EnglishDeutschFrançaisEspañolPortuguês

HashiCorp · HC-VA · Associate

HashiCorp Vault Associate (003) — Practice Questions and Mock Exam

The HashiCorp Certified: Vault Associate (003) credential validates foundational knowledge of Vault for secrets management, encryption as a service, and identity-based access to sensitive data.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing HC-VA freeBuy HC-VA access for $29.99
57Questions per Pass-IT mock exam
60minPass-IT mock exam time limit

Checked against HashiCorp · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a HC-VA sample question and read the explanation with its source. Right here, with no sign-up.

Vault Architecture Fundamentals1 / 5

Which environment variable tells the Vault CLI which Vault server address to communicate with?

AlexFull explanation from Alex

VAULT_ADDR is the environment variable the Vault CLI reads to determine the server's API address (e.g., https://vault.example.com:8200). If unset, the CLI defaults to https://127.0.0.1:8200. You can also pass -address on the command line. VAULT_URL, VAULT_HOST, and VAULT_ENDPOINT are not recognized by the Vault CLI and will be silently ignored, causing fallback to the localhost default. This is one of the first variables set in any Vault deployment. Ref: developer.hashicorp.com/vault/docs/commands; /vault/tutorials/get-started/learn-cli

Sourcedeveloper.hashicorp.com

How to prepare for HC-VA with Pass-IT.

Currently 407 practice questions for HC-VA, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · HC-VA

Managing a dynamic secret’s lifetime

  1. You

    Which returned value lets me manage this database credential’s lease?

  2. Alex · AI tutor

    The lease ID identifies the lease associated with the dynamic secret.

    Read the documentation ↗
  3. You

    What can I do with that ID?

  4. Alex · AI tutor

    Use it to request renewal when the lease is renewable, or to revoke it.

    Read the documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

HC-VA · Question excerpt

Managing a dynamic secret’s lifetime

View the full question

A developer runs vault read against a dynamic database credential and wants to know how to manage the returned secret's lifetime. Which value returned by the read serves that purpose?

Understand the correct answer.

The lease_id, which is used with commands such as vault lease renew and vault lease revoke

The lease ID is the handle for renewal and revocation of the secret’s lease.

Read the documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your HC-VA mock exam

Questions
57
Minutes
60

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for HC-VA.

Exam topics, relevant practice and sources you can check.

Authentication methodsSee the guide for weighting52 QuestionsPass-IT questions

Choose how people and applications prove their identity to Vault.

  • Explain authentication methods and select suitable methods for humans or systems.
  • Explain how identities and groups organize authenticated clients.
  • Authenticate and configure authentication methods through the API, CLI and user interface.
Official certification objectives
Vault policiesSee the guide for weighting50 QuestionsPass-IT questions

Translate access requirements into Vault policies.

  • Explain why policies are needed and select a policy for the required access.
  • Read and write policy paths and capabilities.
  • Configure policies through the user interface and CLI.
Official certification objectives
Token behavior and lifecycleSee the guide for weighting50 QuestionsPass-IT questions

Understand the tokens that represent access to Vault.

  • Choose service or batch tokens and create tokens suited to the requirement.
  • Explain root-token uses and lifecycle and the purpose of token accessors.
  • Explain token time-to-live and how orphan tokens differ in their parent relationship.
Official certification objectives
Managing leasesSee the guide for weighting40 QuestionsPass-IT questions

Control the lifetime of leased credentials.

  • Explain what a lease ID identifies.
  • Renew a lease when access should continue.
  • Revoke a lease when the associated access should end.
Official certification objectives
Secrets enginesSee the guide for weighting53 QuestionsPass-IT questions

Choose how Vault stores, generates or processes secrets.

  • Explain secrets engines and choose one for the use case, including Transit for cryptographic operations.
  • Compare static and dynamic secrets and explain the value of short-lived generated credentials.
  • Use response wrapping to hand over a response through a wrapping token.
  • Enable engines and access secrets through the CLI, API and user interface.
Official certification objectives
Encryption as a serviceSee the guide for weighting45 QuestionsPass-IT questions

Use Vault for encryption operations and key rotation.

  • Encrypt secret data through Vault.
  • Decrypt encrypted data through Vault.
  • Rotate the encryption key as part of its lifecycle.
Official certification objectives
Core Vault architectureSee the guide for weighting37 QuestionsPass-IT questions

Understand how Vault protects data and starts securely.

  • Explain how Vault encrypts stored data.
  • Explain sealing and unsealing Vault.
  • Configure environment variables used to interact with Vault.
Official certification objectives
Deployment architectureSee the guide for weighting43 QuestionsPass-IT questions

Compare cluster, storage and recovery choices.

  • Compare self-managed and HashiCorp-managed clusters and their deployment strategies.
  • Explain storage backends and Shamir secret sharing for unsealing.
  • Distinguish disaster recovery replication from performance replication.
Official certification objectives
Application access toolsSee the guide for weighting37 QuestionsPass-IT questions

Understand how applications receive secrets through supporting components.

  • Explain the role of Vault Agent alongside an application.
  • Explain the role of Vault Secrets Operator in Kubernetes.
Official certification objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.

These are practice formats in Pass-IT. See the Official certification objectives for the official exam requirements.

Frequently asked questions

Your preparation

How much study time should I plan for HC-VA?

For planning, Pass-IT estimates roughly 25–60 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from HashiCorp or a promise that you will be exam-ready within that time.

What do you need before the Vault Associate exam?

Basic terminal skills, an understanding of on-premises and cloud architecture, and security fundamentals. No certification is required and no experience is formally enforced. The catalog budget is around 40 hours, the same as the Terraform Associate.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with HashiCorp for the languages available for the official exam.

How long does my HC-VA access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the HC-VA exam

Where can I take the HC-VA exam?

Online proctored via Certiverse.

How long is the HashiCorp Certified: Vault Associate (003) exam?

The HashiCorp Certified: Vault Associate (003) exam has 57 questions and a 60-minute time limit.

Which Vault Associate objectives carry the most marks?

HashiCorp does not publish percentage weightings for the Vault Associate objectives, so our page lists them without numbers rather than inventing a split. The nine objectives run from authentication methods, policies, tokens and leases through secrets engines and encryption as a service to the three architecture topics. Treat them as equally likely to appear, because nothing published says otherwise.

How long does the Vault Associate stay valid?

Two years. You renew it by passing the current Vault Associate exam again, or by passing the Vault Operations Advanced exam, which extends the credential for you.

Your preparation for HC-VA

$29.99one-time

12 months of access for HC-VA · No automatic renewal

Buy HC-VA access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

HashiCorp Certified: Terraform Associate (004)HashiCorp Certified: Terraform Authoring and Operations AdvancedHashiCorp Certified: Vault Operations AdvancedAll HashiCorp certifications →