Free Preparation Discussions
MENU
HashiCorp Vault-Associate Exam Questions
- Topic 1: Describe Shamir secret sharing and unsealing/ Differentiate between service and batch tokens. Choose one based on use-case
- Topic 2: Differentiate human vs. system auth methods/ Choose an authentication method based on use case
- Topic 3: Compare and configure Vault secrets engines/ Contrast dynamic secrets vs. static secrets and their use cases
- Topic 4: Describe root token uses and lifecycle/ Craft a Vault policy based on requirements
- Topic 5: Be aware of identities and groups/ Explain the value of short-lived, dynamically generated secrets
- Topic 6: Configure authentication methods/ Describe Vault policy syntax: capabilities
- Topic 7: Configure authentication methods/ Describe the encryption of data stored by Vault
- Topic 8: Configure Vault policies/ Access Vault secrets via Curl/ Explain Vault architecture
- Topic 9: Describe authentication methods/ Illustrate the value of Vault policy
- Topic 10: Choose a secret method based on use case/ Explain the purpose of a lease ID
Free HashiCorp Vault-Associate Exam Actual Questions
Note: Premium Questions for Vault-Associate were last updated On Oct. 05, 2025 (see below)
You are using the Vault userpass auth method mounted at auth/userpass. How do you create a new user named "sally" with password "h0wN0wB4r0wnC0w"? This new user will need the power-users policy.
A.
B.
C.
D.
To create a new user named ''sally'' with password ''h0wN0wB4r0wnC0w'' and the power-users policy, you would use the Vault userpass auth method mounted at auth/userpass. You would use the following command: ''vault write auth/userpass/users/sally password=h0wN0wB4r0wnC0w policies=power-users''. This command would create a new user named ''sally'' with the specified password and policy.Reference:
[Userpass Auth Method | Vault | HashiCorp Developer]
[Create Vault policies | Vault | HashiCorp Developer]
A developer mistakenly committed code that contained AWS S3 credentials into a public repository. You have been tasked with revoking the AWS S3 credential that was in the code. This credential was created using Vault's AWS secrets engine and the developer received the following output when requesting a credential from Vault.
Which Vault command will revoke the lease and remove the credential from AWS?
You are using the Vault userpass auth method mounted at auth/userpass. How do you create a new user named "sally" with password "h0wN0wB4r0wnC0w"? This new user will need the power-users policy.
A.
B.
C.
D.
To create a new user named ''sally'' with password ''h0wN0wB4r0wnC0w'' and the power-users policy, you would use the Vault userpass auth method mounted at auth/userpass. You would use the following command: ''vault write auth/userpass/users/sally password=h0wN0wB4r0wnC0w policies=power-users''. This command would create a new user named ''sally'' with the specified password and policy.Reference:
[Userpass Auth Method | Vault | HashiCorp Developer]
[Create Vault policies | Vault | HashiCorp Developer]
Which of the following statements are true about Vault policies? Choose two correct answers.
Vault does not need to be restarted in order for a policy change to take effect, as policies are stored and evaluated in memory. Any change to a policy is immediately reflected in the system, and any token or role that has that policy attached will be affected by the change.
Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?
The command that does not meet the security requirement of not having secrets appear in the shell history is B. vault kv put secret/password value-itsasecret. This command would store the secret value ''itsasecret'' in the key/value secrets engine at the path secret/password, but it would also expose the secret value in the shell history, which could be accessed by other users or malicious actors. This is not a secure way of storing secrets in Vault.
The other commands are more secure ways of storing secrets in Vault without revealing them in the shell history. A. generate-password | vault kv put secret/password value would use a pipe to pass the output of the generate-password command, which could be a script or a tool that generates a random password, to the vault kv put command, which would store the password in the key/value secrets engine at the path secret/password. The password would not be visible in the shell history, only the commands. C. vault kv put secret/password value=@data.txt would use the @ syntax to read the secret value from a file named data.txt, which could be encrypted or protected by file permissions, and store it in the key/value secrets engine at the path secret/password. The file name would be visible in the shell history, but not the secret value. D. vault kv put secret/password value-SSECRET_VALUE would use the -S syntax to read the secret value from the environment variable SECRET_VALUE, which could be set and unset in the shell session, and store it in the key/value secrets engine at the path secret/password. The environment variable name would be visible in the shell history, but not the secret value.
[Write Secrets | Vault | HashiCorp Developer]
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Noe
2 days agoPercy
6 days agoLashandra
6 days agoChantell
1 months agoCordell
1 months agoPamella
3 months agoEmiko
4 months agoIvette
6 months agoSabina
7 months agoAntione
8 months agoBarney
9 months agoLindy
9 months agoOlive
10 months agoCarlee
10 months agoMarshall
10 months agoAvery
11 months agoWillard
11 months agoLaticia
11 months agoAvery
12 months agoRutha
12 months agoSylvia
1 years agoBette
1 years agoBeatriz
1 years agoJosephine
1 years agoFranchesca
1 years agoElbert
1 years agoYuette
1 years agoWalton
1 years agoMammie
1 years agoLatonia
1 years agoLashaunda
1 years agoBeatriz
1 years agoCassi
1 years agoCordelia
1 years agoMalinda
1 years agoMalcom
2 years ago