HCVA0-003 Exam Questions and Answers

QUESTION: 46 Exam Topic: 1, Exam Pool A

What could you do with the feature found in the screenshot below (select two)?

Using a short TTL, you could encrypt data in order to place only the encrypted data in Vault
Encrypt the Vault master key that is stored in memory
Encrypt sensitive data to send to a colleague over email
Use response-wrapping to protect data

Answer(s): C,D

Explanation:

Comprehensive and Detailed in Depth
The screenshot highlights Vault's response wrapping feature, accessible via the UI's "Wrap" option.

This feature wraps a Vault response (e.g., a secret or token) in a single-use token with a configurable TTL, ensuring secure delivery to an intended recipient. Let's evaluate each option against this capability:
Option A: Using a short TTL, you could encrypt data in order to place only the encrypted data in Vault This misinterprets response wrapping. Wrapping doesn't encrypt data for storage in Vault; it secures a response for transmission outside Vault. Encryption for storage would involve the Transit secrets engine, not wrapping. The TTL in wrapping limits the wrapped token's validity, not the data's encryption lifecycle. This option conflates two unrelated features and is incorrect. Vault Docs Insight: "Response wrapping does not store data in Vault; it delivers it securely to a recipient." (No direct storage implication.)
Option B: Encrypt the Vault master key that is stored in memory The master key in Vault is already encrypted at rest (in storage) and decrypted in memory during operation using the unseal process (e.g., Shamir shares or auto-unseal). Response wrapping doesn't interact with the master key--it's a client-facing feature for secret delivery, not an internal encryption mechanism. This is a fundamental misunderstanding of Vault's architecture and wrapping's purpose. Incorrect.
Vault Docs Insight: "The master key is managed by the seal mechanism, not client-facing features like wrapping." (See seal/unseal docs.)
Option C: Encrypt sensitive data to send to a colleague over email This aligns perfectly with response wrapping. You can retrieve a secret (e.g., vault read secret/data/my-secret), wrap it with a short TTL (e.g., 5 minutes), and receive a token (e.g., hvs.<token>). You email this token to a colleague, who unwraps it with vault unwrap <token> to access the secret. The data is encrypted within the token, secure during transit, and expires after the TTL. This is a textbook use case for wrapping. Correct. Vault Docs Insight: "Response wrapping... can be used to securely send sensitive data to another party, such as over email, with a limited lifetime." (Directly supported use case.) Option D: Use response-wrapping to protect data
This is the essence of the feature. Wrapping protects data by encapsulating it in a single-use token, accessible only via an unwrap operation. For example, vault write -wrap-ttl=60s secret/data/my- secret returns a wrapped token, protecting the secret until unwrapped. This ensures confidentiality and controlled access, making it a core benefit of the feature. Correct. Vault Docs Insight: "Vault can wrap a response in a single-use token... protecting the data until unwrapped by the recipient." (Core definition.)
Detailed Mechanics:
Response wrapping works by taking a Vault API response (e.g., a secret's JSON payload) and storing it in the cubbyhole secrets engine under a newly generated single-use token. The token's TTL (e.g., 60s) limits its validity. The API call POST /v1/sys/wrapping/wrap with a payload (e.g., {"ttl": "60s", "data": {"key": "value"}}) returns {"wrap_info": {"token": "hvs.<token>"}}. The recipient uses vault unwrap hvs.<token> (or POST /v1/sys/wrapping/unwrap) to retrieve the original data. Once unwrapped, the token is revoked, ensuring one-time use. This leverages Vault's encryption and token system for secure data exchange.
Real-World Example:
You generate an API key in Vault: vault write secret/data/api key=abc123. In the UI, you click "Wrap" with a 5-minute TTL, getting hvs.XYZ. You email hvs.XYZ to a colleague, who runs vault unwrap hvs.XYZ within 5 minutes to get key=abc123. After unwrapping, the token is invalid, and the secret is safe from interception.
Overall Explanation from Vault Docs:
"Vault includes a feature called response wrapping.
When requested, Vault can take the response it would have sent to an HTTP client and instead insert it into the cubbyhole of a single-use token, returning that token instead... This is useful for securely delivering sensitive data." The feature excels at protecting data in transit (e.g., email) and enforcing one-time access, not internal key management or storage encryption.

Reference:

https://developer.hashicorp.com/vault/docs/concepts/response-wrapping Additional

https://developer.hashicorp.com/vault/docs/secrets/cubbyhole

Reveal Solution Next Question

QUESTION: 47 Exam Topic: 1, Exam Pool A

From the options below, select the benefits of using the PKI (x.509 certificates) secrets engine (select three):

TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time
Reducing, or eliminating certificate revocations
Reduces time to get a certificate by eliminating the need to generate a private key and CSR
Vault can act as an intermediate CA

Answer(s): B,C,D

Explanation:

Comprehensive and Detailed in Depth
The PKI secrets engine in Vault generates dynamic X.509 certificates, acting as a certificate authority (CA) to streamline certificate management. Let's assess each option based on its documented benefits:
Option A: TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time This is misleading. Vault's PKI engine allows configurable TTLs, but the recommendation is for short TTLs (e.g., hours or days) to reduce the need for revocation and enhance security. Long TTLs increase exposure if a certificate is compromised, requiring revocation and larger Certificate Revocation Lists (CRLs). The engine's benefit isn't longer validity--it's flexibility and automation, not extended lifetimes. Incorrect.
Vault Docs Insight: "By keeping TTLs relatively short, revocations are less likely... helping scale to large workloads." (Short TTLs are preferred.)
Option B: Reducing, or eliminating certificate revocations A key advantage of the PKI engine is issuing short-lived certificates. With short TTLs (e.g., 24h), certificates expire naturally before revocation is needed, minimizing CRL maintenance. For example, an app can fetch a new cert daily, reducing revocation events compared to traditional multi-year certs. This aligns with Vault's ephemeral certificate model. Correct. Vault Docs Insight: "By keeping TTLs relatively short, revocations are less likely to be needed, keeping CRLs short..." (Direct benefit.)
Option C: Reduces time to get a certificate by eliminating the need to generate a private key and CSR Traditionally, obtaining a certificate involves generating a private key, creating a Certificate Signing Request (CSR), and submitting it to a CA--a manual, time-consuming process. The PKI engine automates this: vault write pki/issue/my-role common_name=app.example.com instantly generates a private key and signed certificate. This eliminates manual steps, speeding up issuance significantly.
Correct.
Vault Docs Insight: "Services can get certificates without... generating a private key and CSR, submitting to a CA, and waiting..." (Automation reduces time.)

Option D: Vault can act as an intermediate CA
The PKI engine can be configured as an intermediate CA, signed by a root CA (internal or external). For example, vault write pki/intermediate/generate/internal common_name="Intermediate CA" creates an intermediate, which can issue certificates under a trust chain. This supports hierarchical PKI setups, a major feature. Correct.
Vault Docs Insight: "The PKI secrets engine can act as an intermediate CA... issuing certificates on behalf of a root CA." (Explicit capability.)
Detailed Mechanics:
The PKI engine operates at paths like pki/ (root) or pki_int/ (intermediate). Roles (e.g., my-role) define parameters like TTL and allowed domains. Issuing a cert (vault write pki/issue/my-role...) returns a JSON payload with certificate, private_key, and issuing_ca. Short TTLs leverage Vault's lease system, auto-revoking certs on expiry. As an intermediate CA, it signs certificates with its key,

validated against a root, enhancing trust management.
Real-World Example:
An app needs a cert: vault write pki/issue/web common_name=web.example.com ttl=24h. Vault returns a cert and key instantly, valid for 24 hours. No CSR, no revocation needed--expires tomorrow. Another PKI mount at pki_int/ issues certs under a corporate root CA.
Overall Explanation from Vault Docs:
"The PKI secrets engine generates dynamic X.509 certificates... Services can get certificates without the usual manual process... By keeping TTLs short, revocations are less likely... Vault can act as an intermediate CA, issuing certificates efficiently." These benefits--automation, reduced revocation, and CA flexibility--define its value.

Reference:

https://developer.hashicorp.com/vault/docs/secrets/pki

Reveal Solution Next Question

QUESTION: 48 Exam Topic: 1, Exam Pool A

According to the screenshot below, what auth method did this client use to log in to Vault? (Screenshot shows a lease path: auth/userpass/login/student01)

Userpass
Auth
Root token
Child token

Answer(s): A

Explanation:

Comprehensive and Detailed in Depth
The screenshot provides a lease path: auth/userpass/login/student01, which reveals the authentication method used to generate the token tied to this lease. Vault's auth methods create tokens at specific paths, and the path structure indicates the method.
Option A: Userpass
The path auth/userpass/login/student01 explicitly includes userpass, matching the userpass auth method. This method authenticates users with a username (e.g., student01) and password, typically via vault login -method=userpass username=student01. The /login endpoint confirms a login operation, and the lease ties to the resulting token. This is the clear, correct answer based on the path. Correct.

Vault Docs Insight: "The userpass auth method allows users to authenticate with a username and password... mounted at auth/userpass by default." (Matches the path.) Option B: Auth
"Auth" isn't an auth method--it's the namespace prefix (auth/) for all auth methods in Vault (e.g., auth/token, auth/userpass). The screenshot specifies userpass within auth/, not a generic "auth" method. This option is a misnomer and incorrect.
Vault Docs Insight: "All auth methods are mounted under auth/... `auth' itself is not a method." (Clarifies structure.)
Option C: Root token
A root token is a privileged token type, not an auth method. It's created during Vault initialization or via auth/token/create with root privileges, not through a login path like auth/userpass/login. The screenshot's path indicates a userpass login, not a root token usage. Incorrect.

Vault Docs Insight: "Root tokens are created at initialization... not tied to a specific auth method login path." (Distinct from userpass.)
Option D: Child token
A child token is a token created by a parent token (e.g., via vault token create), not an auth method. The path auth/userpass/login/student01 shows a login event, not a token creation event (which would be auth/token/create). This option confuses token hierarchy with authentication. Incorrect. Vault Docs Insight: "Child tokens are created by parent tokens... not directly via login endpoints." (Different mechanism.)
Detailed Mechanics:
When a user logs in with vault login -method=userpass -path=userpass username=student01, Vault hits the endpoint POST /v1/auth/userpass/login/student01 with a password payload. Success generates a token, and a lease is created at auth/userpass/login/student01 with a TTL. The screenshot's lease path directly reflects this process, pinpointing userpass as the method.
Real-World Example:
Enable userpass: vault auth enable userpass. Add user: vault write auth/userpass/users/student01 password=secret. Login: vault login -method=userpass username=student01. The token's lease appears as auth/userpass/login/student01.
Overall Explanation from Vault Docs:
"The lease shown lives at auth/userpass/login/<username> and indicates the userpass auth method was used to obtain a token... The userpass method authenticates via username/password at its mount path." The path structure is a definitive indicator.

Reference:

https://developer.hashicorp.com/vault/docs/auth/userpass

Reveal Solution Next Question

QUESTION: 49 Exam Topic: 1, Exam Pool A

What is the difference between the TTL and the Max TTL (select two)?

The TTL defines when the token will expire and be revoked
The TTL defines when another token will be generated
The Max TTL defines the timeframe for which a token cannot be used
The Max TTL defines the maximum timeframe for which a token can be renewed

Answer(s): A,D

Explanation:

Comprehensive and Detailed in Depth
Vault tokens have two key time attributes: TTL (Time-To-Live) and Max TTL (Maximum Time-To-Live), governing their lifecycle. Let's dissect each option:
Option A: The TTL defines when the token will expire and be revoked The TTL is the current lifespan of a token before it expires. For example, a token with a TTL of 24h (vault token create -ttl=24h) expires 24 hours from creation unless renewed. Upon expiry, Vault revokes it automatically. This is a fundamental property of TTL, making this statement accurate.
Correct.
Vault Docs Insight: "The TTL defines when the token will expire... if it reaches its TTL, it will be revoked by Vault." (Core definition.)
Option B: The TTL defines when another token will be generated TTL governs expiration, not token generation. New tokens are created explicitly (e.g., vault token create) or via auth methods, not automatically by TTL. This misunderstands TTL's role--it's about expiry, not regeneration. Incorrect.
Vault Docs Insight: "TTL is the duration until expiration... New tokens are not generated by TTL." (No generation link.)
Option C: The Max TTL defines the timeframe for which a token cannot be used This is backwards. Max TTL sets the upper limit a token can exist through renewals, not a period of inactivity or unusability. A token with a Max TTL of 72h can be renewed up to 72 hours from creation, after which it's revoked. This option inverts the concept. Incorrect. Vault Docs Insight: "Max TTL defines the maximum timeframe for which the token can be renewed...
not a usage restriction." (Opposite meaning.)
Option D: The Max TTL defines the maximum timeframe for which a token can be renewed Max TTL caps the total lifespan of a token, including renewals. For example, a token with TTL=24h and Max TTL=72h (vault token create -ttl=24h -explicit-max-ttl=72h) can be renewed twice (24h + 24h + 24h = 72h) before hitting the limit. Beyond 72h, renewal fails, and it expires. This is the precise definition of Max TTL. Correct.
Vault Docs Insight: "The Max TTL defines the maximum timeframe for which the token can be renewed... Once reached, it cannot be renewed further." (Exact match.) Detailed Mechanics:
TTL is dynamic, decreasing as time passes (e.g., vault token lookup shows ttl: 23h59m50s after 10 seconds). Renewal (vault token renew) resets TTL to its original value (e.g., 24h), but only up to Max TTL from creation. System defaults (768h/32 days) apply unless overridden. Periodic tokens (- period=24h) renew indefinitely within their period, ignoring Max TTL unless explicitly set.
Real-World Example:
Create: vault token create -ttl=1h -explicit-max-ttl=3h. After 1h, TTL=0, renewable. Renew at 2h total, TTL=1h again. At 3h total, Max TTL hits--revoked. Contrast with TTL-only: vault token create -ttl=1h, renewable up to system Max TTL (768h).
Overall Explanation from Vault Docs:
"The TTL defines when the token will expire... If it reaches its TTL, it will be immediately revoked by Vault. The Max TTL defines the maximum timeframe for which the token can be renewed... Once the Max TTL is reached, the token cannot be renewed any longer and will be revoked." These attributes ensure controlled token lifecycles.

Reference:

https://developer.hashicorp.com/vault/docs/concepts/tokens#token-time-to-live- periodic-tokens-and-explicit-max-ttls

Reveal Solution Next Question

QUESTION: 50 Exam Topic: 1, Exam Pool A

What is true about the output of the following command (select three)?

The admin never sees all the unseal keys and cannot unseal Vault by themselves
All three users, Jane/John/Student01, will receive all unseal keys and can unseal Vault
The admin will receive the unseal keys and be able to unseal Vault themselves
The keys will be returned encrypted
Each individual can only decrypt their own unseal key using their private PGP key

Answer(s): A,D,E

Explanation:

Comprehensive and Detailed in Depth
The command initializes Vault, splitting the master key into 3 shares (threshold 2) and encrypting each with PGP keys for Jane, John, and Student01. Let's analyze:
Option A: The admin never sees all the unseal keys and cannot unseal Vault by themselves With -pgp-keys, Vault encrypts each share with a user's public PGP key. The admin (initializer) sees only encrypted outputs (e.g., Key 1: <encrypted>), not plaintext keys. Since 2 shares are needed and no single entity gets all, the admin can't unseal alone. Correct. Vault Docs Insight: "The initializer receives encrypted keys... never sees all plaintext keys, enhancing security." (Directly stated.)
Option B: All three users, Jane/John/Student01, will receive all unseal keys and can unseal Vault Each user gets one encrypted share (e.g., Jane gets Key 1, John Key 2). No user receives all shares-- only one, decryptable with their private key. Unsealing requires collaboration (2 of 3), so this is false.
Incorrect.
Vault Docs Insight: "Each PGP key encrypts one share... No single user gets all keys." (Distribution is per-user.)
Option C: The admin will receive the unseal keys and be able to unseal Vault themselves Without PGP, the admin gets plaintext keys. With -pgp-keys, they get encrypted keys they can't decrypt (lacking private keys). Threshold=2 means collaboration is required. Incorrect. Vault Docs Insight: "Using PGP keys ensures the initializer cannot unseal alone..." (Security feature.) Option D: The keys will be returned encrypted
The -pgp-keys flag encrypts each share with the corresponding public key. Output shows encrypted blobs (e.g., base64-encoded PGP ciphertext), not plaintext. Correct. Vault Docs Insight: "Vault will generate the unseal keys and encrypt them using the given PGP keys..." (Explicit behavior.)
Option E: Each individual can only decrypt their own unseal key using their private PGP key Each share is encrypted with one user's public key (e.g., Jane's key encrypts Key 1). Only Jane's private key decrypts it. This ensures secure distribution. Correct. Vault Docs Insight: "Only the owner of the corresponding private key can decrypt the value..." (PGP security.)
Detailed Mechanics:
Command: vault operator init -key-shares=3 -key-threshold=2 -pgp- keys="jane.pgp,john.pgp,student01.pgp". Vault generates 3 shares via Shamir's Secret Sharing, encrypts each (Key 1 with jane.pgp, etc.), and outputs encrypted strings. Unsealing requires 2

decrypted shares combined via vault operator unseal. PGP ensures the admin can't access plaintext, enforcing split knowledge.
Real-World Example:
Output: Key 1: <encrypted-jane>, Key 2: <encrypted-john>, Key 3: <encrypted-student01>. Jane decrypts Key 1 with gpg -d, John decrypts Key 2. They submit via UI or CLI to unseal.
Overall Explanation from Vault Docs:
"Vault can optionally be initialized using PGP keys. In this mode, Vault will generate the unseal keys and immediately encrypt them using the given users' public PGP keys. Only the owner of the corresponding private key is able to decrypt the value... The initializer never sees all plaintext keys and cannot unseal Vault alone." This enhances security by distributing trust.

Reference:

https://developer.hashicorp.com/vault/docs/commands/operator/init#pgp-keys

Reveal Solution Next Question

HashiCorp HCVA0-003 Exam (page: 10) HashiCorp Certified: Vault Associate (003) Updated on: 25-Dec-2025

QUESTION: 46 Exam Topic: 1, Exam Pool A

Explanation:

Reference:

QUESTION: 47 Exam Topic: 1, Exam Pool A

Explanation:

Reference:

QUESTION: 48 Exam Topic: 1, Exam Pool A

Explanation:

Reference:

QUESTION: 49 Exam Topic: 1, Exam Pool A

Explanation:

Reference:

QUESTION: 50 Exam Topic: 1, Exam Pool A

Explanation:

Reference:

HashiCorp HCVA0-003 Exam (page: 10)
HashiCorp Certified: Vault Associate (003)
Updated on: 25-Dec-2025