Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. HashiCorp
  5. Vault Associate 002

HashiCorp Vault Associate 002 Exam
HashiCorp Certified: Vault Associate (002) (Page 4 )

Updated On: 9-Feb-2026
Page 4 of 41
PDF with 200 Questions

Which is not a capability that can be used when writing a Vault policy?

  1. read
  2. list
  3. delete
  4. create
  5. modify
  6. update

Answer(s): E

Explanation:

When writing a Vault policy, permissions which can be applied to paths include create, read, update, delete, list, deny, and sudo.


Reference:

https://www.vaultproject.io/docs/concepts/policies
Modify is not one of them.



Which is not a benefit of running HashiCorp Vault in your environment?

  1. Integrate with your code repository to pull secrets when deploying your applications
  2. Consolidate static, long-lived passwords used throughout your organization
  3. Act as root or intermediate certificate authority to automate the generation of PKI certificates
  4. The ability to generate dynamic secrets for applications and resource access

Answer(s): A

Explanation:

Vault does not integrate with any VCS (Version Control System) to checkout or read code. However, It can use GitHub as an auth method.



Which of the following settings are configured using the configuration file? (select three)

  1. Cluster Name
  2. Replication
  3. Seal Type
  4. Auth Methods
  5. Namespaces
  6. Storage Backend
  7. Audit Devices

Answer(s): A,C,F

Explanation:

Seal types, Storage backends, and cluster names are just a few of the configurations done via the configuration file. The others are configured within Vault itself.



Vault's User Interface (UI) needs to be enabled in the command line before it can be used.

  1. FALSE
  2. TRUE

Answer(s): A

Explanation:

The UI is enabled in the Vault configuration file, not in the CLI.



Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (select four)

  1. Transit
  2. HSM
  3. AWS KMS
  4. Key Shards
  5. Azure KMS

Answer(s): A,B,C,E

Explanation:

When a Vault server is started, it starts in a sealed state and it does not know how to decrypt data. Before any operation can be performed on the Vault, it must be unsealed. Unsealing is the process of constructing the master key necessary to decrypt the data encryption key. Below are links covering details of each option:- https://www.vaultproject.io/docs/concepts/seal AWS KMS
https://learn.hashicorp.com/vault/operations/ops-autounseal-aws-kms Auto-unseal using Transit Secrets Engine
https://learn.hashicorp.com/vault/operations/autounseal-transit
Auto-unseal using Azure Key Vault
https://learn.hashicorp.com/vault/day-one/autounseal-azure-keyvault Auto-unseal using HSM
https://learn.hashicorp.com/vault/operations/ops-seal-wrap Key shards don't support auto unseal instead key shards require the user to provide unseal keys to reconstruct the master key
https://www.vaultproject.io/docs/concepts/seal






Post your Comments and Discuss HashiCorp Vault Associate 002 exam prep with other Community members:

Join the Vault Associate 002 Discussion