Free HashiCorp Certified: Vault Associate (003) Exam HCVA0-003 Exam Practice Test

True or False? Your organization currently runs all of its workloads on Google Cloud Platform (GCP). Recently, Vault has been deployed, and you need to select an auth method to authenticate your workloads with Vault. Based on this information, GCP is the only auth method that can be used in your environment.

• True
• False

If Bobby is currently assigned the following policy, what additional policy can be added to ensure Bobby cannot access the data stored at secret/apps/confidential but still read all other secrets? path "secret/apps/*" { capabilities = ["create", "read", "update", "delete", "list"] }

• path "secret/apps/confidential" { capabilities = ["deny"] }
• path "secret/*" { capabilities = ["read", "deny"] }
• path "secret/apps/*" { capabilities = ["deny"] }
• path "secret/apps/confidential/*" { capabilities = ["deny"] }

You have multiple Vault clusters in your environment, one for test and one for production. You have the CLI installed on your local machine and need to target the production cluster to make configuration changes. What environment variable can you set to target the production cluster?

• VAULT_REDIRECT_ADDR
• VAULT_CLUSTER_ADDR
• VAULT_ADDR
• VAULT_CAPATH

True or False? You can create and update Vault policies using the UI.

• True
• False

A MySQL server has been deployed on Google Cloud Platform (GCP) to support a legacy application. You want to generate dynamic credentials against this MySQL server rather than use static credentials. What Vault secrets engine would you use to accomplish this?

• The GCP secrets engine
• The Identity secrets engine
• The database secrets engine
• The Cubbyhole secrets engine

When an auth method is disabled all users authenticated via that method lose access.

• True
• False

After setting up a new HashiCorp Vault server with the default configurations, which method can be used to unseal Vault?

• Log on to each Vault node and provide the root token
• Running vault operator init to regenerate unseal keys and automatically unseal the Vault
• Submit a threshold of unseal keys to reconstruct the root key
• Restart the Vault service, which will automatically unseal it

When configuring Vault replication and monitoring its status, you keep seeing something called 'WALs'. What are WALs?

• Warning of allocated logs
• Write along logging
• Write-ahead logs
• Wake after LAN

Hanna is working with Vault and has been assigned a namespace called integration, where she stores all her secrets. Hanna configured her application to use the following API request, but the request is failing. What changes below will help Hanna correctly retrieve the secret? (Select two)$ curl \--header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" \--request GET \ https://vault.example.com:8200/v1/secret/data/my-secret

• $ curl --header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" --request GET\integration https://vault.example.com:8200/v1/secret/data/my-secret
• $ curl --header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" --request GET --namespace "integration" https://vault.example.com:8200/v1/secret/data/my-secret
• $ curl --header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" --request GET https://vault.example.com:8200/v1/integration/secret/data/my-secret
• $ curl --header "X-Vault-Token:hvs.lzrmRe5Y3LMcDRmOttEjWoag" --header "X-Vault- Namespace:integration" --request GET https://vault.example.com:8200/v1/secret/data/my-secret

Which of the following best describes the function of the Vault Secrets Operator in a Kubernetes environment?It replaces the Kubernetes secrets API entirely and operates purely as a certificate authority for all workloads.It is a standalone Vault server that automatically applies security policies and rotates root tokens.It continuously reconciles and synchronizes secrets from Vault to Kubernetes, ensuring secrets are always updatedIt provides an interface to dynamically provision Kubernetes clusters through Vault’s infrastructure secrets.

• Option B is incorrect— it’s not a Vault server but an operator. Option D is wrong—it syncs secrets, not provisions clusters.
• Thus, C is correct.