Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. HashiCorp
  5. HCVA0-003

HashiCorp HCVA0-003 Exam
HashiCorp Certified: Vault Associate (003) (Page 7 )

Updated On: 9-Feb-2026
Page 7 of 58
PDF with 285 Questions

After issuing the command to delete a secret, you run a vault kv list command, but the path to the secret still seems to exist.
What command would permanently delete the path from Vault?

  1. vault kv delete -force kv/applications/app01
  2. vault kv destroy -versions=1 kv/applications/app01
  3. vault kv metadata delete kv/applications/app01
  4. vault kv delete -all kv/applications/app01

Answer(s): C

Explanation:

Comprehensive and Detailed in Depth
A: Soft-deletes data, not metadata. Incorrect.
B: Destroys a version, not the path. Incorrect.
C: Deletes all metadata and versions, removing the path. Correct.
D: Invalid syntax. Incorrect.
Overall Explanation from Vault Docs:
"kv metadata delete deletes all versions and metadata for the key, permanently removing it."


Reference:

https://developer.hashicorp.com/vault/docs/secrets/kv/kv-v2#key-metadata



When using the Vault Secrets Operator, where is the secret written to after being retrieved from Vault?

  1. The secret is never written to any service or persistent storage
  2. Directly to the filesystem of the pod
  3. Kubernetes Secrets
  4. To the cloud-provider's native secret manager (Azure Key Vault, AWS Secrets Manager, etc.)

Answer(s): C

Explanation:

Comprehensive and Detailed in Depth
A: Incorrect; VSO writes to Kubernetes Secrets.
B: Incorrect; not written to pod filesystem.
C: VSO syncs secrets to Kubernetes Secrets. Correct.
D: Incorrect; no automatic cloud provider integration.
Overall Explanation from Vault Docs:
"VSO synchronizes secrets from Vault to Kubernetes Secrets..."


Reference:

https://developer.hashicorp.com/vault/docs/platform/k8s/vso



A user is assigned the following policy, and they can successfully retrieve secrets using the CLI. However, the user reports receiving an error message in the UI.
Why can't the user access the secret in the Vault UI?
path "kv/apps/app01" { capabilities = ["read"] }

Successful retrieval using the CLI



(Error: Permission denied in UI)

  1. The user doesn't know what they're doing
  2. The user doesn't have permissions to retrieve the data from the UI, only the CLI
  3. The user needs list permissions to browse the UI
  4. The user's token is invalid

Answer(s): C

Explanation:

Comprehensive and Detailed in Depth
A: Irrelevant to permissions. Incorrect.
B: UI and CLI use the same permissions. Incorrect.
C: UI browsing requires list on parent paths; read alone isn't enough. Correct.
D: Token works via CLI, so it's valid. Incorrect.
Overall Explanation from Vault Docs:
"To browse the UI, users need list permissions on paths leading to the secret..."


Reference:

https://developer.hashicorp.com/vault/docs/concepts/policies#list



During a service outage, you must ensure all current tokens and leases are copied to another Vault cluster for failover so applications don't need to authenticate. How can you accomplish this?

  1. Have Vault write all the tokens and leases to a file so you have a second copy of them
  2. Configure all applications to use the auto-auth feature of the Vault Agent
  3. Configure Disaster Recovery replication and promote the secondary cluster during an outage
  4. Replicate to another cluster using Performance Replication and promote the secondary cluster during an outage

Answer(s): C

Explanation:

Comprehensive and Detailed in Depth
A: Insecure and manual; not a Vault feature. Incorrect.
B: Auto-auth doesn't replicate tokens/leases. Incorrect.
C: DR replication mirrors tokens and leases; promotion enables failover. Correct.
D: Performance replication doesn't replicate tokens fully. Incorrect.
Overall Explanation from Vault Docs:
"Disaster Recovery replication mirrors tokens and leases... Promote the secondary during an outage."


Reference:

https://developer.hashicorp.com/vault/docs/enterprise/replication#replicated-data



You logged into the Vault CLI and attempted to enable an auth method, but you received this error message.
What can you do to resolve the error and configure Vault? (Error: dial tcp 127.0.0.1:8200: connect: connection refused)

  1. Restart the Vault service on this node
  2. Ask an admin to grant you permission to enable the userpass auth method
  3. Change 'userpass' to 'username and password'
  4. Set the VAULT_ADDR environment variable to HTTP

Answer(s): D

Explanation:

Comprehensive and Detailed in Depth
A: Connection refused isn't a service issue here. Incorrect.
B: Permissions don't cause connection errors. Incorrect.
C: Invalid syntax change. Incorrect.
D: Default VAULT_ADDR is HTTPS; if TLS is off, set to http://127.0.0.1:8200. Correct.
Overall Explanation from Vault Docs:
"If TLS is disabled, set VAULT_ADDR to http://127.0.0.1:8200 to avoid connection errors..."


Reference:

https://developer.hashicorp.com/vault/docs/commands#vault_addr






Post your Comments and Discuss HashiCorp HCVA0-003 exam prep with other Community members:

Join the HCVA0-003 Discussion