[NEW] HashiCorp Certified: Vault Associate

Authentication (15%): Configuring advanced methods like AppRole, LDAP, GitHub, and Kubernetes, alongside entity and group management.

Policies (15%): Writing HCL policy syntax, mastering capabilities (read, create, sudo), and using path rules effectively.

Tokens (15%): Managing the lifecycle of Service and Batch tokens, including creation, renewal, and revocation.

Secrets Engines (20%): Differentiating between dynamic and static secrets and handling the complexities of lease management.

Architecture & Operations (20%): Understanding the Seal/Unseal process, high availability, and enterprise features like replication.

B. Service Token

C. Batch Token

D. Recovery Token

E. Parent Token

F. Periodic Token

Correct Answer: C

Explanation:

A (Incorrect): Root tokens are for initial configuration and are highly sensitive; they should not be used for routine operations.

B (Incorrect): Service tokens are the default, persisted to the data store, and have more overhead than batch tokens.

D (Incorrect): There is no "Recovery Token" for standard operations; recovery keys are used for unsealing.

E (Incorrect): A Parent token is a hierarchy designation, not a specific high-performance type.

F (Incorrect): Periodic tokens are a subtype of service tokens that can be renewed indefinitely, not optimized for "batch" speed.

Question 2: Which command is used to permit a specific user to read secrets from the path secret/data/config but prevents them from deleting or listing them?

B. Creating a policy with path "secret/data/config" { capabilities = ["read"] }

C. vault auth enable userpass

D. vault policy write admin ...

E. Creating a policy with path "secret/data/config" { capabilities = ["list"] }

F. vault operator unseal

Correct Answer: B

Explanation:

A (Incorrect): This command writes data but does not set permissions.

C (Incorrect): This enables an authentication method but does not define what a user can do once logged in.

D (Incorrect): While this writes a policy, the "admin" label implies broad permissions, which contradicts the "read-only" requirement.

E (Incorrect): The "list" capability allows a user to see the names of keys but not their contents.

F (Incorrect): Unsealing is an operational task to open the Vault, not a permission setting.

Question 3: In the Vault Seal/Unseal process, what is the purpose of "Shamir's Secret Sharing"?

B. To divide the unseal key into multiple shards, requiring a threshold of keys to reconstruct the master key.

C. To sync data between primary and secondary clusters.

D. To create a backup of the Vault configuration.

E. To generate a new root token every 24 hours.

F. To automate the login process for GitHub users.

Correct Answer: B

Explanation:

A (Incorrect): Vault uses AES-GCM for storage encryption, not Shamir's.

C (Incorrect): This describes replication, not the unseal process.

D (Incorrect): Backups are handled via storage backend snapshots.

E (Incorrect): Root tokens are not managed by Shamir's algorithm.

F (Incorrect): GitHub login is handled by the GitHub Auth method.

You can retake the exams as many times as you want.

This is a huge original question bank.

You get support from instructors if you have questions.

Each question has a detailed explanation.

Mobile-compatible with the Udemy app.

30-days money-back guarantee if you're not satisfied.