VA-003 Study Guide — How to Pass HashiCorp Vault Associate

Weeks 1–2

Vault Architecture: storage backends, secrets engines, authentication methods, audit devices

Tip: Know the Vault architecture components: Secrets Engines (store and generate secrets — KV, database, AWS, PKI, TOTP), Auth Methods (authenticate identities — Token, AppRole, AWS, Kubernetes, LDAP), Policies (define what an authenticated identity can do — HCL policy language), Audit Devices (write audit logs to file, syslog, or socket).

Weeks 3–4

Authentication Methods: Token, AppRole, AWS, Kubernetes, and token types

Tip: AppRole authentication is the most tested auth method on the Vault Associate exam. Know the AppRole flow: administrator creates a role, retrieves RoleID (non-secret, can be baked into the application), application retrieves SecretID (secret, short-lived), application calls vault write auth/approle/login with both to get a token.

Weeks 5–6

Secrets Engines: KV v1 vs v2, database secrets (dynamic secrets), PKI, AWS

Tip: Dynamic secrets are the primary value proposition of Vault. Know how the database secrets engine works: Vault connects to a database → administrator configures a role (SQL statements to create/revoke credentials) → application calls Vault for a lease → Vault creates a short-lived database user → Vault revokes the user when the lease expires. No long-lived credentials exist.

Weeks 7–8

Vault Policies, Response Wrapping, Encryption as a Service, and Operations

Tip: Transit secrets engine (Encryption as a Service) is tested on Vault Associate: Vault encrypts/decrypts data for applications without the application ever having access to the key. Know the transit operations: encrypt (returns ciphertext), decrypt (returns plaintext), rewrap (re-encrypt with a new key version without decrypting first).