Free Preparation Discussions
MENU
HashiCorp Vault-Associate Exam Questions
- Topic 1: Describe Shamir secret sharing and unsealing/ Differentiate between service and batch tokens. Choose one based on use-case
- Topic 2: Differentiate human vs. system auth methods/ Choose an authentication method based on use case
- Topic 3: Compare and configure Vault secrets engines/ Contrast dynamic secrets vs. static secrets and their use cases
- Topic 4: Describe root token uses and lifecycle/ Craft a Vault policy based on requirements
- Topic 5: Be aware of identities and groups/ Explain the value of short-lived, dynamically generated secrets
- Topic 6: Configure authentication methods/ Describe Vault policy syntax: capabilities
- Topic 7: Configure authentication methods/ Describe the encryption of data stored by Vault
- Topic 8: Configure Vault policies/ Access Vault secrets via Curl/ Explain Vault architecture
- Topic 9: Describe authentication methods/ Illustrate the value of Vault policy
- Topic 10: Choose a secret method based on use case/ Explain the purpose of a lease ID
Free HashiCorp Vault-Associate Exam Actual Questions
Note: Premium Questions for Vault-Associate were last updated On May. 15, 2026 (see below)
Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?
The command that does not meet the security requirement of not having secrets appear in the shell history is B. vault kv put secret/password value-itsasecret. This command would store the secret value ''itsasecret'' in the key/value secrets engine at the path secret/password, but it would also expose the secret value in the shell history, which could be accessed by other users or malicious actors. This is not a secure way of storing secrets in Vault.
The other commands are more secure ways of storing secrets in Vault without revealing them in the shell history. A. generate-password | vault kv put secret/password value would use a pipe to pass the output of the generate-password command, which could be a script or a tool that generates a random password, to the vault kv put command, which would store the password in the key/value secrets engine at the path secret/password. The password would not be visible in the shell history, only the commands. C. vault kv put secret/password value=@data.txt would use the @ syntax to read the secret value from a file named data.txt, which could be encrypted or protected by file permissions, and store it in the key/value secrets engine at the path secret/password. The file name would be visible in the shell history, but not the secret value. D. vault kv put secret/password value-SSECRET_VALUE would use the -S syntax to read the secret value from the environment variable SECRET_VALUE, which could be set and unset in the shell session, and store it in the key/value secrets engine at the path secret/password. The environment variable name would be visible in the shell history, but not the secret value.
[Write Secrets | Vault | HashiCorp Developer]
A user issues the following cURL command to encrypt data using the transit engine and the Vault AP:
Which payload.json file has the correct contents?
A.
B.
C.
D.
The payload.json file that has the correct contents is C. This file contains a JSON object with a single key, ''plaintext'', and a value that is the base64-encoded string of the data to be encrypted.This is the format that the Vault API expects for the transit encrypt endpoint1. The other files are not correct because they either have the wrong key name, the wrong value format, or the wrong JSON syntax.
Encrypt Data - Transit Secrets Engine | Vault | HashiCorp Developer
Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?
The command that does not meet the security requirement of not having secrets appear in the shell history is B. vault kv put secret/password value-itsasecret. This command would store the secret value ''itsasecret'' in the key/value secrets engine at the path secret/password, but it would also expose the secret value in the shell history, which could be accessed by other users or malicious actors. This is not a secure way of storing secrets in Vault.
The other commands are more secure ways of storing secrets in Vault without revealing them in the shell history. A. generate-password | vault kv put secret/password value would use a pipe to pass the output of the generate-password command, which could be a script or a tool that generates a random password, to the vault kv put command, which would store the password in the key/value secrets engine at the path secret/password. The password would not be visible in the shell history, only the commands. C. vault kv put secret/password value=@data.txt would use the @ syntax to read the secret value from a file named data.txt, which could be encrypted or protected by file permissions, and store it in the key/value secrets engine at the path secret/password. The file name would be visible in the shell history, but not the secret value. D. vault kv put secret/password value-SSECRET_VALUE would use the -S syntax to read the secret value from the environment variable SECRET_VALUE, which could be set and unset in the shell session, and store it in the key/value secrets engine at the path secret/password. The environment variable name would be visible in the shell history, but not the secret value.
[Write Secrets | Vault | HashiCorp Developer]
When looking at Vault token details, which key helps you find the paths the token is able to access?
When looking at Vault token details, the policies key helps you find the paths the token is able to access. Policies are a declarative way to grant or forbid access to certain paths and operations in Vault. Policies are written in HCL or JSON and are attached to tokens by name. Policies are deny by default, so an empty policy grants no permission in the system. A token can have one or more policies associated with it, and the effective policy is the union of all the individual policies. You can view the token details by using the vault token lookup command or the auth/token/lookup API endpoint. The output will show the policies key with a list of policy names that are attached to the token. You can also view the contents of a policy by using the vault policy read command or the sys/policy API endpoint. The output will show the rules key with the HCL or JSON representation of the policy.The rules will specify the paths and the capabilities (such as create, read, update, delete, list, etc.) that the policy allows or denies.Reference: https://developer.hashicorp.com/vault/docs/concepts/policies4, https://developer.hashicorp.com/vault/docs/commands/token/lookup5, https://developer.hashicorp.com/vault/api-docs/auth/token#lookup-a-token6, https://developer.hashicorp.com/vault/docs/commands/policy/read7, https://developer.hashicorp.com/vault/api-docs/system/policy8
An authentication method should be selected for a use case based on:
An authentication method should be selected for a use case based on the auth method that best establishes the identity of the client. The identity of the client is the basis for assigning a set of policies and permissions to the client in Vault. Different auth methods have different ways of verifying the identity of the client, such as using passwords, tokens, certificates, cloud credentials, etc. Depending on the use case, some auth methods may be more suitable or convenient than others. For example, for human users, the userpass or ldap auth methods may be easy to use, while for machines or applications, the approle or aws auth methods may be more secure and scalable. The choice of the auth method should also consider the trade-offs between security, performance, and usability.Reference:Auth Methods | Vault | HashiCorp Developer,Authentication - Concepts | Vault | HashiCorp Developer
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Kimberly Ramirez
9 days agoJustin Collins
23 days agoJessica Campbell
13 days agoAnthony Hall
15 days agoJoseph Brown
17 days agoDaniel Reed
11 days agoMichelle Hill
19 days agoLatosha
1 month agoGarry
2 months agoMatt
2 months agoKattie
2 months agoAdela
2 months agoBlondell
3 months agoKerry
3 months agoStephaine
3 months agoMarya
3 months agoElinore
4 months agoTayna
4 months agoJennie
4 months agoTamar
4 months agoDierdre
5 months agoArthur
5 months agoMica
5 months agoCatrice
6 months agoBong
6 months agoPeggy
6 months agoGearldine
6 months agoLanie
6 months agoKrystal
7 months agoLemuel
7 months agoNoe
7 months agoLashandra
8 months agoPercy
8 months agoChantell
8 months agoCordell
8 months agoPamella
10 months agoEmiko
11 months agoIvette
1 year agoSabina
1 year agoAntione
1 year agoBarney
1 year agoLindy
1 year agoOlive
1 year agoCarlee
1 year agoMarshall
1 year agoAvery
1 year agoWillard
1 year agoLaticia
2 years agoAvery
2 years agoRutha
2 years agoSylvia
2 years agoBette
2 years agoBeatriz
2 years agoJosephine
2 years agoFranchesca
2 years agoElbert
2 years agoYuette
2 years agoWalton
2 years agoMammie
2 years agoLatonia
2 years agoLashaunda
2 years agoBeatriz
2 years agoCassi
2 years agoCordelia
2 years agoMalinda
2 years agoMalcom
2 years ago