HashiCorp · HC-VP · Professional

HashiCorp Vault Operations Professional — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Prepare for HC-VP with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing HC-VP free Buy HC-VP access for $29.99

Buy HC-VP access for $29.99 Start practicing HC-VP free

240minTime limit

Checked against HashiCorp · September 2026 · Current exam version

Overview

About the exam

The HashiCorp Certified: Vault Operations Professional credential validates advanced operational mastery of Vault in production. It confirms that you can design highly available clusters, configure performance and disaster recovery replication, implement auto-unseal and seal wrapping, tune storage and audit backends, and troubleshoot real incidents across a multi-cluster deployment. The eight exam domains emphasize day-two operations, security hardening, and recovery rather than basic configuration.

This certification targets senior security engineers, platform operators, and SREs who run Vault as critical infrastructure for their organization. It is a strong fit for those with at least one to two years of hands-on Vault operations experience, including upgrades, incident response, and integrating Vault with identity providers, Kubernetes, and application platforms at scale.

Try the practice preview

Try five HC-VP questions

Try five practice questions from the app’s current HashiCorp Certified: Vault Operations Professional question bank, with answers and explanations.

Configure Access Control1 / 5

In Vault's identity system, what role does an entity alias play?

AlexFull explanation from Alex

An entity alias maps a Vault identity entity to a specific auth method mount and the login name used at that mount. This lets a single canonical entity span multiple auth backends (e.g., LDAP, OIDC, userpass), consolidating policies and group memberships under one identity. Creating an alias requires the mount accessor (via vault auth list) and the alias name. The option “It grants the entity a secondary set of policies…” is wrong—aliases do not grant or override policies; policies come from the entity and its groups. The option “It acts as a short-lived token attached to the entity…” confuses aliases with tokens; aliases are persistent identity mappings, not short-lived credentials. The option “It defines a renaming rule applied during group membership…” is fabricated—Vault has no renaming-rule concept for group lookups. Ref: developer.hashicorp.com/vault/docs/concepts/identity; /vault/api-docs/secret/identity/entity-alias

Sourcedeveloper.hashicorp.com

Monitor a Vault Environment2 / 5

In a Vault audit log entry, what value does the `auth.accessor` field contain by default?

AlexFull explanation from Alex

Vault audit devices hash sensitive string values with a per-device salted HMAC-SHA256 before writing log entries. The auth.accessor field therefore contains the HMAC of the token's accessor, not the raw accessor. You can correlate a known accessor to its hashed form via the /sys/audit-hash endpoint. The option “The cleartext token that authenticated the request” is incorrect—raw tokens are never written to audit logs. The option “The IP address from which the request originated” describes request.remote_address, a separate field. The option “The list of policy names attached to the token” describes auth.policies, also a different field. The hmac_accessor option can disable this hashing but is not recommended. Ref: developer.hashicorp.com/vault/docs/audit; /vault/docs/audit/schema

Sourcedeveloper.hashicorp.com

Employ the Vault Security Model3 / 5

When Vault wraps a response with `wrap-ttl`, where is the actual response stored until it is unwrapped?

AlexFull explanation from Alex

When Vault wraps a response via wrap-ttl, it stores the actual response inside the cubbyhole of a single-use wrapping token at cubbyhole/response. Only the holder of that token can unwrap it via /sys/wrapping/unwrap (Ref: developer.hashicorp.com/vault/docs/concepts/response-wrapping). The cubbyhole is scoped exclusively to the wrapping token—no other token can access it, and data is destroyed when the token expires or is used. The option “In the requester's identity entity metadata, encrypted…” is wrong: identity entity metadata is not used for response storage. The option “In the audit log, retrievable by audit device path” is wrong: audit logs store hashed data for compliance, not retrievable secrets. The option “In the wrapping token's metadata field, accessible…” is wrong: token metadata fields are client-visible labels, not secret storage.

Sourcedeveloper.hashicorp.com

Configure Vault Agent5 / 5

Which Vault Agent configuration enables a local listener that proxies API calls and automatically attaches the auto-auth token when a request does not already include one?

AlexFull explanation from Alex

Vault Agent API proxy lets clients send Vault API requests to a local Agent listener. The listener stanza configures the local endpoint, and the `api_proxy` stanza controls proxy behavior. Setting `use_auto_auth_token = true` forwards tokenless requests to Vault with the Agent auto-auth token; setting it to `force` overrides any request token. HashiCorp documents `cache.use_auto_auth_token` only as backward compatibility with API proxy options and recommends configuring these values in `api_proxy` instead.

Sourcedeveloper.hashicorp.com

Create a free account

Exam domains

What's on the exam

Four domains tie at 13%: building a working Vault server configuration from a scenario, monitoring telemetry and audit logs, architecting fault-tolerant clusters, and scaling performance with batch tokens and replication. The other four (security model, HSM integration, access control, and Vault Agent) sit at 12% each, close enough that no domain is safe to deprioritize.

Several domains lean heavily on Enterprise-only features: disaster recovery and performance replication, HSM-backed auto-unsealing and seal wrap, Sentinel policies, control groups, and namespace-based multi-tenancy all appear inside domains that also cover open-source functionality. A candidate preparing only against open-source Vault is exposed across at least half the domain list.

Exam blueprint: HC-VP

Create a working Vault server configuration given a scenario13%

Enable/configure secret engines, production hardening, auto unseal, integrated storage, authentication methods, secure initialization, root token regeneration, rekeying and key rotation.

≈ 10 h

Monitor a Vault Environment14%

Vault telemetry monitoring, audit log monitoring, operational log monitoring and analysis.

≈ 11 h

Employ the Vault Security Model12%

Secure introduction of Vault clients, security implications of Vault in Kubernetes.

≈ 9 h

Build Fault-Tolerant Vault Environments13%

HA cluster configuration, DR replication (Enterprise), secondary cluster promotion (Enterprise).

≈ 10 h

Understand the hardware security module (HSM) integration11%

Auto unsealing with HSM benefits (Enterprise), seal wrap and PKCS#11 use cases (Enterprise).

≈ 9 h

Scale Vault for Performance13%

Batch tokens, performance standby nodes (Enterprise), performance replication (Enterprise), paths filter (Enterprise).

≈ 10 h

Configure Access Control13%

Identity entities and groups, ACL policy writing and troubleshooting, Sentinel policies (Enterprise), control groups (Enterprise), namespaces for multi-tenancy (Enterprise).

≈ 10 h

Configure Vault Agent12%

Auto-auth and token sink configuration, templating setup.

≈ 9 h

The shares below describe how questions in the Pass-IT practice pool are distributed across domains. Refer to HashiCorp for the official exam blueprint.

Format

Exam format and question types

The exam runs four hours, including a 15-minute break, and combines hands-on lab scenarios with 60 multiple-choice questions; a US QWERTY keyboard is required. Lab tasks configure live clusters, enabling and verifying replication, recovering from a seal or storage failure, and standing up audit devices, while the multiple-choice portion probes the same objectives, including the specific differences between performance and DR replication semantics. HashiCorp does not publish how the four hours split between labs and multiple-choice, so on-screen section timers are the only guide during the exam.

Planning

Preparing for HC-VP

The exam is delivered online through Certiverse with a live proctor for the full four-hour session. The credential holds for two years, and renewing means passing the Vault Operations Professional exam again.

Preparation and logistics: HC-VP

Preparation

Illustrative study time50–120 h

illustrative planning range: 50 h with relevant experience to 120 h when starting out; your needs may fall outside this range

LevelProfessional

Recommended backgroundVault Associate certification (strongly recommended). Linux skills. IP networking. PKI experience (PGP, TLS). Information security fundamentals (network security, RBAC). Container operations knowledge.

Taking and maintaining the certification

DeliveryOnline proctored via Certiverse

Retake policyIncludes one free retake.

Certification validity2 years

Pass the Vault Operations Professional exam again to renew.

Official guideView on provider site

Study notes

Common pitfalls

Topics to review: HC-VP

01Performance vs DR replication
Performance replicas serve reads and hold local tokens; DR replicas are warm standbys without local tokens. Distinguishing them is a safe exam question.
02Auto-unseal migration
Migrating from Shamir to auto-unseal requires the -migrate flag and the unseal keys; skipping the flag leaves the cluster inconsistent.
03Raft quorum
Integrated Storage needs (N/2)+1 nodes for quorum; losing quorum requires peers.json recovery. Size the cluster with quorum in mind.
04Audit device failure
If all audit devices fail to write, Vault blocks requests. Always run at least two devices on independent paths.
05Seal wrap
Seal wrap is a FIPS/compliance feature wrapping CSPs with the seal; it is not the same as auto-unseal and the exam exploits that confusion.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

Which pitfalls should I review when preparing for HashiCorp Certified: Vault Operations Professional?

Topics to review include Performance vs DR replication, Auto-unseal migration, Raft quorum, Audit device failure, Seal wrap. Work through examples to check that you understand the distinctions and can explain your answer.

Do you need the Vault Associate before the Operations Professional exam?

HashiCorp strongly recommends it without requiring it. The wider assumption is heavier: Linux skills, IP networking, PKI experience with PGP and TLS, information security fundamentals and container operations. The catalog budget is 80 hours on top of that background.

What does the Vault Operations Professional exam cover?

Eight objectives weighted almost evenly between 12% and 13%: server configuration, monitoring, the Vault security model, fault-tolerant environments, HSM integration, scaling for performance, access control and Vault Agent. No single objective is worth more than an eighth of the exam. It is an operations paper, so every topic is about running Vault rather than consuming it.

How do you renew the Vault Operations Professional?

By sitting the exam again before the two-year expiry. HashiCorp offers no continuing-education route, and there is no higher Vault exam that would renew it for you.

What happens if you fail the Vault Operations Professional exam?

One retake is included with the registration. For a four-hour exam that changes the calculation on booking early rather than waiting until you feel certain.

One certification, 12 months

Practice for HC-VP

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy HC-VP access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →