Practice Vault-Associate Exam Online

Question 1

True or False? When encrypting data with the Transit secrets engine, Vault always stores the ciphertext in a dedicated KV store along with the associated encryption key.

A : True

B : False

Answer: B

Question 2

Which of the following features are not available in the Vault Community version?

A : Cloud KMS auto-unseal

B : Single sign-on support

C : Event notifications and filtering

D : Multi-factor authentication (auth)

E : Dynamic secrets engines

F : HSM auto-unseal

Answer: F

Question 3

During a service outage, you must ensure all current tokens and leases are copied to another Vault cluster for failover so applications don't need to authenticate. How can you accomplish this?

A : Have Vault write all the tokens and leases to a file so you have a second copy of them

B : Configure all applications to use the auto-auth feature of the Vault Agent

C : Configure Disaster Recovery replication and promote the secondary cluster during an outage

D :

Replicate to another cluster using Performance Replication and promote the secondary cluster during an outage

Answer: C

Question 4

True or False? Once the lease for a dynamic secret has expired, Vault revokes the credentials on the backend platform for which they were created (i.e., database, AWS, Kubernetes).

A : True

B : False

Answer: A

Question 5

Which of the following is NOT a valid way in which a lease can be revoked in Vault?

A : Using the user interface (UI)

B : Automatically when the TTL or Max-TTL expires

C : Using the API to call the /v1/sys/leases endpoint

D : Via the CLI using the vault token command

Answer: D

Name:	HashiCorp Certified: Vault Associate (002)
Exam Code:	Vault-Associate
Certification:	HashiCorp Security Automation
Vendor:	HashiCorp
Total Questions:	324
Last Updated:	Sep 29, 2026

HashiCorp Vault-Associate Answers