Vault Associate study guide · 2026

The 9 Vault Associate domains, explained

9 areas and 40 objectives. HashiCorp does not publish weights for these areas, so each gets equal space here. Each guide explains what the area covers, how it is assessed and where candidates slip.

Start with Domain 1 See all domains
Questions
~57 multiple-choice questions (not published by HashiCorp; varies)
Time
60 minutes
Passing score
Not published by HashiCorp
Outline
Vault Associate (003) exam content list, tested against Vault 1.19 (current)

Exam blueprint

HashiCorp does not publish weights, so every area is drawn the same size.

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  1. 1 Authentication methods
  2. 2 Vault policies
  3. 3 Vault tokens
  4. 4 Vault leases
  5. 5 Secrets engines
  6. 6 Encryption as a service
  7. 7 Vault architecture fundamentals
  8. 8 Vault deployment architecture
  9. 9 Access management architecture

All 9 domains

40 official objectives 43–59 hrs suggested study

  1. Domain 01

    Authentication methods

    The first objective group of the Vault Associate (003) exam: what auth methods do, how to pick one for a human or a machine, how identities and groups tie logins together, and how to enable and use auth methods from the CLI, API and UI.

    Inside this domain

    • Define the purpose of authentication methods
    • Choose an authentication method based on use case
    • Explain the difference between human vs. system authentication methods
    • Define the purpose of identities and groups
    • and 2 more objectives

    Watch for Userpass for apps

    Objectives
    6
    Questions est.
    ~9
    Study time est.
    6–8 hrs
  2. Domain 02

    Vault policies

    Vault policies decide what a token may do. This group tests why policies matter, how path and capabilities syntax work, how to choose a policy that meets a requirement, and how to write and attach policies from the UI and CLI.

    Inside this domain

    • Explain the value of Vault policies
    • Describe Vault policy syntax: path
    • Describe Vault policy syntax: capabilities
    • Choose a Vault policy based on requirements
    • and 1 more objectives

    Watch for Glob in the middle

    Objectives
    5
    Questions est.
    ~7
    Study time est.
    5–7 hrs
  3. Domain 03

    Vault tokens

    Tokens are the core credential in Vault. This group tests service versus batch tokens, root token lifecycle, accessors, TTL behavior, orphan tokens, and how to create a token that fits a particular need.

    Inside this domain

    • Choose between service and batch tokens based on use case
    • Describe root token uses and lifecycle
    • Explain the purpose of token accessors
    • Explain the impact of time-to-live
    • and 2 more objectives

    Watch for Renew a batch token

    Objectives
    6
    Questions est.
    ~9
    Study time est.
    6–8 hrs
  4. Domain 04

    Vault leases

    Leases attach a lifetime to dynamic secrets and service tokens. This compact group covers what a lease ID is for, how renewal works within max TTL limits, and how leases are revoked singly or by prefix.

    Inside this domain

    • Explain the purpose of a lease ID
    • Describe how to renew leases
    • Describe how to revoke leases

    Watch for Increment adds time

    Objectives
    3
    Questions est.
    ~4
    Study time est.
    3–5 hrs
  5. Domain 05

    Secrets engines

    The largest Vault Associate objective group. It covers what secrets engines are, how to choose one, dynamic versus static secrets, transit, response wrapping, and enabling engines and reading secrets through the CLI, API and UI.

    Inside this domain

    • Choose a secrets engine based on use case
    • Compare and contrast dynamic secrets vs. static secrets, and know their use cases
    • Describe the uses of transit secrets engine
    • Describe the purpose of secrets engines
    • and 4 more objectives

    Watch for KV for expiring creds

    Objectives
    8
    Questions est.
    ~11
    Study time est.
    8–10 hrs
  6. Domain 06

    Encryption as a service

    A short, hands-on objective group about the transit engine in practice: encrypting and decrypting data through Vault and rotating encryption keys while existing ciphertext stays readable.

    Inside this domain

    • Encrypt and decrypt secrets
    • Rotate the encryption key

    Watch for Rotation breaks data

    Objectives
    2
    Questions est.
    ~3
    Study time est.
    3–4 hrs
  7. Domain 07

    Vault architecture fundamentals

    How Vault protects its own data and how operators interact with it: the encryption barrier and key hierarchy, sealing and unsealing including auto-unseal, and the environment variables the CLI relies on.

    Inside this domain

    • Describe how Vault encrypts data
    • Explain how to seal and unseal Vault
    • Configure environment variables

    Watch for Unseal keys encrypt data

    Objectives
    3
    Questions est.
    ~4
    Study time est.
    4–6 hrs
  8. Domain 08

    Vault deployment architecture

    How Vault is deployed and kept available: cluster strategy for self-managed and HashiCorp-managed Vault, storage backends, Shamir secret sharing, disaster recovery and performance replication, and the trade-offs between running Vault yourself and using HCP.

    Inside this domain

    • Explain cluster strategy for self-managed and HashiCorp-managed Vault clusters
    • Explain the uses of storage backends
    • Explain the uses of Shamir secret sharing and unsealing
    • Explain the uses of disaster recovery and performance replication
    • and 1 more objectives

    Watch for DR for latency

    Objectives
    5
    Questions est.
    ~7
    Study time est.
    5–7 hrs
  9. Domain 09

    Access management architecture

    Client-side tools that bring secrets to applications without changing their code: Vault Agent with auto-auth and templating, and the Vault Secrets Operator that syncs Vault secrets into Kubernetes Secrets.

    Inside this domain

    • Describe the Vault Agent
    • Describe the Vault Secrets Operator

    Watch for Rewrite the app

    Objectives
    2
    Questions est.
    ~3
    Study time est.
    3–4 hrs

Suggested study order

No official weights are published, so follow the outline order, across about 43–59 hrs of study.

  1. 1 Authentication methods 6–8 hrs
  2. 2 Vault policies 5–7 hrs
  3. 3 Vault tokens 6–8 hrs
  4. 4 Vault leases 3–5 hrs
  5. 5 Secrets engines 8–10 hrs
  6. 6 Encryption as a service 3–4 hrs
  7. 7 Vault architecture fundamentals 4–6 hrs
  8. 8 Vault deployment architecture 5–7 hrs
  9. 9 Access management architecture 3–4 hrs

Try one

Practice questionDomain 1: Authentication methods

An organization runs microservices on EC2 instances and wants them to authenticate to Vault without storing any long-lived credentials on the instances. Developers already sign in through the corporate OIDC provider. Which auth method should the microservices use?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Userpass for apps

    Clue The client is a pipeline, script or service.

  • Domain 2

    Glob in the middle

    Clue A wildcard is needed between two fixed segments.

  • Domain 3

    Renew a batch token

    Clue The workload needs renewal or a longer run.

  • Domain 4

    Increment adds time

    Clue Renewal output shows a smaller TTL than expected.

  • Domain 5

    KV for expiring creds

    Clue The requirement says credentials must expire or be unique.

  • Domain 6

    Rotation breaks data

    Clue Old vault:v1: ciphertext must still be read.

  • Domain 7

    Unseal keys encrypt data

    Clue The question asks which key encrypts stored data.

  • Domain 8

    DR for latency

    Clue The goal is faster reads elsewhere.

Other Cybersecurity certifications

Study guides for exams that overlap with Vault Associate.

Practise what you read

Vault Associate domains: common questions

How many domains are in the Vault Associate exam?

Vault Associate has 9 domains with 40 official objectives between them: Authentication methods, Vault policies, Vault tokens, Vault leases, Secrets engines, Encryption as a service, Vault architecture fundamentals, Vault deployment architecture and Access management architecture.

What is the Vault Associate exam format?

Questions: ~57 multiple-choice questions (not published by HashiCorp; varies). Time allowed: 60 minutes. Passing score: Not published by HashiCorp.

How long should I study for Vault Associate?

Our planning estimate is 43–59 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Work through the areas in order, since each builds on the one before. Use the checklist on each page to confirm you can do what it asks before moving on.

Which outline is this guide based on?

This guide follows Vault Associate (003) exam content list, tested against Vault 1.19 (current), published by HashiCorp. It was last reviewed in October 2026.

Domain names, weights and objectives come from HashiCorp's official outline (Vault Associate (003) exam content list, tested against Vault 1.19 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.