Vault Associate study plan

Compare token, userpass, LDAP, GitHub, and AppRole authentication methods and write a one-line note on when each is the right fit

Enable two different auth methods on a local dev Vault server and complete a successful login against each

Trace a single vault kv get request through CLI, HTTP API, core, barrier, and storage backend, and write down where authorization happens

Identify which Vault components are unavailable while the seal is engaged and explain what an operator must supply to unseal

Distinguish auth methods from token stores and state which one issues the client token in each flow

Write HCL policies that grant least privilege on a KV path, separating read from create/update capabilities

Attach policies to tokens and demonstrate that a request to an unauthorized path returns a 403 permission denied error

Create service tokens and batch tokens, then contrast their renewal, revocation, and storage behavior

Set explicit TTL and max_ttl on a token and demonstrate both renewal and revocation from the CLI

Explain the difference between a token ID and a token accessor, and revoke a token by using only its accessor

Create token roles that fix TTL, period, and policy sets, then issue tokens from each role and verify the resulting TTLs

Use response wrapping to deliver a secret to a consumer and unwrap it before the wrapping TTL expires

Read, write, version, soft-delete, and undelete a KV v2 secret using both CLI and HTTP API calls

Map KV v1 API paths to their KV v2 equivalents, explaining the /data/ and /metadata/ path segments

Consume a secret from an environment variable populated at runtime so that no credential is written into a file

Enable a KV v2 secrets engine at a custom mount path and move an existing secret from a v1 mount to it

Enable the transit secrets engine and perform an encrypt, a decrypt, and a key rotation, confirming old ciphertext still decrypts

Configure a database secrets engine against a local database and generate dynamic credentials from a role

Classify three sample secrets as static, dynamic, or leased and state which lease fields apply to each

Configure a PKI secrets engine with a root and an intermediate CA and issue a short-lived certificate from a role

Configure a cloud secrets engine role and generate dynamic cloud credentials, or reproduce the flow against a mock endpoint if no cloud account is available

Set default_lease_ttl and max_lease_ttl on a mount and observe how each changes the TTL of issued leases

Tune an existing mount's configuration and verify the change without recreating stored data

Explain which secrets engine types generate leases and which return static data with no lease

Enable a file audit device and confirm that a request appears in the audit log with sensitive values HMAC'd rather than in plaintext

Walk through seal and unseal with Shamir key shares and describe what changes operationally during a rekey

Write and execute a backup and restore procedure against a dev instance's storage backend

Explain the purpose of the barrier, the root key, and the unseal keys, and state which one never leaves Vault

Describe the access requirements for the Vault listener, storage backend, and audit device in a production deployment

Trace the full lifecycle of a leased credential from issuance through renewal to expiry, naming the TTL that governs each stage

List active leases with the sys/leases lookup endpoint and revoke a single lease by its lease ID

Revoke a lease prefix and confirm the dependent tokens and credentials are also invalidated

Diagnose a token that fails to renew and identify whether TTL, max_ttl, or a periodic token setting is the cause

Explain what happens to a client's secret when its token is revoked versus when the lease expires naturally

Complete two full-length timed practice exams and score every miss against the domain it belongs to

Re-derive from memory the policy grammar for path, capabilities, and parameter constraints without consulting notes

Re-run the weakest three lab exercises from weeks 1 through 7 until each succeeds on the first attempt

Explain aloud, in under two minutes each, how authentication, authorization, lease management, and sealing fit together

Confirm readiness by scoring at least 85 percent on the final practice exam with no domain below 70 percent