HVA-002
HVA-002
HashiCorp
Vault Associate 002
The HVA-002 training teaches Vault concepts, architecture, authentication methods, policies, and secret engines, enabling practitioners to configure and manage secure secret storage and access in production environments.
60
Minutes
57
Questions
70/100
Passing Score
$70.5
Exam Cost
1
Languages
Who Should Take This
It is intended for DevOps engineers, system administrators, and security professionals who already work with infrastructure automation and need to implement secret management at scale. These learners typically have a few years of experience with Linux, cloud platforms, and basic scripting, and they aim to validate their ability to deploy and operate HashiCorp Vault in real‑world production settings.
What's Covered
1
Understand what Vault is, its use cases, and the problems it solves for secrets management, data protection, and identity-based access.
2
Understand Vault architecture including storage backends, seal/unseal process, and cluster configuration.
3
Configure and use auth methods including token, userpass, AppRole, LDAP, and cloud-based methods.
4
Write and manage Vault policies using HCL and JSON to control access to secrets paths.
5
Configure and use secrets engines including KV v1/v2, Transit, PKI, database, and cloud secrets engines.
6
Use the Transit secrets engine for encryption, decryption, key rotation, and data protection without storing secrets.
7
Understand token types, hierarchies, accessors, TTLs, and periodic tokens.
8
Understand lease concepts, renewal, and revocation for dynamic secrets.
9
Understand HA concepts including leader election, replication modes, and disaster recovery.
Exam Structure
Question Types
- Multiple Choice
- Multiple Response
- Fill In The Blank
Scoring Method
Percentage-based, 70% to pass
Delivery Method
Online proctored via PSI
Recertification
Valid for 2 years. Recertify by passing the current exam version.
What's Included in AccelaStudy® AI
Adaptive Knowledge Graph
Practice Questions
Lesson Modules
Console Simulator Labs
Exam Tips & Strategy
20 Activity Formats
Course Outline
57 learning goals
1
Vault Concepts
1 topic
Secrets Management Fundamentals
- Describe the problems Vault solves including secrets sprawl, static credentials, lack of audit trails, and manual secret rotation
- Identify Vault use cases including secrets management, data encryption, identity-based access, and dynamic credentials for cloud and database platforms
- Describe the difference between static secrets and dynamic secrets and explain why dynamic short-lived credentials reduce the blast radius of credential compromise
- Analyze a credential management scenario to determine which Vault capabilities address specific security requirements for secret storage, rotation, and access control
- Describe Vault's identity-based access model and explain how entities, aliases, and groups enable unified identity across multiple auth methods
- Explain the principle of least privilege as applied to Vault and describe how short-lived credentials, fine-grained policies, and audit logging enforce zero-trust access
2
Vault Architecture
2 topics
Core Architecture Components
- Describe Vault's architecture including the barrier, storage backend, secrets engines, auth methods, audit devices, and the system backend
- Describe storage backend options including Integrated Storage (Raft), Consul, and cloud-managed options and explain their trade-offs for production deployments
- Describe the seal/unseal process including Shamir's Secret Sharing, the master key, encryption key, and how auto-unseal with cloud KMS simplifies operations
- Implement Vault server initialization using vault operator init to generate unseal keys and the initial root token for first-time cluster setup
- Analyze Vault architecture decisions to recommend storage backend, seal mechanism, and listener configuration for a given availability and security requirement
- Implement Vault configuration using HCL config files to specify listener, storage, seal, and telemetry settings for production server deployment
Audit and Dev Server
- Implement audit device configuration to enable file, syslog, or socket audit logging for compliance and forensic analysis of all Vault operations
- Describe the Vault dev server mode and explain how it differs from production configuration including in-memory storage, auto-unseal, and root token behavior
- Describe Vault's secrets engine mount system and explain how enabling, disabling, tuning, and moving mounts at specific paths organizes secrets access
- Implement the Vault CLI and API to interact with secrets engines, auth methods, and system operations using vault read, write, list, and delete commands
3
Authentication Methods
1 topic
Auth Method Configuration
- Describe the purpose of auth methods in Vault and explain how they verify identity and assign policies to authenticated entities
- Implement the token auth method including direct token creation, orphan tokens, and token role configuration for automated token generation
- Implement the userpass auth method for human operator authentication with username/password credentials and associated policy mappings
- Implement the AppRole auth method for machine-to-machine authentication using role IDs and secret IDs with configurable CIDR restrictions
- Describe LDAP and OIDC auth methods and explain how they integrate Vault authentication with existing enterprise identity providers
- Analyze authentication requirements for a mixed human and machine environment to recommend appropriate auth method combinations and policy assignments
- Describe cloud-based auth methods including AWS, Azure, and GCP and explain how they leverage cloud provider identity metadata for automatic machine authentication
4
Vault Policies
1 topic
Policy Authoring and Management
- Describe Vault policy syntax in HCL including path matching, capabilities (create, read, update, delete, list, sudo, deny), and parameter constraints
- Implement Vault policies to grant least-privilege access to specific secrets engine paths with appropriate capability sets
- Implement glob patterns and path templating in policies using identity attributes to create dynamic, identity-aware access rules
- Describe the default and root policies and explain how policy attachment to tokens determines the effective permission set through policy intersection
- Analyze overlapping policy rules to determine the effective capability set for a given token and path combination and identify overly permissive configurations
- Implement policy testing using vault policy read and vault token capabilities to verify that policies grant the intended access before deploying to production
5
Secrets Engines
2 topics
KV Secrets Engine
- Describe the differences between KV v1 (unversioned) and KV v2 (versioned) secrets engines including metadata, soft delete, and version history
- Implement KV v2 secrets engine operations including put, get, delete, undelete, destroy, and metadata management for secret versioning
- Configure KV v2 settings including max-versions, cas-required (check-and-set), and delete-version-after to enforce secrets lifecycle policies
- Implement secrets engine enable, disable, and tune operations to mount engines at custom paths and configure default lease TTLs
Dynamic Secrets Engines
- Implement the database secrets engine to generate dynamic, time-limited database credentials with configurable roles and TTLs
- Implement the AWS secrets engine to generate dynamic IAM credentials including IAM users, assumed roles, and federation tokens with scoped policies
- Describe the PKI secrets engine and explain how it issues dynamic X.509 certificates for TLS with configurable roles, TTLs, and key parameters
- Analyze dynamic secrets engine selection for a given use case to recommend the appropriate engine based on credential type, TTL requirements, and security posture
- Implement the PKI secrets engine to configure a root CA, issue intermediate certificates, and generate leaf TLS certificates with configurable TTLs and SANs
6
Encryption as a Service
1 topic
Transit Secrets Engine
- Describe the Transit secrets engine and explain how it provides encryption as a service without exposing encryption keys to applications
- Implement Transit engine operations including encrypt, decrypt, rewrap, and sign/verify for data protection and integrity verification
- Implement key rotation on Transit encryption keys and explain how rewrap operations update ciphertext to use the latest key version without exposing plaintext
- Analyze encryption key management requirements to determine appropriate key types (aes256-gcm96, rsa-2048, ecdsa-p256) and convergent encryption settings
- Implement convergent encryption using the Transit engine to enable deterministic ciphertext generation for indexed lookups on encrypted data
7
Vault Tokens
1 topic
Token Types and Management
- Describe Vault token types including service tokens, batch tokens, and periodic tokens and explain their use cases, storage characteristics, and performance trade-offs
- Describe the token hierarchy including parent-child relationships, orphan tokens, and how revoking a parent token cascades to all child tokens
- Implement token creation with configurable TTL, max-TTL, policies, and metadata using the token auth method or token create API
- Implement token lookup and renewal operations using token accessors and explain how accessor-based management enables token administration without exposing the token itself
- Analyze token TTL and renewal behavior to design appropriate token lifecycle policies that balance security (short TTLs) with operational convenience (fewer renewals)
- Implement token roles to define reusable token creation templates with predefined policies, TTLs, and token types for standardized token generation
8
Leases and Renewal
1 topic
Lease Management
- Describe the Vault lease system and explain how leases track the validity period of dynamic secrets, tokens, and auth method credentials
- Implement lease renewal and revocation using the sys/leases API and vault lease commands to manage dynamic credential lifecycles
- Analyze lease accumulation patterns to identify credential lifecycle issues and recommend max-TTL and revocation strategies that prevent lease exhaustion
- Implement prefix-based lease revocation to bulk-revoke all leases under a specific secrets engine path during incident response or decommissioning
9
High Availability
1 topic
HA and Replication
- Describe Vault high availability concepts including active/standby nodes, leader election, and request forwarding for uninterrupted secrets access
- Describe Vault replication modes including disaster recovery replication and performance replication and explain their use cases for multi-datacenter deployments
- Analyze high availability requirements to recommend appropriate Vault deployment topology including cluster size, storage backend, and replication configuration
- Describe the Integrated Storage (Raft) consensus protocol and explain how leader election, log replication, and snapshot management provide built-in HA without external storage dependencies
Certification Benefits
Salary Impact
$140,000
Average Salary
Related Job Roles
Security Engineer
DevOps Engineer
Platform Engineer
Cloud Security Architect
Infrastructure Engineer
Industry Recognition
The Vault Associate certification validates proficiency with the industry's leading secrets management platform, highly valued in security-conscious organizations.
Scope
Included Topics
- HashiCorp Vault Associate 002 exam objectives: Vault concepts including secrets management and data protection, Vault architecture including storage backends, seal/unseal, and clusters, authentication methods including token, userpass, AppRole, LDAP, and OIDC, Vault policies and access control, secrets engines including KV, Transit, PKI, database, and AWS, encryption as a service with the Transit engine, Vault tokens including types, accessors, and TTLs, lease management and renewal, and high availability concepts including replication and disaster recovery.
Not Covered
- Vault Enterprise advanced features (Sentinel, namespaces, performance replication details)
- Custom plugin development for auth methods or secrets engines
- HashiCorp Consul or Nomad integration details
- Vault Agent templating and auto-auth deep dives
- Vault CSI provider for Kubernetes
- Terraform Vault provider configuration
- Cloud-specific auto-unseal key management service internals
Official Exam Page
Learn more at HashiCorp
Ready to master HVA-002?
Adaptive learning that maps your knowledge and closes your gaps.
Subscribe to Access