Unseal Your Vault Knowledge Before Exam Day

Take on 25 practice questions across nine Vault Associate objectives.
Start Free Practice
No Credit Card Required
HOW TO PREPARE

Everything You Need to Know First

Warm-up topics before the test.
  • Basic Terminal Skills: Comfort running commands in a shell, since many questions reference the Vault CLI.
  • Cloud and On-Prem Architecture Basics: General understanding of how infrastructure is deployed across cloud and on-premises environments.
  • Security Fundamentals: Basic understanding of authentication, authorization, encryption, and secrets handling.
PRACTICE TEST

Put Your Knowledge to the Test

25 multiple-choice questions, including ones built around command output
A Kubernetes team wants Vault secrets reconciled into native Kubernetes Secret objects using Vault-specific custom resources such as VaultStaticSecret. Which integration fits?
The Vault Agent Injector sidecar
A root token mounted into every Pod
Vault Secrets Operator
A Kubernetes label containing the secret path
C
Vault Secrets Operator watches its custom resources and keeps Kubernetes Secrets in sync with Vault. The Agent Injector renders secrets into Pod files through a sidecar rather than creating Kubernetes Secrets.
Access management architecture
25
Select One
An application cannot be changed to call the Vault API. It must authenticate to Vault automatically and read secrets from rendered files on disk. Which component fits?
Vault Agent with auto-auth and templates
Vault Proxy with a listener for API requests
The Vault CLI run once at application startup
A token accessor stored in the application's config
A
Vault Agent authenticates automatically, keeps its token renewed, and renders secrets to files with templates. Vault Proxy forwards API calls but does not render templates, and an accessor cannot authenticate.
Access management architecture
24
Select One
A company uses Vault Enterprise replication. Which two statements are correct?
Performance secondary clusters can serve client requests in their own region
Vault Community Edition includes performance and disaster recovery replication
Disaster recovery replication removes the need for regular backups and recovery testing
Disaster recovery secondaries do not serve client requests until they are promoted
A
Performance secondaries serve local clients and keep their own tokens and leases, while DR secondaries stay on standby until promotion. Replication is an Enterprise feature and does not replace backups.
Vault deployment architecture
23
Select Two
D
A small team wants Vault without operating servers, storage, upgrades, or unsealing. HashiCorp should run and maintain the cluster. Which offering fits?
Vault Community Edition on Kubernetes with the official Helm chart
Vault Enterprise with disaster recovery replication to a second site
A Vault server started in dev mode on a managed VM
HCP Vault Dedicated
D
HCP Vault Dedicated is a HashiCorp-managed Vault cluster, so HashiCorp handles infrastructure, upgrades, storage, and unsealing. The other options are self-managed, and dev mode is not for production.
Vault deployment architecture
22
Select One
A production cluster uses Integrated Storage (Raft). According to HashiCorp's reference architecture, how many voting nodes should it have to tolerate the failure of two nodes?
3
5
4
2
B
Raft needs a majority of voters for quorum, so five voters tolerate two failures, and the reference architecture recommends five nodes spread across three availability zones. Three voters tolerate only one failure.
Vault deployment architecture
21
Select One
A Vault cluster uses Shamir seals with 5 key shares and a threshold of 3. How many distinct valid shares are required to unseal it?
1
2
3
5
C
Shamir's secret sharing needs any combination of shares equal to the threshold to reconstruct the root key. The total number of shares only sets how many exist.
Vault architecture fundamentals
20
Select One
True or false: While a Vault server is sealed, it can still serve read requests for secrets that were read recently.
True
False
B
A sealed Vault cannot decrypt anything in its storage, so it answers only status and unseal requests. It must be unsealed before any secret can be read.
Vault architecture fundamentals
19
Select One
A transit key was rotated. The team wants existing ciphertext upgraded to the newest key version, without the client ever receiving the plaintext. Which transit operation does this?
Rewrap
Decrypt followed by encrypt in the application
Rotate the key a second time
Generate a new data key
A
Rewrap re-encrypts ciphertext with the latest key version inside Vault, so plaintext is never returned to the client. Decrypting and re-encrypting in the application exposes plaintext, and rotating again does not update existing ciphertext.
Encryption as a Service
18
Select One
An application must encrypt customer records before storing them in its own database. It must not handle or store encryption keys itself. Which secrets engine fits?
KV version 2, storing each record as a secret
Cubbyhole, storing the key for the application's token
PKI, issuing a certificate for each record
Transit, with Vault holding the key
D
Transit encrypts and decrypts data sent to it using keys that never leave Vault, and it does not store the data. The application stores the returned ciphertext in its own database.
Encryption as a Service
17
Select One
Internal services need short-lived X.509 TLS certificates issued on demand, so that no long-lived certificates need to be distributed. Which secrets engine fits?
Transit
PKI
KV version 2
SSH
B
The PKI secrets engine generates X.509 certificates on demand from a role, and short TTLs reduce the need for revocation. Transit performs cryptographic operations, and the SSH engine signs SSH keys rather than TLS certificates.
Secrets engines
16
Select One
True or false: In KV version 2, vault kv destroy permanently removes the data of the specified versions, and those versions cannot be restored with vault kv undelete.
True
False
A
vault kv delete is a soft delete that undelete can reverse, while vault kv destroy permanently removes the version's data. Deleting the metadata removes all versions and history.
Secrets engines
15
Select One
A KV version 2 secret at secret/app has three versions. A developer needs to read version 2 without changing the current version. Which command does this?
vault kv rollback -version=2 secret/app
vault kv undelete -versions=2 secret/app
vault kv get -version=2 secret/app
vault read secret/app version=2
C
vault kv get -version reads a specific retained version. vault kv rollback writes that data as a new current version, and undelete restores soft-deleted versions.
Secrets engines
14
Select One
Each instance of an application should receive its own short-lived database credentials, which Vault revokes automatically when their lease expires. Which capability fits?
Dynamic credentials from the database secrets engine
A single static password stored in the KV secrets engine
A transit key used to encrypt one shared password
A response-wrapped copy of the root database password
A
The database secrets engine creates unique credentials for each request, attached to a lease, and revokes them when the lease expires or is revoked. A static shared password gives no per-instance credentials.
Secrets engines
13
Select One
A client manages renewable leases for dynamic database credentials. Which two practices are correct?
Treat the lease ID as a token that authenticates other Vault requests
Assume that every requested renewal increment is always granted in full
Schedule renewals based on the lease duration that Vault returns
Handle refused renewals and max TTL limits by requesting new credentials
C
Clients should use the returned lease duration and expect that renewals can be shortened or refused at the max TTL. A lease ID is not a token, requested increments are not guaranteed, and not every secret is renewable.
Vault leases
12
Select Two
D
Credentials issued by the readonly role of a database secrets engine mounted at database/ may have leaked. The team must revoke every credential issued by that role without disabling the secrets engine. Which command does this?
vault secrets disable database
vault token revoke -mode=path auth/database/creds/readonly
vault lease renew database/creds/readonly
vault lease revoke -prefix database/creds/readonly
D
Prefix revocation revokes every lease issued under that path, and the database engine then deletes the credentials. Disabling the engine would also revoke them but removes its configuration, which the requirement rules out.
Vault leases
11
Select One
A service token is created with a TTL of 1 hour and an explicit max TTL of 4 hours. The client renews it every 30 minutes. What happens?
The token stays valid indefinitely because it is renewed before each expiry
The token expires 4 hours after creation, despite further renewals
The token expires after 1 hour because renewals are ignored
Each renewal extends the max TTL by another 4 hours
B
Renewal can extend a token's TTL only up to its max TTL, which is measured from creation. After that, the client must authenticate again to get a new token.
Vault tokens
10
Select One
A high-volume service creates many short-lived tokens that never need to be renewed. The team wants the lightest-weight tokens that are not persisted to storage. Which token type fits?
Service tokens with periodic renewal
Root tokens generated for each request
Batch tokens
Orphan service tokens with a long TTL
C
Batch tokens are encrypted blobs that are not stored, which makes them cheap to create at high volume, but they cannot be renewed. Service tokens are persisted and support renewal, and root tokens should never be issued per request.
Vault tokens
9
Select One
True or false: Revoking a parent token also revokes any orphan token that was created by that parent.
True
False
B
An orphan token has no parent, so revoking the token that created it does not revoke it. The orphan still expires according to its own TTL.
Vault tokens
8
Select One
An administrator must revoke a token but does not have the token's value. The administrator has the token's accessor and the required permissions. Which statement is correct?
The accessor can look up and revoke the token without its value
The accessor can be used in place of the token to authenticate requests
Only the root token can revoke another token, with or without an accessor
Revoking by accessor also revokes every other token that was issued by the same auth method
A
Accessors reference a token for management operations such as lookup, renewal, and revocation, but cannot authenticate requests. Revocation by accessor needs suitable policy permissions, not the root token.
Vault tokens
7
Select One
True or false: A token that has only Vault's built-in default policy, unmodified, can read any secret stored in a KV secrets engine.
True
False
B
The unmodified default policy provides limited capabilities, including token self-management and access to the token's own cubbyhole. It does not grant general read access to application secrets in KV secrets engines. Additional policy permissions are required for those secrets. Administrators can edit the default policy, which is why the question specifies that it is unmodified.
Vault policies
6
Select One
An application must read secrets under app/ on a KV version 2 mount at secret/, and also list the key names under app/. Which two policy rules are required?
path "secret/app/*" with ["read"]
path "secret/data/app/*" with ["read"]
path "secret/data/app/*" with ["list"]
path "secret/metadata/app/*" with ["list"]
B
KV version 2 reads secret data through the data/ path and lists keys through the metadata/ path. Policies written for the logical path without data/ or metadata/ do not match API requests to a KV v2 mount.
Vault policies
5
Select Two
D
A token has only the following policy. It requests a read of secret/data/app/admin on a KV version 2 mount at secret/. What is the result? path "secret/data/app/*" { capabilities = ["read", "list"] } path "secret/data/app/admin" { capabilities = ["deny"] }
The read succeeds, because the glob path grants read on all app secrets
The read succeeds, but only the secret's metadata is returned
Only a list of the path succeeds, because list overrides deny
The read is denied, because the exact path's deny applies
D
When several paths in a policy match a request, Vault uses the highest-priority match, and an exact path outranks a glob. Here the exact path grants only deny, so the read fails, while read still works for other paths under secret/data/app/. Separately, when several policies grant capabilities on the same path, deny overrides everything else.
Vault policies
4
Select One
An administrator wants to enable the AppRole auth method at the path ci/ instead of the default path. Which command does this?
vault secrets enable -path=ci approle
vault auth enable -path=ci approle
vault write sys/auth/approle path=ci
vault login -method=approle -path=ci
B
Auth methods are enabled with vault auth enable, and -path sets a custom mount path. vault secrets enable mounts secrets engines, and vault login authenticates rather than enabling a method.
Authentication methods
3
Select One
Applications running in Kubernetes Pods must authenticate to Vault without any credentials stored in their images or ConfigMaps. Which auth method fits?
AppRole, with the SecretID baked into the container image
Userpass, with a shared username and password for all Pods
The Kubernetes auth method with the Pod's service account token
The GitHub auth method, using a personal access token
C
The Kubernetes auth method validates the Pod's service account token with the Kubernetes API and maps it to a Vault role. A SecretID baked into an image, a shared password, or a personal access token are all static credentials.
Authentication methods
2
Select One
True or false: The token auth method is enabled by default in every Vault server and cannot be disabled.
True
False
A
The token auth method is mounted at auth/token and is always available, because every other auth method ultimately issues tokens. Other auth methods must be enabled before use.
Authentication methods
1
Select One
DOMAIN Question 01/00

0 of 0 answered

A Course Built Around Your Needs

HashiCorp Certified: Vault Associate

Beginner
Associate
Professional
12.75
Hours
Play icon
Master secrets management with HashiCorp Vault. Learn Vault fundamentals, authentication methods, secrets engines, and production deployment strategies for securing sensitive data.
Bryan Krausen
Details
WHY HANDS-ON PRACTICE

Knowledge, Earned by Doing

The Vault Associate exam rewards secrets-management judgment, not memorized paths.

Build Real Exam Speed

You get 60 minutes for the full exam. Repeated practice trains you to read a policy or command fast, so you're not second-guessing capabilities under time pressure.

Know Your Weak Domains‍

Review every question you missed and spot the topics that need more work. Better to find them here than on exam day.

Realistic Scenario Questions‍

Exam-style questions, that are a mix of concept, CLI, and policy scenario items.

Reduce Exam-Day Anxiety Familiarity with multiple-choice format removes surprises, so nerves don't cost you marks.

Reinforce Through Repetition‍

Spaced repetition on frequently tested concepts, like tokens, leases, and secrets engines, moves them from look it up to just know it.

Check Your Readiness‍

HashiCorp doesn't publish a passing score, so treat your result as a readiness check and identify topics to review before exam-day.

HEAR FROM OUR LEARNERS

Real Learners. Real Results

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast
FAQs

Frequently Asked Questions

Is this practice test free ? 

Yes! This practice test is completely free. You can take it as many times as you like to practice and assess your knowledge.

Do I need to install anything ? 

No. You don’t need to install anything. The practice test is completely browser-based, so you can start practicing directly online. 

What if I'm new to this domain?

That's completely fine , mock tests aren't just for the final week before your exam. Taking one early gives you a baseline: you'll see which topics you already grasp, which ones you've never encountered, and how the real exam frames its questions. Every attempt comes with detailed explanations for each answer, so even the questions you get wrong become a study guide. We'd suggest starting with one full mock test, reviewing the explanations carefully, then working through the linked learning material before attempting the next one. 

How closely does this mock test match the real exam?

The question style and pattern closely mirror the real certification exam, the way scenarios are framed, the answer options, and the level of reasoning required are all modelled on it. The main difference is length: this mock has 25 sample questions, while the actual exam typically presents 50-60 questions of this type. So treat this as a representative sample rather than a full-length simulation. The style will feel familiar on exam day; the stamina and time pressure of a longer paper is something you'll want to prepare for separately.