dc dotCreds
Reference guide

HashiCorp Vault Associate Course Notes

Study HashiCorp Vault Associate section notes, then jump straight into the guided course or related practice questions without losing your place.

Continue CourseStart PracticePDF downloads available in Pro.
Checking access

Checking Pro access...

Looking for your active Pro access before showing Course Notes. This usually takes just a moment.

Course Notes preview

Unlock Pro for the full per-exam reference guide.

Preview one piece from each section. Pro includes every Course Notes section, summary, key point, common mistake, exam tip, related-question review, and PDF export.

Includes full Course Mode and Course Notes.

Section 1Authentication methodsPreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 1 more exam tips in Pro version
  • 21 more related questions in Pro version

Summary

Auth methods prove a human/workload identity and return a Vault token. Choose the auth method that matches the platform and threat model; authorization still comes from token policies.

Key Points

  • Flow: identity/credential -> auth method -> token -> policy check.

Common Mistakes

  • Confusing auth role with ACL policy.

Exam Tips

  • Match actor to auth method.
Section 2Vault policiesPreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 1 more exam tips in Pro version
  • 19 more related questions in Pro version

Summary

Policies are default-deny ACL rules that authorize Vault API paths through capabilities. Exact paths, HTTP operations, KV-v2 prefixes, and least privilege matter.

Key Points

  • Policy = path + capabilities.

Common Mistakes

  • Believing read implies list.

Exam Tips

  • Map API path + HTTP verb to capability.
Section 3Vault tokensPreview
More in this section
  • 5 more key points in Pro version
  • 3 more common mistakes in Pro version
  • 1 more exam tips in Pro version
  • 19 more related questions in Pro version

Summary

Tokens are Vault client credentials. Know service vs batch, root discipline, accessors, TTL/periodic behavior, orphans, and token roles.

Key Points

  • Service = full lifecycle/renew/accessor/child support.

Common Mistakes

  • Using root for daily admin.

Exam Tips

  • Choose shortest practical lifetime.
Section 4Vault leasesPreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 1 more exam tips in Pro version
  • 19 more related questions in Pro version

Summary

Dynamic secrets are leased. The lease ID manages the lease, TTL bounds validity, renewal extends renewable leases, and explicit revocation invalidates immediately.

Key Points

  • Dynamic secret -> lease ID + TTL + renewability.

Common Mistakes

  • Saying revocation waits for TTL.

Exam Tips

  • Need access longer? renew/reissue.
Section 5Secrets enginesPreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 1 more exam tips in Pro version
  • 19 more related questions in Pro version

Summary

Secrets engines provide storage, dynamic credentials, PKI, crypto, and specialized secret workflows. The exam tests engine choice, static vs dynamic, response wrapping, and CLI/API/UI use.

Key Points

  • KV = static; Database/AWS/PKI-style = dynamic; Transit = cryptographic service.

Common Mistakes

  • Putting every use case in KV.

Exam Tips

  • Choose engine by lifecycle/use case.
Section 6Encryption as a ServicePreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 19 more related questions in Pro version

Summary

Transit centralizes crypto without handing applications raw keys. Encrypt/decrypt and key rotation are the explicit 003 objectives.

Key Points

  • Transit performs crypto; it does not store application plaintext as a secret.

Common Mistakes

  • Assuming rotation re-encrypts all existing data.

Exam Tips

  • Rotate keys; rewrap data; then retire old decryption versions when safe.
Section 7Vault architecture fundamentalsPreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 1 more exam tips in Pro version
  • 27 more related questions in Pro version

Summary

Vault encrypts data across an encryption barrier before storage. Sealed Vault lacks the key material for normal operations; Shamir or auto-unseal restores access. Know common client environment variables.

Key Points

  • Storage backend is untrusted; barrier encrypts before storage.

Common Mistakes

  • Confusing recovery keys with Shamir startup unseal keys.

Exam Tips

  • Think barrier/key hierarchy.
Section 8Vault deployment architecturePreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 1 more exam tips in Pro version
  • 33 more related questions in Pro version

Summary

Separate cluster HA, integrated-storage/Raft replication, Enterprise performance/DR replication, and backups. Know self-managed vs HCP Vault Dedicated responsibilities.

Key Points

  • Integrated Storage = Raft within a cluster; quorum matters.

Common Mistakes

  • Confusing replication and backup.

Exam Tips

  • Performance = scale; DR = catastrophe.
Section 9Access management architecturePreview
More in this section
  • 5 more key points in Pro version
  • 2 more common mistakes in Pro version
  • 1 more exam tips in Pro version

Summary

Vault Agent helps local apps consume Vault through auto-auth, token/lease lifecycle, templating and caching. VSO provides Kubernetes-native Vault secret synchronization.

Key Points

  • Agent auto-auth obtains and renews a token.

Common Mistakes

  • Confusing Agent with Vault Proxy.

Exam Tips

  • Local app integration -> Agent.