Skip to content
Cheat sheets
Associate · 003Prep available

HashiCorp Certified: Vault Associate (003) practice exam and study path

A free, timed 57-question 003 practice exam in 60 minutes, scored by domain, with every option explained after you submit. Also 217 practice questions you can check one at a time, a page for every task in the exam guide, and a study path. No sign-up.

Start the free practice examGet the exam packPractice question by question →
Vault Associate exam pack:

$6.99for 12 months

For engineers who run or consume Vault: auth methods and identities, policies, tokens and leases, static and dynamic secrets engines, transit encryption, seal and unseal, storage and replication, HCP Vault Dedicated, Vault Agent and the Vault Secrets Operator.

The exam

Exam code
003
Questions
Not yet published
Time
60 minutes
Passing score
Not published
Exam fee
$70.50 (USD)
Question types
multiple choice, multiple response

A one-hour, online-proctored multiple-choice exam in English that tests Vault 1.19; the credential is valid for 2 years and the fee is $70.50 plus locally applicable taxes and fees, with no free retake. HashiCorp's associate exams use true or false, multiple choice and multiple answer questions; our forms write the true or false kind as four-option questions. HashiCorp publishes neither the number of questions nor a passing score. Our forms hold 57 questions, the count candidates commonly report for HashiCorp's associate exams (community reports, not a HashiCorp figure), and each objective is weighted by its number of sub-objectives because HashiCorp publishes no weights.

From HashiCorp's certification page and exam guide, checked Nov 8, 2026.

Domains and weights

  • Domain 1: Authentication methods

    15%

  • Domain 2: Vault policies

    13%

  • Domain 3: Vault tokens

    15%

  • Domain 4: Vault leases

    7%

  • Domain 5: Secrets engines

    20%

  • Domain 6: Encryption as a service

    5%

  • Domain 7: Vault architecture fundamentals

    8%

  • Domain 8: Vault deployment architecture

    12%

  • Domain 9: Access management architecture

    5%

Practice

217 original practice questions, every option explained with the HashiCorp documentation page that proves it. Free, no sign-up; progress stays on this device.

Your results on this device →

More practice exams

The lessons, the sample questions on every task page and the first full practice exam are free and stay free. A pack adds the further timed 003 practice exams.

Vault Associate exam pack

$6.99for 12 months

  • Every paid 003 practice exam, timed, with every option explained
  • The next version of this exam included when it changes within your 12 months
  • 12 months of access. One payment, nothing renews by itself.
  • 14-day refund, no conditions
  • 14-day refund, no conditions: ask within 14 days of buying and you get the whole payment back.
  • No pass guarantee. These are practice exams written by us from the exam guide and the HashiCorp documentation; a score here does not predict your result on the real exam.

Study path

One module per exam domain. Lessons that already exist on BytePatterns are linked; the rest are being written.

  1. Module 1: Authentication methods

    1. 1What auth methods do: verify an identity, map it to policies, return a tokenTask 1.1

      Lesson coming

    2. 2Choosing a method: OIDC, LDAP and userpass for people, AppRole, Kubernetes and cloud IAM for workloadsTask 1.2

      Lesson coming

    3. 3Human and machine logins: interactive credentials versus platform identityTask 1.3

      Lesson coming

    4. 4Entities, aliases and groups: one identity across many loginsTask 1.4

      Lesson coming

    5. 5Logging in from the CLI, the HTTP API and the UITask 1.5

      Lesson coming

    6. 6Enabling, tuning and disabling auth methodsTask 1.6

      Lesson coming

  2. Module 2: Vault policies

    1. 7Why policies: deny by default, least privilege, default and root policiesTask 2.1

      Partly covered by: Shared Responsibility & IAM

    2. 8Policy paths: exact paths, the * glob, the + wildcard and priorityTask 2.2

      Lesson coming

    3. 9Capabilities: HTTP verbs, sudo, deny and parameter constraintsTask 2.3

      Lesson coming

    4. 10Choosing a policy: the smallest set of paths and capabilities, and explicit denyTask 2.4

      Partly covered by: Shared Responsibility & IAM

    5. 11Writing and checking policies with the CLI and the UITask 2.5

      Lesson coming

  3. Module 3: Vault tokens

    1. 12Service and batch tokens: features, cost and scaleTask 3.1

      Lesson coming

    2. 13Root tokens: initial set-up, generate-root and revocationTask 3.2

      Lesson coming

    3. 14Token accessors: look up, renew and revoke without the tokenTask 3.3

      Lesson coming

    4. 15Time-to-live: TTL, max TTL, explicit max TTL and periodic tokensTask 3.4

      Lesson coming

    5. 16Token hierarchies and orphan tokensTask 3.5

      Lesson coming

    6. 17Creating tokens: flags, token roles and use limitsTask 3.6

      Lesson coming

  4. Module 4: Vault leases

    1. 18Lease IDs: what gets a lease and how the ID is builtTask 4.1

      Lesson coming

    2. 19Renewing leases: increments, limits and returned durationsTask 4.2

      Lesson coming

    3. 20Revoking leases: one lease, a prefix, or everything a token madeTask 4.3

      Lesson coming

  5. Module 5: Secrets engines

    1. 21Choosing a secrets engine for the jobTask 5.1

      Lesson coming

    2. 22Static and dynamic secrets: stored values versus credentials made on demandTask 5.2

      Partly covered by: ConfigMaps, Secrets & Env

    3. 23Transit: encryption as a service, signing, HMAC and data keysTask 5.3

      Partly covered by: KMS, Envelope Encryption & Private CA

    4. 24What secrets engines are: mounts, paths, isolation and tuningTask 5.4

      Lesson coming

    5. 25Response wrapping: single-use wrapping tokens and unwrappingTask 5.5

      Lesson coming

    6. 26Why short-lived, dynamic secrets reduce riskTask 5.6

      Lesson coming

    7. 27Enabling secrets engines from the CLI, the API and the UITask 5.7

      Lesson coming

    8. 28Reading and writing secrets: kv commands, API paths and versionsTask 5.8

      Lesson coming

  6. Module 6: Encryption as a service

    1. 29Encrypting and decrypting with transitTask 6.1

      Partly covered by: KMS, Envelope Encryption & Private CA

    2. 30Rotating transit keys and rewrapping ciphertextTask 6.2

      Partly covered by: KMS, Envelope Encryption & Private CA

  7. Module 7: Vault architecture fundamentals

    1. 31How Vault encrypts data: barrier, keyring and root keyTask 7.1

      Partly covered by: KMS, Envelope Encryption & Private CA

    2. 32Sealing and unsealing: Shamir shares, auto unseal and recovery keysTask 7.2

      Lesson coming

    3. 33CLI environment variablesTask 7.3

      Lesson coming

  8. Module 8: Vault deployment architecture

    1. 34Cluster strategy: odd-sized Raft clusters, quorum and failure toleranceTask 8.1

      Partly covered by: Consistency and CAP

    2. 35Storage backends: integrated storage, Consul and the restTask 8.2

      Partly covered by: Consistency and CAP, Storage: PV, PVC & StatefulSet

    3. 36Shamir secret sharing, rekeying and recovery keysTask 8.3

      Lesson coming

    4. 37Disaster recovery and performance replicationTask 8.4

      Partly covered by: Database Replication, Disaster Recovery: RPO & RTO

    5. 38Self-managed Vault and HCP Vault Dedicated: who operates whatTask 8.1, 8.5

      Partly covered by: Shared Responsibility & IAM

  9. Module 9: Access management architecture

    1. 39Vault Agent: auto-auth, templates, caching and process supervisor modeTask 9.1

      Lesson coming

    2. 40Vault Secrets Operator: syncing Vault secrets into Kubernetes SecretsTask 9.2

      Partly covered by: ConfigMaps, Secrets & Env

    3. 41Rolling restarts of Deployments when a synced secret changesTask 9.2

      Partly covered by: Scheduling & Rolling Updates

Every task in the exam guide

The exam guide splits each domain into task statements. Each one has a page with a short summary, the lessons that teach it and open sample questions.

Domain 1: Authentication methods

Domain 2: Vault policies

Domain 3: Vault tokens

Domain 4: Vault leases

Domain 5: Secrets engines

Domain 6: Encryption as a service

Domain 7: Vault architecture fundamentals

Domain 8: Vault deployment architecture

Domain 9: Access management architecture

How these questions are made

  • Written by us from the exam guide's task statements and the HashiCorp documentation — never from real exam content.
  • Every option carries its own explanation and a link to the HashiCorp page that proves it.
  • A question enters a timed exam only after an independent check; until then it is a practice question.
  • Results are a plain percentage, per domain too — not an imitation of HashiCorp's scaled score.

Questions about the 003 practice exam

Is the 003 practice exam free?
Yes. The full practice exam (57 questions, 60 minutes) is free with no sign-up, and so are the 217 practice questions, the task pages and the study path. Your attempts are saved in this browser, on this device.
How many questions does it have, and is it timed?
57 questions in 60 minutes: the real 003 pace, scaled to this form. When the time runs out, the exam is submitted as it stands.
Are the answers explained?
After you submit, not during: like the real exam, the timed exam gives no feedback until the end. Then you get your score overall and per exam domain, and every question with each option explained and a link to the HashiCorp documentation page behind it. In practice mode an answer is explained as soon as you check it.
What does the Vault Associate exam pack add?
3 more timed practice exams (Practice exam 1: 57 questions, 60 minutes; Practice exam 2: 57 questions, 60 minutes; Practice exam 3: 57 questions, 60 minutes), each scored and explained the same way, and the next version of this exam if it changes within your 12 months. 12 months of access. One payment, nothing renews by itself. Everything above stays free. See the pack.
Can I get a refund?
Yes, with no conditions: ask within 14 days of buying and you get the whole payment back. The details are in the terms.
Is this an official HashiCorp practice exam?
No. BytePatterns is not affiliated with, endorsed or sponsored by HashiCorp. Every question is written by us from the public exam guide and the HashiCorp documentation, never from real exam content, and a score here does not predict your result on the real exam. HashiCorp lists its own preparation resources on its certification page.