HashiCorp Certified: Vault Associate (003)
Validate foundational knowledge of secrets management, data protection, and identity-based security using HashiCorp Vault, including authentication methods, secret engines, Vault policies, tokens, and lease lifecycles.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The Vault Associate (003) exam validates foundational skills in secrets management, identity-based authentication, encryption as a service, policy authoring, and operational workflows using HashiCorp Vault.
The exam consists of 57 multiple-choice, multiple-answer, and true/false questions to be completed within 60 minutes. The registration fee is $70.50 USD.
The passing scaled threshold is approximately 70%. Results with domain breakdowns are provided immediately upon exam completion.
Domains include: (1) Compare Authentication Methods (16%), (2) Create Vault Policies (18%), (3) Assess Vault Architecture (16%), (4) Explain Encryption as a Service (14%), (5) Manage Leases and Tokens (16%), (6) Secrets Engines (16%), and (7) Vault CLI/API Workflows (14%).
When Vault initializes, it creates a master key split into multiple unseal keys via Shamir's algorithm. A configurable threshold (e.g. 3 of 5) must be entered to decrypt the barrier encryption key and unseal the storage.
KV v1 provides unversioned key-value storage. KV v2 adds automatic versioning, soft deletion, undeletion, and metadata tracking for every secret.
Static secrets are fixed values manually created and stored in Vault. Dynamic secrets are generated on-demand with unique credentials, an attached TTL, and automatic revocation upon lease expiry.
Response wrapping places a secret inside a temporary, single-use, time-limited cubbyhole token. The recipient unwraps it, and any attempt at interception is instantly detectable.
AppRole requires a machine to present a RoleID (similar to a username) and a SecretID (similar to a password) to authenticate and receive a scoped Vault token.
Service tokens are persisted in Vault storage, have leases, can be renewed, and support accessors. Batch tokens are lightweight, encrypted in memory, not written to storage, and ideal for high-volume microservices.
Transit performs cryptography (encrypt, decrypt, sign, HMAC, datakey generation) over an API without exposing the underlying cryptographic keys to applications.
The official HashiCorp Developer tutorials, hands-on lab practice running Vault in dev mode and production mode, and comprehensive realistic mock exams.