Question 2

How long does the Transit secrets engine store the resulting ciphertext by default?



Answer : D

Comprehensive and Detailed in Depth Explanatio n:

The Transit secrets engine in Vault is designed for encryption-as-a-service, not data storage. Let's evaluate:

Option A: 24 hours

Transit doesn't store ciphertext, so no TTL applies. Incorrect.

Option B: 30 days

No storage means no 30-day retention. Incorrect.

Option C: 32 days

This aligns with token TTLs, not Transit behavior. Incorrect.

Option D: Transit does not store data

Transit encrypts data and returns the ciphertext to the caller without persisting it in Vault. Correct.

Detailed Mechanics:

When you run vault write transit/encrypt/mykey plaintext=<base64-data>, Vault uses the named key (e.g., mykey) to encrypt the input and returns a response like vault:v1:<ciphertext>. This ciphertext is not stored in Vault's storage backend (e.g., Consul, Raft); it's the client's responsibility to save it (e.g., in a database). This stateless design keeps Vault lightweight and secure, avoiding data retention risks.

Real-World Example:

Encrypt a credit card: vault write transit/encrypt/creditcard plaintext=$(base64 <<< '1234-5678-9012-3456'). Response: ciphertext=vault:v1:<data>. You store this in your app's database; Vault retains nothing.

Overall Explanation from Vault Docs:

''Vault does NOT store any data encrypted via the transit/encrypt endpoint... The ciphertext is returned to the caller for storage elsewhere.''


Question 3

Which of the following secrets engines can store static secrets in Vault for future retrieval?



Answer : A

Comprehensive and Detailed In-Depth

For static secrets:

A . KV: 'The KV secrets engine is the ONLY secrets engine that will store static data in Vault for future retrieval.'

Incorrect Options:

B, C, D: Generate or encrypt, don't store static secrets.


Question 4

You need to write a Vault operator policy and give the users access to perform administrative actions in Vault. What path is used for Vault backend functions?



Answer : E

Comprehensive and Detailed in Depth Explanatio n:

The correct path for Vault backend functions, which include administrative actions, is /sys. The HashiCorp Vault documentation confirms: 'All backend system functions live in the /sys backend. Policies should take /sys into account when users need to administer Vault configurations.' This path hosts endpoints for system-level operations like mounting secrets engines, managing policies, and sealing/unsealing Vault.

Paths like /security, /admin, /vault, /system, and /backend are not standard for Vault's system backend. Only /sys provides the necessary administrative capabilities, making E the correct answer.


HashiCorp Vault Documentation - System Backend

Question 5

Which of the following are considered benefits of using policies in Vault? (Select three)



Answer : B, C, D

Comprehensive and Detailed In-Depth

Vault policies offer several benefits for access control. The Vault documentation states:

'There are many benefits to using Vault policies, including:

Provides granular access control to paths within Vault to control who can access certain paths inside Vault

Policies have an implicit deny, meaning that policies are deny by default - no policy means no authorization

Policies provide Vault operators with role-based access control so you can ensure users only have access to the paths required'

--- Vault Tutorials: Policies

B: Correct. Granular control is a core feature.

C: Correct. Implicit deny enhances security:

'Policies in Vault follow the principle of least privilege by having an implicit deny.'

--- Vault Policies

D: Correct. Role-based access simplifies management.

A: Incorrect; tokens can have multiple policies:

'Policies are indeed attached to tokens, but tokens can be assigned more than one policy if needed. Policies are cumulative and capabilities are additive.'

--- Vault Tutorials: Policies


Vault Tutorials: Policies

Vault Policies

Question 6

From the options below, select the auth methods that are better suited for machine-to-machine authentication (select five):



Answer : A, C, D, E, F

Comprehensive and Detailed in Depth Explanatio n:

Machine-to-machine (M2M) auth methods in Vault enable automated systems to authenticate without human interaction. Let's assess:

A: Kubernetes - Uses service account tokens for pods. Correct.

Vault Docs Insight: ''Kubernetes auth... ideal for workloads in Kubernetes clusters.''

B: GitHub - User-focused, requires human GitHub login. Incorrect.

Vault Docs Insight: ''GitHub auth... typically for human users.''

C: TLS - Certificate-based, perfect for M2M. Correct.

Vault Docs Insight: ''TLS auth uses certificates... suited for machine authentication.''

D: Token - Pre-generated tokens for automation. Correct.

Vault Docs Insight: ''Token auth... can be used by machines with proper management.''

E: AppRole - RoleID/SecretID for apps. Correct.

Vault Docs Insight: ''AppRole is designed for machine-to-machine authentication...''

F: AWS - IAM roles for AWS resources. Correct.

Vault Docs Insight: ''AWS auth... automated for AWS-based machines.''

G: LDAP - User directory-based, human-oriented. Incorrect.

Vault Docs Insight: ''LDAP... commonly for human user authentication.''

H: OIDC - User SSO, not M2M. Incorrect.

Vault Docs Insight: ''OIDC... for human single sign-on.''

Overall Explanation from Vault Docs:

''Examples of machine auth methods include AppRole, AWS, Kubernetes, TLS, and Token... Human auth methods include LDAP, GitHub, OIDC.''


Question 7

A new application is being provisioned in your environment. The application requires the generation of dynamic credentials against the Oracle database in order to read reporting dat

a. Which is the best auth method to use to permit the application to authenticate to Vault?



Answer : D

Comprehensive and Detailed In-Depth

AppRole is optimal for machine authentication. The Vault documentation states:

'AppRole is an auth method that is better suited for machine-to-machine authentication. The AppRole auth method allows machines or applications to authenticate with Vault using a role-specific secret ID and role ID.'

--- Vault Auth: AppRole

D: Correct. Ideal for dynamic Oracle credentials:

'AppRole is the best auth method to use in this scenario because it allows machines or applications to authenticate with Vault.'

--- Vault Auth: AppRole

A, B, C: Human-oriented, not machine-suited.


Vault Auth: AppRole

Page:    1 / 14   
Total 285 questions