Vault Associate

HashiCorp restructured its certification program in 2023, and VA-003 is the version of the Vault Associate exam that came out of that change — it now runs through PSI's online proctoring instead of the older Kryterion setup, and the objectives were refreshed to reflect how Vault is actually used in production today, not just how it looked a few versions ago. If you studied from an older guide referencing VA-002, some of what you learned still applies, but the objective list has shifted enough that it's worth re-checking before exam day. This page is built around the current VA-003 blueprint.

What VA-003 Exam Actually Tests

VA-003 is not a deep operations exam. It checks whether you understand Vault's core concepts well enough to reason about them — not whether you can tune a production HA cluster from scratch. The objective domains include:

• Secrets engines — the difference between KV v1 and v2, dynamic vs. static secrets, and when engines like Database, PKI, or Transit are the right fit

• Authentication methods — how AppRole, LDAP, Userpass, and Kubernetes auth differ, and what each is suited for

• Policies — reading and writing HCL-based Vault policies, path-based permissions, and capability grants (read, create, update, delete, list, sudo)

• Tokens — token types (service vs. batch), TTLs, renewal, and revocation behavior

• Leases and dynamic secrets — how leases tie to the lease ID, renewal windows, and what happens on expiration

• Vault architecture — the storage backend vs. the barrier, the seal/unseal process, Shamir's Secret Sharing, and auto-unseal options

• High availability and replication concepts — at a conceptual level, not configuration syntax

• CLI and API basics — recognizing correct vault command syntax and interpreting output, plus basic config file structure

Candidates consistently underestimate how much of this exam is about concepts and relationships between features rather than memorized command flags. You're tested on knowing why you'd pick Transit over KV for a given use case, not on reciting every subcommand.

Who Actually Takes VA-003 Exam

The candidate pool splits into two groups. The larger group is platform and DevOps engineers who already use Vault at work — often just for a KV store or database credential rotation — and are sitting the exam to formalize knowledge they've picked up piecemeal. The second group is security engineers moving from a compliance or IAM background who need Vault fluency to speak the same language as their platform team, but haven't necessarily run a cluster themselves. Very few people take VA-003 as their first HashiCorp exam cold; most have at least touched Terraform or another HashiCorp product first, which is why comparisons to Terraform's workflow occasionally show up in study discussions even though the exam itself doesn't test Terraform.

VA-003 Exam Format and What Trips People Up

The official VA-003 exam is multiple-choice and multiple-select, delivered online through PSI proctoring (a webcam and ID check are required, and the room needs to be clear of notes and second monitors). HashiCorp does not publish the exact passing score or a fixed question count publicly, and both can shift between exam refreshes, so treat any number you see quoted elsewhere as approximate rather than official — check the current PSI candidate handbook for what's in effect when you register.

The recurring failure pattern is not running out of time — it's second-guessing questions that test the difference between similar-sounding features. The three places this shows up most:

• Confusing KV v2's versioning behavior with how leases and dynamic secrets expire — they're unrelated mechanisms that get mentally merged

• Mixing up token TTL vs. lease TTL — a token can outlive or be shorter than the secrets it's used to fetch, and the exam tests that distinction directly

• Misreading policy capability strings — mistaking list for implying read, or assuming sudo is required more often than it actually is

How to Use Practice Questions Effectively for VA-003

Because this exam rewards conceptual clarity over command memorization, drilling flashcard-style on CLI syntax alone won't get you far. When you miss a practice question, don't just note the correct answer — open the relevant page in Vault's own documentation and check why the other three options were wrong. VA-003 questions are frequently written so that two of four options are technically true statements about Vault, just not true in the specific scenario described. Practicing that scenario-reading skill matters more than raw repetition.

If you have access to even a local dev-mode Vault instance (vault server -dev), spend twenty minutes writing and testing a couple of policies by hand before you sit more practice questions. Seeing a policy actually deny an operation you expected it to allow does more for retention than reading about capability grants.

Common Mistakes Candidates Make on VA-003 Exam Specifically

• Treating auto-unseal as functionally identical to the Shamir unseal process rather than understanding it removes the manual key-share step entirely

• Assuming every secrets engine issues dynamic, short-lived credentials — KV is static, and this trips up people who learned Vault primarily through the Database or AWS secrets engines

• Not distinguishing root tokens from regular service tokens when a question describes token capabilities

• Underestimating how many questions reference Vault Enterprise-only features just to test whether you know they're Enterprise-only, not because you need to configure them

Study Tips Specific to VA-003 Exam

Read the actual Vault Associate study guide HashiCorp publishes on its certification page before touching third-party material — it lists the exact objective domains, and VA-003 questions map to those domains closely enough that skipping straight to random online question banks means you might drill topics that are barely tested while missing ones that show up repeatedly. Pair that with the "Vault concepts" section of the official docs (barrier, storage backend, seal) rather than blog summaries of it, since exam wording tends to mirror the docs' own terminology closely.

Next Step

Work through the free practice questions below in blocks of ten, and after each block, cross-reference every question you got wrong against the matching page in Vault's official documentation rather than just the answer key. That habit — checking the doc, not just the answer — is what actually closes the gap between "I recognize this concept" and "I can apply it under exam conditions."