I85PREP
⌘ K
Vault Associate study materials
Vault Associate study resources

Vault Associate practice questions

One question at a time. Build your Vault Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Compare authentication methods

Which authentication method is enabled in every Vault installation by default and cannot be disabled?

  1. AppRole
  2. LDAP
  3. userpass
  4. token Correct answer.

Explanation

The token auth method is built into Vault core and is always mounted at auth/token; it backs every login regardless of which method produced the token. It cannot be disabled or unmounted. Other methods are enabled explicitly by an operator.

Question 2Compare authentication methods

Regardless of which authentication method a client uses, what does a successful login ultimately return?

  1. A lease ID tied to a secrets engine
  2. A wrapped secret ID
  3. An identity entity ID
  4. A Vault token Correct answer.

Explanation

Every auth method is a front end that verifies credentials and then has Vault core issue a token carrying the applicable policies. The token, not the original credential, is what subsequent API requests present. Lease IDs and entity IDs are related objects but are not the login result.

Question 3Compare authentication methods

Which auth method stores usernames and password hashes directly in Vault's storage backend?

  1. Okta
  2. RADIUS
  3. LDAP
  4. userpass Correct answer.

Explanation

userpass keeps its own user entries inside Vault, storing a password hash rather than delegating verification to an external system. LDAP, Okta, and RADIUS all forward credentials to an outside directory or service for validation.

Question 4Compare authentication methods

Which pair of values does an application present when logging in with the AppRole auth method?

  1. A client ID and a client secret
  2. A username and a password
  3. An access key and a secret key
  4. A role ID and a secret ID Correct answer.

Explanation

AppRole is designed for machine authentication and splits the credential into a role ID, which is not sensitive, and a secret ID, which is sensitive and can be constrained by TTL and use count. The application submits both to the login endpoint for its role.

Question 5Compare authentication methods

Which credential does a pod present to Vault when using the Kubernetes auth method?

  1. Its kubelet client certificate
  2. Its Kubernetes service account JWT Correct answer.
  3. A static bootstrap token stored in a ConfigMap
  4. An AWS instance identity document

Explanation

The pod sends the JWT mounted into its service account token volume, and Vault validates it against the Kubernetes API using a TokenReview request. Roles then bind on claims such as namespace and service account name.

Question 6Compare authentication methods

What is the primary purpose of an auth method in Vault?

  1. To replicate data to a performance secondary cluster
  2. To encrypt data at rest before it is written to storage
  3. To verify client identity and issue a token Correct answer.
  4. To generate dynamic database credentials on demand

Explanation

Auth methods handle authentication: they validate a credential against some source of truth and ask Vault core to issue a token bound to policies. Secrets engines, by contrast, store or generate data such as dynamic database credentials.

Question 7Compare authentication methods

Which credential does a user supply to Vault when logging in with the GitHub auth method?

  1. A GitHub SSH private key
  2. A GitHub OAuth refresh token
  3. A GitHub personal access token Correct answer.
  4. The GitHub organization's admin password

Explanation

Vault calls the GitHub API with the supplied personal access token to learn the user's identity and team memberships, then maps teams to policies. The token itself is never stored for future logins.

Question 8Compare authentication methods

Which auth method identifies a client from a certificate signed by a certificate authority that Vault trusts?

  1. JWT
  2. TLS certificates Correct answer.
  3. Okta
  4. RADIUS

Explanation

The TLS certificate auth method validates the client certificate against a configured CA certificate and then matches fields such as the common name to a role. No password is transmitted.

Question 9Compare authentication methods

An operator needs two independent LDAP configurations on one Vault cluster, each pointing at a different directory and granting different policies. What should the operator do?

  1. Enable ldap separately on each cluster node
  2. Enable ldap once and define two config entries in that mount
  3. Enable the ldap auth method twice at different paths Correct answer.
  4. Enable ldap once and create two roles in the same mount

Explanation

Each enable creates a separate mount with its own configuration, roles, and accessor, so enabling ldap again with a distinct -path value yields two independent configurations. Roles inside one mount all share that mount's single directory connection.

Question 10Compare authentication methods

Which AppRole role parameter limits how many times a single secret ID can be used to log in?

  1. secret_id_ttl
  2. bind_secret_id
  3. token_num_uses
  4. secret_id_num_uses Correct answer.

Explanation

secret_id_num_uses caps the number of logins a given secret ID can perform before it is exhausted. secret_id_ttl bounds its lifetime, and token_num_uses applies to the issued token instead.

Question 11Compare authentication methods

How does Vault verify the identity of a client using the AWS auth method's IAM workflow?

  1. By querying the AWS Cost Explorer API for the account
  2. By comparing the client's session token against stored IAM policies
  3. By having the client sign a request to sts:GetCallerIdentity Correct answer.
  4. By reading the instance identity document from the EC2 metadata endpoint

Explanation

In the IAM workflow the client signs a request to sts:GetCallerIdentity with its own AWS credentials and sends it to Vault, which forwards it to AWS. AWS confirms the calling principal's ARN, so Vault never needs the client's secret key.

Question 12Compare authentication methods

Which statement best distinguishes the OIDC auth method from the JWT auth method?

  1. OIDC validates tokens with symmetric keys only
  2. OIDC uses a browser redirect flow; JWT accepts an existing token Correct answer.
  3. OIDC works only with Kubernetes service accounts
  4. JWT requires a browser redirect while OIDC does not

Explanation

OIDC runs the authorization code flow through a browser so a human can authenticate with the identity provider and Vault can obtain a token. JWT auth is non-interactive: the caller already holds a signed token from a trusted issuer and submits it directly.

Question 13Compare authentication methods

A role is configured with token_type=batch. Which behavior should the operator expect from tokens issued under that role?

  1. They are persisted and can be renewed indefinitely
  2. They are not persisted to storage and cannot be renewed Correct answer.
  3. They skip policy evaluation for faster response
  4. They are always orphaned and never expire

Explanation

Batch tokens are lightweight, self-contained tokens that Vault does not write to storage, which makes them cheaper to create but non-renewable and limited to a fixed lifetime. Service tokens are the persisted, renewable alternative.

Question 14Compare authentication methods

Which LDAP auth method parameter specifies the account Vault uses when searching the directory for the user attempting to log in?

  1. userattr
  2. binddn Correct answer.
  3. groupdn
  4. userdn

Explanation

binddn (with bindpass) supplies the distinguished name and password Vault binds with before performing the user search. userdn restricts where that search is allowed to look.

Question 15Compare authentication methods

A user logs in with userpass on Monday and with LDAP on Tuesday, and both logins should map to one identity with a common set of policies. Which Vault feature makes this possible?

  1. Identity entities and aliases Correct answer.
  2. Auth method tuning
  3. Token roles
  4. Response wrapping

Explanation

An identity entity represents one person or object, and aliases attached to different auth mounts link those separate logins to that entity. Policies attached to the entity are then added to tokens issued by any of the linked methods.

Question 16Compare authentication methods

Which tuning parameter on an auth mount sets the upper bound on the lifetime of tokens the mount issues?

  1. audit_non_hmac_request_keys
  2. max_lease_ttl Correct answer.
  3. default_lease_ttl
  4. listing_visibility

Explanation

max_lease_ttl is a ceiling: no token issued from that mount, and no role token_max_ttl setting, can exceed it. default_lease_ttl supplies the value used when a role does not specify one.

Question 17Compare authentication methods

Which two values must be configured on the Okta auth method before users can log in?

  1. An organization name and an API token Correct answer.
  2. A tenant ID and a subscription key
  3. A bind DN and a bind password
  4. A client ID and a client secret

Explanation

Vault calls the Okta API using the configured organization name and an Okta API token to verify the user's credentials, then maps Okta groups to Vault policies. No per-user entries are stored in Vault.

Question 18Compare authentication methods

How can an operator deliver an AppRole secret ID to an application without exposing it in logs or configuration files?

  1. Enable response wrapping and give the wrapping token to the application Correct answer.
  2. Commit it to the application's source repository
  3. Append it to the login URL as a query parameter
  4. Write it into the audit device output for later retrieval

Explanation

Response wrapping returns a single-use wrapping token whose TTL is short, and the wrapped payload can only be unwrapped once by the holder. The application unwraps it locally, so the secret ID never appears in transit logs or stored configuration.

Question 19Compare authentication methods

Which configuration item lets Vault authenticate itself to the Kubernetes API when reviewing service account tokens?

  1. kubernetes_ca_cert
  2. token_reviewer_jwt Correct answer.
  3. disable_iss_validation
  4. issuer

Explanation

token_reviewer_jwt is the credential Vault presents when calling the Kubernetes TokenReview API, so it must belong to an account permitted to create token reviews. The CA certificate merely establishes trust in the API server's TLS certificate.

Question 20Compare authentication methods

A CI/CD pipeline runs on an EC2 instance and must authenticate to Vault without storing a long-lived Vault secret. Which auth method fits best?

  1. GitHub
  2. AWS auth using the IAM workflow Correct answer.
  3. userpass
  4. LDAP

Explanation

The AWS IAM workflow lets the instance sign a GetCallerIdentity request with credentials already provided by its instance profile, so no static Vault credential is stored. A role restricted to the expected IAM principal then grants the needed policies.

Question 21Compare authentication methods

Which statement about policies attached to an identity entity is accurate?

  1. Entity policies replace the policies granted by the auth role
  2. Entity policies are merged with the token's policies at login Correct answer.
  3. Entity policies can be set only by a root token
  4. Entity policies apply only to batch tokens

Explanation

At login Vault combines the policies from the auth role with any policies attached to the entity the alias resolves to. The resulting token therefore holds the union of both sets rather than one replacing the other.

Question 22Compare authentication methods

A JWT role is configured with bound_audiences set to "vault" and bound_claims requiring sub=ci. What happens when a validly signed token with audience "other" is presented?

  1. The login fails only if the token has already expired
  2. The login succeeds because signature verification is sufficient
  3. The login succeeds and Vault rewrites the audience claim
  4. The login fails because the audience claim does not match Correct answer.

Explanation

A valid signature only proves who issued the token; the role's bound claims and bound audiences must also match for the login to be authorized. A mismatch on either check causes the login to be rejected.

Question 23Compare authentication methods

An operator wants to enable a third-party auth method plugin. What must be done before the auth mount can be created successfully?

  1. The plugin must first be enabled as a secrets engine
  2. The plugin must be registered in the plugin catalog with its command and SHA-256 Correct answer.
  3. The plugin must be written in Go and compiled with Vault
  4. The plugin binary must be signed by HashiCorp

Explanation

External plugins are not known to Vault until they are registered in the plugin catalog, which records the executable name, type, and checksum used to verify the binary. Once registered, the method can be enabled at a chosen path.

Question 24Compare authentication methods

Which value ties a login performed at a specific auth mount to an identity alias?

  1. The token accessor
  2. The auth mount accessor Correct answer.
  3. The namespace path
  4. The entity ID

Explanation

Each auth mount receives a unique accessor, and identity aliases reference that accessor to record which mount produced the login. Because accessors survive re-enabling a mount at the same path, aliases remain resolvable after a disable and re-enable.

Question 25Compare authentication methods

Which statement about the relationship between an auth mount's max_lease_ttl and a role's token_max_ttl is correct?

  1. The mount's max_lease_ttl does not apply to batch tokens
  2. A role's token_max_ttl cannot exceed the mount's max_lease_ttl Correct answer.
  3. A role's token_max_ttl overrides the mount's max_lease_ttl
  4. A role's token_max_ttl must be shorter than the mount's default_lease_ttl

Explanation

The mount-level max_lease_ttl is the hard ceiling, and Vault caps any role token_max_ttl at that value. Role settings can tighten the limit further but can never raise it beyond the mount ceiling.

Question 26Compare authentication methods

Which auth method is mounted automatically on every Vault server and cannot be disabled by an operator?

  1. userpass
  2. token Correct answer.
  3. approle
  4. cert

Explanation

The token auth method is built into Vault's core and is always present at the token/ mount; it is what issues and validates every client token. Because Vault's own request handling depends on it, it cannot be disabled or moved to another path. All other methods are optional and must be explicitly enabled.

Question 27Compare authentication methods

Which auth method validates a username and password against credentials that are stored inside Vault itself, without contacting an external identity provider?

  1. Okta
  2. RADIUS
  3. LDAP
  4. userpass Correct answer.

Explanation

The userpass method keeps user entries, including a password hash, in Vault's own storage backend, so authentication is resolved entirely within Vault. It is typically used for small numbers of local operators or break-glass accounts. LDAP, Okta, and RADIUS all delegate the credential check to a remote system.

Question 28Compare authentication methods

An operator runs `vault auth enable -path=corp-ldap ldap`. At which path do users subsequently authenticate?

  1. identity/ldap/login/<username>, through the identity secrets engine
  2. auth/ldap/login/<username>, because the method type always determines the login path
  3. auth/corp-ldap/login/<username>, because the chosen mount path is part of the login URL Correct answer.
  4. sys/auth/corp-ldap/login/<username>, under the sys/ prefix

Explanation

The `-path` flag sets the mount path, and a method's login endpoints are always built from that mount path rather than from the method type. Enabling LDAP at corp-ldap therefore produces login URLs such as auth/corp-ldap/login/<username> and CLI logins via `-path=corp-ldap`. Only one mount can occupy a given path, which is how multiple configurations of the same method coexist.

Question 29Compare authentication methods

An operator wants users who log in through the LDAP auth method to receive policies based on their directory group membership. What must be configured?

  1. A group-to-policy mapping stored on the LDAP auth mount Correct answer.
  2. An external token group listing the directory groups to match
  3. One token role per directory group, referenced from the bind DN
  4. An alias metadata field on each LDAP user entry holding the policy name

Explanation

The LDAP auth method lets you register a directory group by name (or by DN when groupdn is used) together with a list of policies, stored on that auth mount. On login, Vault searches the directory for the user's group memberships and attaches the policies of any matching registered groups. Token roles and alias metadata play no role in that resolution.

Question 30Compare authentication methods

An auth mount is tuned with listing_visibility=unauth. What effect does this setting have?

  1. Tokens from the mount are treated as unauthenticated in policy checks
  2. The mount's roles and configuration become readable without a token
  3. The mount appears in listings returned to unauthenticated callers Correct answer.
  4. Unauthenticated requests to the mount bypass credential checks

Explanation

By default, auth mounts are hidden from the unauthenticated mount listing; setting listing_visibility=unauth makes the mount visible in that listing so clients and the UI can discover which login methods exist before authenticating. The setting changes discoverability only. It does not relax credential requirements or grant any read access to the mount's configuration.

Question 31Create Vault policies

Vault policy documents can be authored in which pair of formats?

  1. YAML or JSON
  2. HCL or YAML
  3. XML or JSON
  4. HCL or JSON Correct answer.

Explanation

A policy is a declarative document describing paths and the capabilities granted on them, and Vault accepts it as either HCL or JSON. Both formats express the same structure: path stanzas mapping to a list of capabilities.

Question 32Create Vault policies

Which policy does Vault attach to every token unless that behavior is explicitly suppressed?

  1. default Correct answer.
  2. admin
  3. root
  4. token

Explanation

The default policy is added to tokens automatically at creation, including tokens issued by auth methods. It grants a small set of self-service abilities such as looking up the token's own properties. It can be disabled per role or token request.

Question 33Create Vault policies

Which statement describes the built-in root policy?

  1. It is attached to tokens only when the root user logs in.
  2. It is a template that must be applied to each auth method.
  3. It grants read-only access to every system endpoint and can be edited by any operator.
  4. It grants every capability on every path and cannot be altered. Correct answer.

Explanation

The root policy contains a single stanza granting all capabilities on the wildcard path "*", so a token carrying it can do anything. Because it bypasses normal authorization checks, Vault does not allow it to be modified or deleted.

Question 34Create Vault policies

Which command creates or replaces the policy named app-read using a local file?

  1. vault write policy app-read app-read.hcl
  2. vault policies write app-read.hcl
  3. vault policy create -file app-read.hcl app-read
  4. vault policy write app-read app-read.hcl Correct answer.

Explanation

The policy write subcommand takes the policy name followed by the path to the file containing the policy document. Writing an existing name replaces its contents.

Question 35Create Vault policies

Which capability explicitly blocks access to a path regardless of what other policies grant?

  1. none
  2. deny Correct answer.
  3. revoke
  4. sudo

Explanation

The deny capability is absolute: if any policy attached to a token denies a path, the request fails even when another policy grants the needed capability.

Question 36Create Vault policies

Which wildcard in a policy path matches exactly one path segment?

  1. ?
  2. + Correct answer.
  3. *
  4. **

Explanation

The plus sign matches any characters within a single path segment, stopping at a slash. It is commonly used to parameterize a segment such as a username or team name.

Question 37Create Vault policies

Two policies on a token both match the path secret/data/app: one grants read and the other grants list. What access does the token have?

  1. Only read, because the first matching policy wins.
  2. Read and list, because matching grants are combined. Correct answer.
  3. Neither, because conflicting grants cancel each other.
  4. Only list, because list is the broader capability.

Explanation

Policies are additive: Vault collects the capabilities from every policy on the token that matches the requested path and applies their union. Order of attachment does not matter.

Question 38Create Vault policies

Policies in Vault are attached to which object?

  1. namespaces
  2. mount accessors
  3. tokens Correct answer.
  4. seal keys

Explanation

Authorization in Vault is evaluated against the policies carried by the token making the request. Auth method roles and token creation options simply seed a token with policy names at issuance.

Question 39Create Vault policies

Which capability is required for a token to mount a new secrets engine at secret/?

  1. write
  2. create
  3. sudo Correct answer.
  4. root

Explanation

Mounting an engine is a root-protected operation on the sys/mounts endpoints, so the token needs sudo on the relevant sys path in addition to create or update.

Question 40Create Vault policies

Given a stanza of path "secret/app/*" with the read capability, which request is allowed?

  1. Reading secret/app itself but not the paths beneath it.
  2. Reading secret/app/db/creds but not secret/other/creds. Correct answer.
  3. Reading only one level, such as secret/app/db, but not deeper paths.
  4. Reading any path whose name contains the string secret/app/.

Explanation

A trailing asterisk performs prefix matching: the literal prefix secret/app/ must be present, and the asterisk then matches any remaining characters including slashes. Deeper paths such as secret/app/db/creds therefore match.

Question 41Create Vault policies

Which template variable in a policy path resolves to the ID of the authenticated entity?

  1. {{identity.id}}
  2. {{token.entity_id}}
  3. {{auth.entity.id}}
  4. {{identity.entity.id}} Correct answer.

Explanation

Policy templating uses the identity namespace, and the entity's identifier is exposed as {{identity.entity.id}}. Vault substitutes the value at request time so a single policy can serve many entities.

Question 42Create Vault policies

Under a KV v2 mount at secret/, which capability on the metadata path allows listing keys with vault kv list?

  1. list Correct answer.
  2. scan
  3. read
  4. enumerate

Explanation

Listing keys is a distinct operation with its own capability. For KV v2 the keys live on the metadata path, so list on secret/metadata/* is required.

Question 43Create Vault policies

Which capability lets a token update only some fields of an existing KV v2 secret while leaving the other fields unchanged?

  1. create
  2. update
  3. patch Correct answer.
  4. merge

Explanation

The patch capability performs a partial update on endpoints that support it, such as KV v2 data paths, changing only the supplied keys. A normal update replaces the stored data.

Question 44Create Vault policies

Which path prefix does a KV v2 engine mounted at secret/ use for reading and writing secret values?

  1. secret/values/
  2. secret/secret/
  3. secret/data/ Correct answer.
  4. secret/metadata/

Explanation

KV v2 splits each secret across subpaths: values are read and written under data/, while configuration and version metadata live under metadata/. Policies must grant capabilities on the subpath that matches the operation being performed.

Question 45Create Vault policies

Which command displays the contents of the policy named ops?

  1. vault policy get ops
  2. vault policy read ops Correct answer.
  3. vault read policy ops
  4. vault policy show ops

Explanation

The policy read subcommand prints the policy document stored under the given name. The policy name is the argument, not a path into a secrets engine.

Question 46Create Vault policies

Which operation on the built-in default policy is permitted?

  1. Deleting it with vault policy delete default.
  2. Removing it from tokens that already carry it.
  3. Renaming it to base.
  4. Adding capabilities to it while keeping the same name. Correct answer.

Explanation

Vault protects the default policy from deletion and renaming, but its contents can be updated in place by writing to the same name. Tokens pick up the new contents on subsequent requests.

Question 47Create Vault policies

To authenticate with the userpass auth method, which capability does the caller need on auth/userpass/login/*?

  1. list
  2. sudo
  3. read
  4. create Correct answer.

Explanation

Logging in submits credentials to a write endpoint, so the caller needs create (or update) on the login path for its username. sudo is not involved because the login endpoint is not root-protected.

Question 48Create Vault policies

Which command reports what a specific token is allowed to do on secret/data/app?

  1. vault policy capabilities <token> secret/data/app
  2. vault token lookup <token> secret/data/app
  3. vault capabilities token <token> secret/data/app
  4. vault token capabilities <token> secret/data/app Correct answer.

Explanation

The token capabilities subcommand takes a token and a path and prints the capabilities that token holds on that path. It is the quickest way to validate a policy before handing it out.

Question 49Create Vault policies

A userpass role sets token_policies = ["dev"]. After a successful login, which policies does the new token carry?

  1. dev and root
  2. dev only
  3. dev and default Correct answer.
  4. default only, until dev is assigned to the token

Explanation

Policies named on the role become token policies, and Vault also attaches the default policy unless the role disables it. The resulting token therefore holds both.

Question 50Create Vault policies

A token's policies contain no stanza matching secret/data/billing. What happens when the token reads that path?

  1. Vault falls back to the default policy for that path.
  2. Vault allows the read and logs a warning.
  3. Vault returns a permission denied error. Correct answer.
  4. Vault returns an empty response with no data.

Explanation

Vault authorizes by explicit grant only; a path with no matching stanza in any attached policy yields no capabilities and the request is rejected. There is no implicit read access anywhere.