Free Preparation Discussions
MENU
HashiCorp Vault-Associate Exam Questions
- Topic 1: Describe Shamir secret sharing and unsealing/ Differentiate between service and batch tokens. Choose one based on use-case
- Topic 2: Differentiate human vs. system auth methods/ Choose an authentication method based on use case
- Topic 3: Compare and configure Vault secrets engines/ Contrast dynamic secrets vs. static secrets and their use cases
- Topic 4: Describe root token uses and lifecycle/ Craft a Vault policy based on requirements
- Topic 5: Be aware of identities and groups/ Explain the value of short-lived, dynamically generated secrets
- Topic 6: Configure authentication methods/ Describe Vault policy syntax: capabilities
- Topic 7: Configure authentication methods/ Describe the encryption of data stored by Vault
- Topic 8: Configure Vault policies/ Access Vault secrets via Curl/ Explain Vault architecture
- Topic 9: Describe authentication methods/ Illustrate the value of Vault policy
- Topic 10: Choose a secret method based on use case/ Explain the purpose of a lease ID
Free HashiCorp Vault-Associate Exam Actual Questions
Note: Premium Questions for Vault-Associate were last updated On Jul. 10, 2026 (see below)
An authentication method should be selected for a use case based on:
An authentication method should be selected for a use case based on the auth method that best establishes the identity of the client. The identity of the client is the basis for assigning a set of policies and permissions to the client in Vault. Different auth methods have different ways of verifying the identity of the client, such as using passwords, tokens, certificates, cloud credentials, etc. Depending on the use case, some auth methods may be more suitable or convenient than others. For example, for human users, the userpass or ldap auth methods may be easy to use, while for machines or applications, the approle or aws auth methods may be more secure and scalable. The choice of the auth method should also consider the trade-offs between security, performance, and usability.Reference:Auth Methods | Vault | HashiCorp Developer,Authentication - Concepts | Vault | HashiCorp Developer
Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?
The command that does not meet the security requirement of not having secrets appear in the shell history is B. vault kv put secret/password value-itsasecret. This command would store the secret value ''itsasecret'' in the key/value secrets engine at the path secret/password, but it would also expose the secret value in the shell history, which could be accessed by other users or malicious actors. This is not a secure way of storing secrets in Vault.
The other commands are more secure ways of storing secrets in Vault without revealing them in the shell history. A. generate-password | vault kv put secret/password value would use a pipe to pass the output of the generate-password command, which could be a script or a tool that generates a random password, to the vault kv put command, which would store the password in the key/value secrets engine at the path secret/password. The password would not be visible in the shell history, only the commands. C. vault kv put secret/password value=@data.txt would use the @ syntax to read the secret value from a file named data.txt, which could be encrypted or protected by file permissions, and store it in the key/value secrets engine at the path secret/password. The file name would be visible in the shell history, but not the secret value. D. vault kv put secret/password value-SSECRET_VALUE would use the -S syntax to read the secret value from the environment variable SECRET_VALUE, which could be set and unset in the shell session, and store it in the key/value secrets engine at the path secret/password. The environment variable name would be visible in the shell history, but not the secret value.
[Write Secrets | Vault | HashiCorp Developer]
A user issues the following cURL command to encrypt data using the transit engine and the Vault AP:
Which payload.json file has the correct contents?
A.
B.
C.
D.
The payload.json file that has the correct contents is C. This file contains a JSON object with a single key, ''plaintext'', and a value that is the base64-encoded string of the data to be encrypted.This is the format that the Vault API expects for the transit encrypt endpoint1. The other files are not correct because they either have the wrong key name, the wrong value format, or the wrong JSON syntax.
Encrypt Data - Transit Secrets Engine | Vault | HashiCorp Developer
Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?
The command that does not meet the security requirement of not having secrets appear in the shell history is B. vault kv put secret/password value-itsasecret. This command would store the secret value ''itsasecret'' in the key/value secrets engine at the path secret/password, but it would also expose the secret value in the shell history, which could be accessed by other users or malicious actors. This is not a secure way of storing secrets in Vault.
The other commands are more secure ways of storing secrets in Vault without revealing them in the shell history. A. generate-password | vault kv put secret/password value would use a pipe to pass the output of the generate-password command, which could be a script or a tool that generates a random password, to the vault kv put command, which would store the password in the key/value secrets engine at the path secret/password. The password would not be visible in the shell history, only the commands. C. vault kv put secret/password value=@data.txt would use the @ syntax to read the secret value from a file named data.txt, which could be encrypted or protected by file permissions, and store it in the key/value secrets engine at the path secret/password. The file name would be visible in the shell history, but not the secret value. D. vault kv put secret/password value-SSECRET_VALUE would use the -S syntax to read the secret value from the environment variable SECRET_VALUE, which could be set and unset in the shell session, and store it in the key/value secrets engine at the path secret/password. The environment variable name would be visible in the shell history, but not the secret value.
[Write Secrets | Vault | HashiCorp Developer]
A user issues the following cURL command to encrypt data using the transit engine and the Vault AP:
Which payload.json file has the correct contents?
A.
B.
C.
D.
The payload.json file that has the correct contents is C. This file contains a JSON object with a single key, ''plaintext'', and a value that is the base64-encoded string of the data to be encrypted.This is the format that the Vault API expects for the transit encrypt endpoint1. The other files are not correct because they either have the wrong key name, the wrong value format, or the wrong JSON syntax.
Encrypt Data - Transit Secrets Engine | Vault | HashiCorp Developer
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Ryan Bell
12 days agoMaria Rogers
16 days agoElizabeth Rodriguez
1 month agoGerald Jones
2 months agoKimberly Ramirez
2 months agoJustin Collins
3 months agoJessica Campbell
2 months agoAnthony Hall
3 months agoJoseph Brown
3 months agoDaniel Reed
2 months agoMichelle Hill
3 months agoLatosha
3 months agoGarry
4 months agoMatt
4 months agoKattie
4 months agoAdela
4 months agoBlondell
5 months agoKerry
5 months agoStephaine
5 months agoMarya
5 months agoElinore
6 months agoTayna
6 months agoJennie
6 months agoTamar
6 months agoDierdre
7 months agoArthur
7 months agoMica
7 months agoCatrice
8 months agoBong
8 months agoPeggy
8 months agoGearldine
8 months agoLanie
9 months agoKrystal
9 months agoLemuel
9 months agoNoe
9 months agoLashandra
10 months agoPercy
10 months agoChantell
10 months agoCordell
10 months agoPamella
1 year agoEmiko
1 year agoIvette
1 year agoSabina
1 year agoAntione
1 year agoBarney
1 year agoLindy
2 years agoOlive
2 years agoCarlee
2 years agoMarshall
2 years agoAvery
2 years agoWillard
2 years agoLaticia
2 years agoAvery
2 years agoRutha
2 years agoSylvia
2 years agoBette
2 years agoBeatriz
2 years agoJosephine
2 years agoFranchesca
2 years agoElbert
2 years agoYuette
2 years agoWalton
2 years agoMammie
2 years agoLatonia
2 years agoLashaunda
2 years agoBeatriz
2 years agoCassi
2 years agoCordelia
2 years agoMalinda
2 years agoMalcom
2 years ago