HashiCorp Vault — Certification

1 minute read

The HashiCorp Certified: Vault Associate certification validates your Vault knowledge for production deployments.

Exam Overview

Detail Value
Exam name HashiCorp Certified: Vault Associate (003)
Format Multiple choice
Duration 60 minutes
Questions ~57
Passing score ~70%
Cost $70.50 USD
Validity 2 years
Delivery Online proctored (PSI)

Exam Objectives

Domain Weight Topics
1. Compare Auth Methods 15% Token, AppRole, LDAP, OIDC, K8s
2. Create Vault Policies 15% HCL syntax, capabilities, paths
3. Assess Vault Architecture 10% HA, storage backends, seal/unseal
4. Encrypt Data with Transit 10% Encrypt, decrypt, rewrap, datakeys
5. Use Dynamic Secrets 10% Database, cloud, lease management
6. Utilize ACL Policies 10% Policy writing, testing, management
7. Vault Tokens 10% Types, TTL, renewal, orphan, batch
8. Manage Vault Leases 10% Renew, revoke, prefix revocation
9. Use Vault Agent 5% Auto-auth, caching, templating
10. Understand HA 5% Raft, replication, auto-unseal

Study Plan

Week 1–2: Core Concepts

  • Complete Chapters 1–5 of this tutorial
  • Practice: Start dev server, create secrets, write policies

Week 3–4: Advanced Features

  • Complete Chapters 6–10
  • Practice: Dynamic secrets, Transit, PKI, Vault Agent

Week 5: Production & Architecture

  • Complete Chapters 11–14
  • Practice: HA clusters, monitoring, upgrade procedures

Week 6: Review & Practice

  • Review all exam objectives
  • Take practice exams
  • Focus on weak areas

Key Topics to Master

Auth Methods

# Know these well:
vault auth enable userpass
vault auth enable approle
vault auth enable kubernetes
vault auth enable oidc
vault token create -policy=admin -ttl=1h

Policies

# Understand all capabilities
path "secret/data/*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

Token Types

| Type | Storage | Renewable | Use Case | |——|———|———–|———-| | Service | Yes | Yes | Interactive sessions | | Batch | No | No | High-throughput workloads | | Periodic | Yes | Yes (indefinitely) | Long-running services | | Orphan | Yes | Yes | Independent lifecycle |

Seal/Unseal

  • Shamir’s Secret Sharing
  • Auto-unseal (KMS)
  • Recovery keys vs unseal keys
  • Seal migration

Practice Resources

Resource URL
HashiCorp Learn developer.hashicorp.com/vault/tutorials
Exam Review Guide developer.hashicorp.com/vault/tutorials/associate-cert
Sample Questions hashicorp.com/certification/vault-associate

Exam Tips

  1. Hands-on practice is essential — the exam tests practical knowledge
  2. Know the CLI commands — most questions reference CLI syntax
  3. Understand the difference between auth methods, secrets engines, and policies
  4. Token lifecycle — TTL, max TTL, renewal, revocation
  5. Policy syntax — capabilities, paths, globs, deny overrides
  6. Read carefully — “which is NOT” questions are common

Next: Boundary

You may also enjoy