Vault Associate study guide
Vault Associate · Work through your exam, one topic at a time.
Vault Associate is HashiCorp's entry-level certification for practitioners who work with Vault, the secrets management product. It is aimed at people who already touch Vault in some capacity - platform engineers, cloud and security engineers, DevOps staff, and administrators - and who need to prove they can operate it day to day rather than just describe it. The Vault Associate study guide has 8 sections and about 2,666 words.
01Compare Authentication Methods
Vault is token-centric: every API call is authorized by a token, and an auth method is a plugin that exchanges an external credential for one. The login response always includes client token , token policies , lease duration , renewable , and metadata , and the token inherits whatever policies the method's role or configuration maps.
345 words, about 2 min02Create Vault Policies
A Vault policy is an HCL (or JSON) document of path stanzas. Anything not granted is denied.
293 words, about 1 min03Manage Tokens
Service tokens are persisted in the token store: renewable, with accessors, child tokens, and cubbyhole storage. Batch tokens are lightweight encrypted blobs: no storage entry, no renewal, no accessors, no children - suited to high-volume short-lived workloads.
341 words, about 2 min04Access Secrets
Static secrets (KV) are stored by Vault. Dynamic secrets are generated on demand by an engine (database, AWS, PKI) and always return lease id , lease duration , and renewable .
321 words, about 2 min05Configure Secrets Engines
Each secrets engine is enabled at a unique path: vault secrets enable -path=kv -version=2 kv . The path appears in every API call, so two KV mounts with different versions can coexist.
324 words, about 2 min06Explain Vault Architecture
A request flows: client → HTTP API (TLS) → Vault core → router → target auth method or secrets engine → barrier → storage backend. The barrier is the heart of the design: it holds the encryption key and encrypts or decrypts everything written to storage with AES-256-GCM.
345 words, about 2 min07Manage Vault Leases
A lease is Vault's promise that a secret or token stays valid for a period. Dynamic secrets always carry lease id , lease duration , and renewable .
340 words, about 2 min08Secure and Operate a Vault Deployment
Never use VAULT SKIP VERIFY outside labs. Never run vault server -dev in production: it is in-memory, pre-unsealed, uses a root token, and listens on plain HTTP.
357 words, about 2 min