Vault-Associate Exam Questions and Answers

QUESTION: 11

Which is not a capability that can be used when writing a Vault policy?

read
list
delete
create
modify
update

Answer(s): E

Explanation:

When writing a Vault policy, permissions which can be applied to paths include create, read, update, delete, list, deny, and sudo.

Reference:

https://www.vaultproject.io/docs/concepts/policies
Modify is not one of them.

Reveal Solution Next Question

QUESTION: 12

Which is not a benefit of running HashiCorp Vault in your environment?

Integrate with your code repository to pull secrets when deploying your applications
Consolidate static, long-lived passwords used throughout your organization
Act as root or intermediate certificate authority to automate the generation of PKI certificates
The ability to generate dynamic secrets for applications and resource access

Answer(s): A

Explanation:

Vault does not integrate with any VCS (Version Control System) to checkout or read code. However, It can use GitHub as an auth method.

Reveal Solution Next Question

QUESTION: 13

Which of the following settings are configured using the configuration file? (select three)

Cluster Name
Replication
Seal Type
Auth Methods
Namespaces
Storage Backend
Audit Devices

Answer(s): A,C,F

Explanation:

Seal types, Storage backends, and cluster names are just a few of the configurations done via the configuration file. The others are configured within Vault itself.

Reveal Solution Next Question

QUESTION: 14

Vault's User Interface (UI) needs to be enabled in the command line before it can be used.

FALSE
TRUE

Answer(s): A

Explanation:

The UI is enabled in the Vault configuration file, not in the CLI.

Reveal Solution Next Question

QUESTION: 15

Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (select four)

Transit
HSM
AWS KMS
Key Shards
Azure KMS

Answer(s): A,B,C,E

Explanation:

When a Vault server is started, it starts in a sealed state and it does not know how to decrypt data. Before any operation can be performed on the Vault, it must be unsealed. Unsealing is the process of constructing the master key necessary to decrypt the data encryption key. Below are links covering details of each option:- https://www.vaultproject.io/docs/concepts/seal AWS KMS
https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms Auto-unseal using Transit Secrets Engine
https://learn.hashicorp.com/vault/operations/autounseal-transit
Auto-unseal using Azure Key Vault
https://learn.hashicorp.com/vault/day-one/autounseal-azure-keyvault Auto-unseal using HSM
https://learn.hashicorp.com/vault/operations/ops-seal-wrap Key shards don't support auto unseal instead key shards require the user to provide unseal keys to reconstruct the master key
https://www.vaultproject.io/docs/concepts/seal

Reveal Solution Next Question

HashiCorp Vault-Associate Exam (page: 3) HashiCorp Certified: Vault Associate (002) Updated on: 25-Dec-2025

QUESTION: 11

Explanation:

Reference:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

HashiCorp Vault-Associate Exam (page: 3)
HashiCorp Certified: Vault Associate (002)
Updated on: 25-Dec-2025