Free HCVA0-003: HashiCorp Certified: Vault Associate (003)Exam Exam Questions and Answers

Last updated: September 19, 2026

Exam code

HCVA0-003

Provider

HashiCorp

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   Based on the screenshot below, how many auth methods have been enabled on this Vault instance?

   
   • A. 1
   • B. 2
   • C. 4
   • D. 3
   Reveal Answer

2. Question #2

   What could you do with the feature found in the screenshot below (select two)?

   

   Select 2 answers.

   • A. Using a short TTL, you could encrypt data in order to place only the encrypted data in Vault
   • B. Encrypt the Vault master key that is stored in memory
   • C. Encrypt sensitive data to send to a colleague over email
   • D. Use response-wrapping to protect data
   Reveal Answer

3. Question #3

   According to the screenshot below, what auth method did this client use to log in to Vault? (Screenshot shows a lease path: auth/userpass/login/student01)

   • A. Userpass
   • B. Auth
   • C. Root token
   • D. Child token
   Reveal Answer

4. Question #4

   You want to encrypt a credit card number using the Transit secrets engine. You enter the following command and receive an error. What can you do to ensure that the credit card number is properly encrypted and the ciphertext is returned? $ vault write -format=json transit/encrypt/creditcards plaintext="1234 5678 9101 1121" Error: * illegal base64 data at input byte 4

   • A. The plain text data needs to be encoded to base64
   • B. The token used to issue the encryption request does not have the appropriate permissions
   • C. Credit card numbers are not supported using the Transit secrets engine since it is considered sensitive data
   • D. The credit card number should not include spaces
   Reveal Answer

5. Question #5

   How can Vault be used to programmatically obtain a generated code for MFA, somewhat similar to Google Authenticator?

   • A. Cubbyhole
   • B. The random byte generator
   • C. TOTP secrets engine
   • D. The identity secrets engine
   Reveal Answer

6. Question #6

   You've hit the URL for the Vault UI, but you're presented with this screen. Why doesn't Vault present you with a way to log in?

   
   • A. The Consul storage backend was not configured correctly
   • B. Vault needs to be initialized before it can be used
   • C. A Vault policy is preventing you from logging in
   • D. The Vault configuration file has an incorrect configuration
   Reveal Answer

7. Question #7

   Which of the following policies would permit a user to generate dynamic credentials on a database?

   • A. path "database/creds/read_only_role" { capabilities = ["generate"] }
   • B. path "database/creds/read_only_role" { capabilities = ["update"] }
   • C. path "database/creds/read_only_role" { capabilities = ["list"] }
   • D. path "database/creds/read_only_role" { capabilities = ["read"] }
   Reveal Answer

8. Question #8

   What API endpoint is used to manage secrets engines in Vault?

   • A. /secret-engines/
   • B. /sys/mounts
   • C. /sys/capabilities
   • D. /sys/kv
   Reveal Answer

9. Question #9

   Select the policies below that permit you to create a new entry of environment=prod at the path /secrets/apps/my_secret (select three).

   Select 3 answers.

   • A. path "secrets/+/my_secret" { capabilities = ["create"] allowed_parameters = { "*" = [] } }
   • B. path "secrets/apps/my_secret" { capabilities = ["update"] }
   • C. path "secrets/apps/my_secret" { capabilities = ["create"] allowed_parameters = { "environment" = [] } }
   • D. path "secrets/apps/*" { capabilities = ["create"] allowed_parameters = { "environment" = ["dev", "test", "qa", "prod"] } }
   Reveal Answer

10. Question #10

    Which of the following secrets engines does NOT issue a lease upon a read request?

    • A. KV
    • B. Consul
    • C. Database
    • D. AWS
    Reveal Answer