CertQuests
Exam at a glance
Questions are mostly multiple-choice and multiple-select. HashiCorp publishes a detailed Study Guide with every objective explicitly listed — it is the most reliable indicator of what will appear in the exam, and studying it alongside the official Vault documentation is the fastest preparation path. The exam can be taken online via Pearson VUE or PSI, or in-person at a testing center.
Why Vault matters in 2026
Secrets sprawl has become one of the most common root causes of enterprise security incidents. API keys committed to Git repositories, database passwords stored in environment variables, TLS certificates that expire because no one tracked them — the pattern repeats across organisations of every size. HashiCorp Vault was built to solve exactly this problem: a single platform that centralises secrets storage, enforces access policies, generates dynamic credentials with automatic expiration, and provides an audit trail for every secret access event.
In 2026, Vault is deployed at tens of thousands of organisations across cloud-native, hybrid, and on-premises environments. Kubernetes clusters use Vault’s Secrets Store CSI Driver and Vault Agent Injector to deliver secrets directly to pods without touching environment variables. CI/CD pipelines authenticate via JWT or GitHub Actions OIDC and retrieve short-lived credentials from Vault instead of storing long-lived API keys. The prevalence of Vault in enterprise environments means that engineers who cannot operate it fluently are excluded from a significant portion of senior platform engineering and DevSecOps roles.
The Vault Associate certification formalises exactly this operational knowledge. It does not require Vault development expertise — it tests the practitioner-level skill of deploying, configuring, operating, and troubleshooting a Vault cluster in production scenarios.
Exam objective areas and domain weights
HashiCorp structures the Vault Associate exam around six objective areas. Each objective area corresponds to a cluster of questions testing specific skills; the table below shows the approximate weight of each area based on the published Study Guide structure.
| Objective Area | Approx. Weight | Key Topics |
|---|---|---|
| 1. Vault Architecture | ~18% | Storage backends, seal/unseal, dev mode vs. production, HA clustering, replication |
| 2. Auth Methods | ~22% | Token, AppRole, AWS, Kubernetes, JWT/OIDC, userpass, LDAP — configuration and use-cases |
| 3. Secrets Engines | ~20% | KV v1/v2, database, PKI, AWS, transit, SSH — mount paths, versioning, rotation |
| 4. Vault Policies | ~18% | HCL policy syntax, capabilities (create/read/update/delete/list/sudo/deny), path glob matching, policy attachment |
| 5. Vault Agent & Dynamic Credentials | ~14% | Agent auto-auth and template rendering, dynamic secrets lifecycle, leases, renew, revoke |
| 6. Encryption as a Service | ~8% | Transit secrets engine, encrypt/decrypt operations, key rotation, key versioning, data key generation |
Auth methods and secrets engines together account for over 40% of the exam — this is where most preparation time pays off. The policy section rewards practice writing HCL and understanding capability inheritance; candidates who only memorise policy concepts without writing them tend to struggle with the multiple-select questions that present policy snippets and ask which operations are allowed or denied.
Objective area 1: Vault architecture
Storage backends and the seal
Vault stores encrypted data in a storage backend — Integrated Storage (Raft-based, built-in), Consul, AWS S3, Azure Blob, or others. Integrated Storage is the recommended production backend since Vault 1.4 and what most modern deployments use. The exam tests the difference between storage backends, what Vault can and cannot store there, and how the barrier encryption layer separates Vault’s data from the underlying storage system.
The seal/unseal process is consistently tested. Vault starts sealed, meaning it cannot decrypt its data. Unseal keys (derived via Shamir’s Secret Sharing, or a cloud KMS auto-unseal) reconstruct the root key. The exam tests the default 5-key / 3-threshold configuration, the auto-unseal alternatives (AWS KMS, Azure Key Vault, GCP Cloud KMS), and what happens operationally when a Vault node is restarted.
HA and replication
High-availability Vault deployments use either Integrated Storage or a backend that supports HA. Only one node is active at a time; standby nodes proxy requests to the active node or redirect clients. The exam tests the difference between Vault HA and Vault Enterprise replication (performance replication, disaster recovery replication) — HA is included in open-source Vault; cross-datacenter replication is Enterprise-only. For the Associate exam, understanding that distinction and how standby nodes behave is sufficient; deep Enterprise replication configuration is not tested.
Objective area 2: Auth methods
Token auth
Tokens are the core auth primitive in Vault. Every other auth method ultimately returns a Vault token. The exam tests token types (service tokens vs. batch tokens), token properties (TTL, max TTL, use limit, renewable, orphan), token hierarchies and parent-child revocation, and the special root token. Understanding that revoking a parent token revokes all child tokens in its hierarchy is a commonly tested concept.
AppRole
AppRole is the auth method for machine-to-machine authentication. It uses a Role ID (non-sensitive, like a username) combined with a Secret ID (sensitive, time-limited, single-use) to authenticate. The pull vs. push Secret ID delivery model is a key concept: the Secret ID should be delivered to an application out-of-band (the “secret zero” problem), not baked into a configuration. The exam tests AppRole configuration, the role_id/secret_id exchange flow, and the security trade-offs of Secret ID wrapping.
Kubernetes auth
Kubernetes auth is the most common auth method for cloud-native environments. Vault validates a pod’s service account JWT against the Kubernetes API server to confirm the pod is who it claims to be. The exam tests the three components: Vault’s Kubernetes auth configuration (token reviewer JWT, Kubernetes host, CA cert), the Vault role binding (service account names, namespaces, policies), and the pod’s token volume mount. Vault Agent Injector and the Secrets Store CSI Driver both use Kubernetes auth under the hood.
Objective area 3: Secrets engines
KV secrets engine (v1 and v2)
KV (Key-Value) is the most basic secrets engine — it stores static secrets at a path. KV v1 stores a single version of each secret; reading it returns the current value. KV v2 adds versioning: up to a configurable number of previous versions are retained, and individual versions can be soft-deleted or permanently destroyed. The exam tests the path difference (secret/data/<path> for v2 vs. secret/<path> for v1), how metadata and data are separated in v2 API calls, and the check-and-set parameter for optimistic locking.
Database secrets engine
The database secrets engine generates dynamic credentials — temporary database users created on demand with a configured TTL. When a client requests a credential, Vault creates a user in the database (PostgreSQL, MySQL, Oracle, MongoDB, etc.), returns the username and password, and revokes the user when the lease expires or when the client explicitly revokes it. This eliminates shared, long-lived database passwords entirely. The exam tests the plugin configuration, role creation with creation statements, lease TTL configuration, and how rotation of the Vault-to-database root credential works.
PKI secrets engine
The PKI secrets engine makes Vault a certificate authority. It can function as a root CA or as an intermediate CA signed by an external root. Vault generates certificates on demand with configured TTLs, roles, and permitted domains. This is the mechanism behind short-lived TLS certificates — certificates with 24-hour or 1-hour TTLs that auto-expire rather than accumulating as a management problem. The exam tests root CA vs. intermediate CA configuration, role constraints (allowed domains, max TTL, key type), and certificate issuance vs. the older offline CA workflow.
Objective area 4: Vault policies
Vault policies are written in HCL and control which operations an authenticated identity can perform at which paths. A policy grants one or more capabilities — create, read, update, delete, list, sudo, or deny — at a specific path or path glob. Policies are additive: a token that has multiple policies attached receives the union of all capabilities. The deny capability overrides everything.
The most common exam question type in the policy section presents an HCL policy and asks which API call will succeed or fail. Practice reading policies and identifying the exact capability each operation requires (avault kv putrequirescreateandupdate;vault kv getrequiresread;vault kv listrequireslist).
Path globbing uses + for a single path segment wildcard and * for a trailing wildcard. A policy at secret/data/+/config matches secret/data/myapp/config but not secret/data/myapp/env/config. This distinction is a frequent exam topic. The default policy is attached to every non-root token; the root policy grants all capabilities and is only held by root tokens.
Objective area 5: Vault Agent and dynamic credentials
Vault Agent
Vault Agent runs as a daemon alongside an application, handling the Vault authentication and token renewal lifecycle on the application’s behalf. It supports auto-auth (using any configured auth method to obtain a token automatically on startup and renew it before expiry), token caching (serving as a local proxy that forwards API calls from the application to Vault with an auto-renewed token), and template rendering (writing secrets from Vault into files on disk in whatever format the application expects). Applications that cannot natively speak the Vault API benefit most from Agent — it decouples the authentication complexity from the application entirely.
Leases, renew, and revoke
Every dynamic secret in Vault is issued with a lease — a time-to-live after which the secret expires and Vault revokes the underlying credential. Clients can renew a lease before it expires (up to the maximum TTL) to extend their credential. Leases can be explicitly revoked at any time. The exam tests the difference between TTL and max TTL, what happens to child leases when a parent token is revoked, and how lease renewal vs. credential rotation differ (renewal extends the same credential’s validity; the database engine can also rotate — create a new credential and revoke the old one).
Objective area 6: Encryption as a service
The transit secrets engine allows applications to use Vault for encryption and decryption without Vault ever storing the data. An application sends plaintext to Vault, receives ciphertext back, and stores the ciphertext in its own database. When it needs to decrypt, it sends the ciphertext to Vault and receives plaintext. Vault manages the cryptographic keys; the application never has access to them. This model makes Vault the boundary for data encryption across services, and simplifies compliance requirements for data at rest.
The exam tests the encrypt/decrypt API flow, the convergent_encryption option (same plaintext always produces the same ciphertext, useful for database lookups), key versioning and rotation (rotating a key generates a new key version; old ciphertexts can be decrypted with old key versions until explicitly re-wrapped), and the data key generation use-case (generating a data encryption key for client-side encryption of large datasets).
What changed from 001 to 002
The 002 version of the Vault Associate exam expanded coverage in three areas relative to the 001 version. First, Vault Agent receives significantly more attention — the auto-auth, caching, and templating configurations are now separate study objectives rather than a brief mention. Second, the KV v2 API distinctions (metadata vs. data paths, CAS parameters) are tested more specifically. Third, Integrated Storage as the recommended production backend is explicitly covered; the 001 exam predated Integrated Storage’s widespread adoption and placed more emphasis on Consul backend configuration. Candidates who studied for 001 and are retaking for 002 should focus most of their incremental study on Vault Agent configuration, KV v2 API behavior, and Integrated Storage internals.
Post-IBM acquisition: what changed for Vault certification
IBM completed its acquisition of HashiCorp in April 2024. Since then, the Vault certification program has continued with no structural changes — exam content, delivery partners (Pearson VUE and PSI), and the two-year validity period are all unchanged. The HashiCorp brand has been preserved for developer-facing products including Vault, Terraform, Consul, and Nomad. The Business Source License (BUSL) change that HashiCorp made to Terraform in August 2023 applied to Terraform only; Vault’s licensing was not changed and it remains available under the Mozilla Public License 2.0 for most deployment scenarios.
For certification candidates, the practical implication is straightforward: the Vault Associate 002 exam tests Vault as it exists today, the official study materials are maintained on developer.hashicorp.com, and the credential is recognised by employers in the same way it was before the acquisition. The ecosystem around Vault — integrations with Kubernetes, AWS, Azure, GCP, and the major CI/CD platforms — has continued to grow under IBM ownership.
HashiCorp offers a second Vault certification: Vault Operations Professional. The Professional exam covers Vault Enterprise features (namespaces, performance replication, disaster recovery replication, HSM integration, Vault Sentinel), advanced deployment patterns, and upgrade procedures. It requires passing the Associate exam first. For most platform engineers, the Associate is the right starting point and covers all skills needed for open-source and non-Enterprise Vault deployments. The Professional is the right path for engineers operating Vault Enterprise in regulated or multi-datacenter environments.
Salary outlook for Vault-certified engineers in 2026
Vault proficiency appears most often in job descriptions for platform engineers, site reliability engineers, DevSecOps engineers, and cloud security architects. The Vault Associate certification is typically listed alongside Terraform Associate and CKA as a credential cluster for senior platform roles. In 2026, roles that specifically require Vault skills pay:
- Platform Engineer (Vault + Kubernetes): $125k–$155k
- DevSecOps Engineer (Vault + CI/CD pipelines): $130k–$160k
- Cloud Security Architect (Vault + AWS/Azure/GCP): $145k–$185k
- Security Engineer (secrets management focus): $120k–$150k
The Vault Associate certification alone is rarely the primary differentiator in compensation — it compounds most strongly when held alongside Terraform Associate 003, CKA, and a cloud provider certification (AWS SAA-C03 or AZ-104). The combination signals the full platform engineering stack that organisations building cloud-native infrastructure on Kubernetes need.
Recommended study path (4–6 weeks)
vault server -dev). Follow the getting-started tutorial on developer.hashicorp.com. Understand the seal/unseal cycle, how dev mode differs from production, and how Vault’s HTTP API maps to CLI commands. Read the Architecture documentation page end-to-end.vault token create -policy and vault kv get flow. Practice reading a policy and identifying which API calls will succeed or fail without running them.Key study resources
- HashiCorp Study Guide (Vault Associate 002): The official objective list on developer.hashicorp.com — the single most important resource. Every exam question maps to an objective in this guide.
- HashiCorp Learn (developer.hashicorp.com/vault/tutorials): Step-by-step tutorials covering every objective area with hands-on exercises. The “Vault Basics” and “Vault Operations” learning paths cover the full Associate scope.
- Vault documentation (developer.hashicorp.com/vault/docs): Essential for auth method and secrets engine configuration details. The API reference is helpful for understanding the exact parameters tested in multiple-select questions.
- Local Vault lab: Running Vault in dev mode costs nothing and provides the fastest feedback loop for hands-on practice. Pair it with Docker to spin up PostgreSQL or other database targets for dynamic secrets practice.
Study the official documentation for the concepts you find confusing — the exam questions are phrased close to how the Vault documentation describes the feature. Candidates who study third-party summaries without reading the primary docs tend to get tripped up by question wording that mirrors the official terminology exactly.
Practice DevOps and cloud security concepts with free certification questions on CertQuests.
Browse IT Certifications →