HashiCorp Certified: Vault Associate

What is the primary purpose of a Vault authentication method?

• ATo encrypt data before it is stored
• BTo verify a client identity and issue a token
• CTo replicate data between clusters
• DTo rotate transit encryption keys

After a client successfully authenticates to Vault, what does Vault normally return?

• AA storage backend configuration file
• BA new unseal key share
• CA client token associated with policies
• DA root certificate authority

Why do many Vault deployments enable more than one authentication method?

• AVault requires at least two auth methods before it can seal
• BDifferent users and workloads often need different login flows
• CEach secrets engine requires its own auth method
• DA second auth method automatically creates replication

Which statement best distinguishes authentication methods from policies in Vault?

• AAuthentication methods define what paths can be read, while policies choose the login end…
• BAuthentication methods verify identity, while policies define what actions a token can pe…
• CAuthentication methods store secrets, while policies generate dynamic credentials
• DAuthentication methods rotate keys, while policies unseal the cluster

A new application team says, "We already know which path we want to read, so we should not need to authenticate first." Which response is most accurate?

• AThey are correct because Vault authorizes by path only
• BThey are correct if the path is in the KV secrets engine
• CThey are incorrect because Vault still needs an authenticated identity or token before it…
• DThey are incorrect only when using the UI

A company wants employees to sign in to Vault with the same browser-based single sign-on experience they already use for other tools. Which auth method is the best fit?

• AOIDC auth
• BAppRole auth
• CToken auth with a shared service token
• DTransit auth

Pods running in a Kubernetes cluster need to authenticate to Vault using their service account identity. Which auth method should you choose?

• ALDAP auth
• BKubernetes auth
• CUserpass auth
• DRADIUS auth

A non-human CI job outside Kubernetes needs to fetch short-lived credentials from Vault without any browser interaction. Which auth method is most appropriate?

• AOIDC auth
• BUserpass auth
• CAppRole auth
• DGitHub auth

An organization wants internal employees to authenticate with their existing Active Directory credentials. Which auth method is the most natural fit?

• ALDAP auth
• BAWS auth
• CAppRole auth
• DTransit auth

An application runs on EC2 instances and should authenticate using the instance's AWS identity instead of a separately distributed secret. Which auth method is the best choice?

• AUserpass auth
• BAWS auth
• CTLS certificates copied by hand
• DRoot token auth

Which authentication method is most clearly intended for human interactive login rather than machine-to-machine access?

• AOIDC auth
• BAppRole auth
• CKubernetes auth
• DAWS auth

Which option is the clearest example of a system authentication method in Vault?

• AOIDC auth for employee SSO
• BAppRole auth for an automated service
• CLDAP auth for help desk staff
• DUserpass auth for a training lab

Why is giving an application a developer's personal Vault token a poor design choice?

• AHuman tokens cannot read any secrets
• BVault blocks humans from creating tokens
• CPersonal human credentials are hard to rotate safely and tie application access to an ind…
• DApplications can only use root tokens

What is one practical difference between human and system authentication methods?

• AHuman methods are only available in Enterprise Vault
• BSystem methods are designed for non-interactive workflows and automation
• CHuman methods can issue tokens but system methods cannot
• DSystem methods do not use policies

A team tries to make a nightly batch job log in with a browser-based SSO prompt. What is the better Vault design?

• AKeep the browser login because all auth methods work the same way
• BUse a workload-oriented auth method such as AppRole or a platform identity method
• CUse a shared root token so no login is needed
• DDisable all policies for the job

What problem do Vault identities and entities help solve?

• AThey encrypt the storage backend
• BThey unify multiple login aliases that belong to the same real user or workload
• CThey replace all Vault policies
• DThey remove the need for authentication methods

If several users need the same access, what is usually the best design?

• ACreate a different secrets engine for each user
• BAttach the same policies through a group instead of managing each user separately
• CGive each user a root token
• DStore policy text inside the login token

A person authenticates to Vault through GitHub one day and LDAP the next day. How can Vault still treat those logins as the same person?

• ABy storing both logins in the same secret engine
• BBy attaching both aliases to one identity entity
• CBy converting both auth methods into root auth
• DBy disabling policy evaluation

What is the main difference between an internal group and an external group in Vault identity management?

• AInternal groups are created in Vault, while external groups are mapped from an external i…
• BInternal groups can use policies, while external groups cannot
• CInternal groups work only with AppRole, while external groups work only with OIDC
• DInternal groups are encrypted, while external groups are plaintext

What is an identity alias in Vault?

• AA second root token for emergencies
• BA mount path for the storage backend
• CThe representation of an auth-method-specific login that links to an entity
• DA transit key version

Which CLI command is commonly used to authenticate and obtain a token interactively?

• Avault login
• Bvault operator unseal
• Cvault secrets enable
• Dvault policy read

In the HTTP API, where do login requests normally go for a mounted auth method?

• Asys/mounts/login/<method>
• Bidentity/login/<method>
• Cauth/<mount-path>/login/...
• Dtransit/login/<method>

Which statement about authenticating in the Vault UI is most accurate?

• AThe UI bypasses auth methods and uses direct policy selection
• BThe UI still relies on enabled auth methods and receives a token after login
• CThe UI can only use token auth
• DThe UI automatically logs in every browser session as root

After authenticating through the Vault API, how does a client usually present its token on later API requests?

• ABy appending it to the URL hostname
• BBy placing it in the X-Vault-Token header
• CBy adding it to the storage backend config
• DBy submitting an unseal key share

A script already has a valid Vault token. What is the best interpretation of that situation?

• AThe script must still complete OIDC login before every request
• BThe script can present the token directly instead of running a fresh login flow
• CThe token can only be used in the UI, not the CLI or API
• DThe token cannot authorize any request unless it is a root token

Which command enables the AppRole auth method from the CLI?

• Avault auth enable approle
• Bvault token create approle
• Cvault operator init approle
• Dvault write sys/leases/approle

Why might a team mount an auth method at a custom path instead of the default path?

• ATo create separate login endpoints for different use cases or configurations
• BTo make the auth method ignore policies
• CTo avoid issuing tokens
• DTo convert the auth method into a secrets engine

Where are authentication methods mounted in Vault?

• AUnder the auth/ path
• BOnly inside the identity/ path
• CInside the storage backend
• DUnder the transit/ path

Which statement about configuring auth methods by CLI, API, and UI is correct?

• AOnly the UI can enable auth methods
• BOnly the API can configure auth methods
• CCLI, API, and UI are all valid ways to manage auth methods
• DAuth methods can only be configured before Vault is initialized

An operator enables the same auth type at two different mount paths. What is the best explanation?

• AVault does not allow that design
• BEach mount can carry its own configuration and can serve a different audience
• CThe second mount automatically becomes a storage backend
• DBoth mounts share a single root token and nothing else

Why are Vault policies valuable in day-to-day operations?

• AThey implement least-privilege access
• BThey generate unseal key shares
• CThey replace authentication methods
• DThey choose the storage backend

What do Vault policies control?

• AWhich disk Vault writes to
• BWhat actions a token can take on specific paths
• CHow many unseal keys are created
• DWhether replication is enabled

How does Vault behave when no policy grants access to a requested path?

• AVault allows the request by default
• BVault reads the secret but hides half the fields
• CVault denies the request
• DVault converts the request into a list operation

Why is it helpful that policies are separate from authentication methods?

• ABecause the same authorization rules can be reused across different login methods
• BBecause policies can then issue root tokens
• CBecause auth methods cannot create tokens unless policies are embedded in them
• DBecause policies become storage backends automatically

A security lead says, "We want identity proofing and access rules to be managed separately." Which Vault design principle supports that goal?

• AMount all secrets engines at the same path
• BUse policies for authorization and auth methods for identity verification
• CUse only root tokens for administrators
• DStore policies in the storage backend manually

In a Vault policy, what does the path stanza identify?

• AThe exact or pattern-matched Vault path the rule applies to
• BThe TLS certificate file on disk
• CThe storage backend directory
• DThe IP address of the client

When writing a policy for KV v2 data reads, which path style is generally required?

• AUse the mount name only, such as kv/
• BUse the underlying data path, such as kv/data/app/config
• CUse auth/kv/login/app
• DUse the UI URL copied from the browser

What is the best description of a policy path ending in *?

• AIt always matches exactly one segment only
• BIt is a wildcard-style pattern used to match a path prefix
• CIt turns the policy into a root policy
• DIt forces the request to use the UI only

Which item should NOT appear in a Vault policy path?

• AThe mount path
• BThe secret path
• CAn API hostname such as https://vault.example.com
• DA data segment for KV v2 when needed

A team uses a KV v2 engine mounted at secret/. They need read access only for entries under team-a. Which policy path is the best fit?

• Asecret/team-a/*
• Bsecret/data/team-a/*
• Cauth/secret/team-a/*
• Dsys/data/team-a/*

Which capability is required to read a secret value from an allowed path?

• Alist
• Bread
• Csudo
• Ddeny

Which capability is needed to enumerate keys under a path?

• Alist
• Bpatch
• Cread
• Ddeny

A path already exists and an operator must modify the data at that path. Which capability is most directly associated with that action?

• Aupdate
• Blist
• Csudo
• Ddeny

How does Vault handle an explicit deny when another policy also allows the same path?

• AAllow wins because the token already authenticated
• BDeny wins over the allow
• CVault ignores both entries and falls back to root access
• DVault converts the request to read-only

A token should be able to view existing secrets under a folder and also read individual values, but it must not write anything. Which capability set is the best fit?

• Acreate and update
• Blist and read
• Cdelete and sudo
• Dpatch and update

An application needs to fetch database credentials from database/creds/payments and nothing else. Which policy is the best match?

• AA policy granting read on database/creds/payments
• BA policy granting sudo on sys/*
• CA policy granting read on secret/*
• DA policy granting create on auth/token/*

A compliance team needs to browse which keys exist under a security path and read them, but must never modify or delete them. Which policy is most appropriate?

• Aread and list on the required path
• Bcreate and update on the required path
• Csudo on sys/*
• Ddeny on all paths