HashiCorp Vault Associate
The HashiCorp Vault tool page teaches the mechanism — dynamic database credentials, the transit engine, AppRole and Kubernetes auth. This page profiles the vendor credential that checks whether you learned it: HashiCorp Certified: Vault Associate, a single-product, knowledge-based multiple-choice exam covering auth methods, policies, secrets engines, tokens and leases, and Vault's architecture at a foundational level. It is not a general secrets-management credential and it is not a DevSecOps credential at all — it is a proof point that reads clearly to exactly one audience: a hiring manager or team lead who already knows their organization runs Vault and wants a fast, cheap signal that a candidate isn't starting from zero on it.
Imagine your school only ever uses one specific brand of calculator, and there's a short quiz just about that calculator — which button does what, how to switch modes, what the error codes mean. Passing it proves you know that calculator. It doesn't prove you're good at math in general, and a school that uses a different calculator brand won't care about it at all. That's this exam: real, useful, narrow, and only worth taking if you already know everyone around you is holding the same calculator.
What this credential actually is
☺ Like you're 10: It's a short, closed-book quiz about one specific product — not a hands-on test, and not a test about security in general.
HashiCorp Certified: Vault Associate sits at the Associate tier of HashiCorp's own certification ladder, alongside similarly-scoped Associate exams for Terraform and Consul, with a smaller set of Professional-tier exams above it. It is issued directly by HashiCorp — now operating as part of IBM following the acquisition announced in 2024 and completed in 2025, a detail worth double-checking on the vendor's site since certification-program branding and ownership are exactly the kind of thing that shifts quietly after an acquisition like that. Unlike the CKA or CKS profiled elsewhere in this section, it is entirely knowledge-based: multiple-choice and multiple-select questions delivered in a proctored online session, with no live Vault instance to operate and nothing graded on end state. You are not asked to write a policy in a terminal and watch it take effect — you are asked to recognize which policy syntax, which auth-method behavior, or which secrets-engine capability is correct from a list.
The published objectives track the same conceptual model this course already teaches on the Vault tool page: auth methods, policies, tokens, leases, secrets engines, and the architecture underneath them (seal/unseal, storage backends, high availability). If you've worked through that page and actually run the commands in it, you already have the shape of this exam in your head — what's left is memorizing the edges: exact CLI flag names, which secrets engine supports which capability, and how Vault's terminology maps onto its own documentation's wording.
This is a product certification, not a discipline certification. It certifies "I know how Vault works," full stop — not "I know how to secure secrets in general" the way CISSP or a role-based credential does, and not "I can operate Vault under pressure" the way a performance-based exam like the CKA does. Read the name literally: it names the vendor before it names anything else.
Format, cost, and prerequisites — verify before you book
☺ Like you're 10: Here's roughly what to expect and what it costs — but HashiCorp changes these details more quietly than the big cloud vendors do, so check their page first.
The details below reflect what HashiCorp has generally published for its Associate-tier exams and what candidates commonly report. Treat every number as a planning estimate, not a guarantee — HashiCorp's exam platform, question counts, and pricing have all changed before without much fanfare, and the IBM acquisition adds one more reason to confirm nothing has moved since this page was written.
| Item | What is generally published |
|---|---|
| Format | Online, remotely proctored (or at a testing center in some regions) — multiple choice and multiple select, closed book, no live Vault environment |
| Duration | Around 60 minutes |
| Question count | Roughly 57 questions — confirm the current count, HashiCorp has adjusted this before across exam versions |
| Passing score | Not publicly disclosed by HashiCorp as an exact percentage, unlike AWS's or the CNCF's published cut scores |
| Price | Around USD $70.50 list, in line with HashiCorp's other Associate-tier exams — regional pricing varies |
| Validity | 2 years from the date you pass |
| Retake policy | A waiting period between attempts has historically applied, and the fee is charged again each attempt — check the current wait window before scheduling a retake |
| Prerequisites | None formally enforced. HashiCorp's own study guidance points to roughly six months of hands-on Vault experience as the realistic bar, not a hard gate |
| Exam version | HashiCorp has revised this exam's version number before (it is not a single unchanging "001") — confirm which version's objectives you're studying against |
Every number in that table can change, and HashiCorp changes them with less public fanfare than AWS or the Linux Foundation do. This site is independent and unofficial. Confirm current format, price, question count, and objectives directly on HashiCorp's certification page before paying for anything, and specifically check whether the certification program's branding, delivery platform, or ownership details have shifted since the 2024–2025 IBM acquisition — that transition is recent enough that details published even a few months apart may already disagree.
The published objectives, and where each one lives on the Vault tool page
☺ Like you're 10: Unlike some exams, HashiCorp doesn't publish a percentage for each topic — just a list of things you need to know. Here's that list, mapped to what you already read on the Vault page.
HashiCorp's Associate-tier study guides typically publish a flat list of objectives rather than the weighted-percentage domains you'll see on CKA or AWS Security – Specialty. That's a real difference worth knowing before you study: there is no official "this topic is worth 30% of the exam" the way there is for those. Treat every objective below as roughly equally likely to appear, and confirm the exact current wording against HashiCorp's own exam-review page rather than this list, since objective wording has been revised between exam versions before.
Spelled out, the nine objectives this exam version has generally published are: (1) compare authentication methods; (2) create Vault policies; (3) assess Vault tokens; (4) manage Vault leases; (5) compare and configure Vault secrets engines; (6) explain Vault architecture; (7) explain the Vault security model; (8) manage the lifecycle of secrets and certificates; (9) use the Vault CLI, API, and UI to interact with Vault, including Vault Agent. Every one of these maps directly onto material already on the Vault tool page: objectives 1–3 are the auth-method and policy walkthrough (AppRole, Kubernetes auth, default-deny HCL policies); objectives 4–5 and 8 are the dynamic-secrets and transit-engine sections, plus lease renewal and revocation; objectives 6–7 are the barrier, seal/unseal, and storage-backend material; objective 9 is the day-to-day command reference and the Vault Agent Injector coverage. Broader Vault-adjacent identity material — how a workload actually proves itself before it ever reaches Vault — is covered in more depth in workload identity & pipeline IAM, and Vault's PKI and transit capabilities connect to cryptography & key management.
How this relates to DevSecOps — and where it doesn't
☺ Like you're 10: This exam proves you know one tool well. It doesn't prove you know how to keep secrets safe in general — that's a bigger skill this whole course teaches, with or without Vault in the picture.
The concept this credential tests — centralized, policy-gated, dynamically-issued secrets instead of static credentials scattered through config files — is core DevSecOps material, covered on this course's own secrets management page independent of any one vendor. What the Vault Associate exam adds is not that concept; it's fluency in exactly one implementation of it. That distinction matters when you're deciding what this credential signals to someone reading a resume: it says "this person has spent real time inside Vault specifically," not "this person understands secrets management as a discipline." A candidate could pass this exam and never have reasoned about, say, why a database's root rotation matters, or how a leaked lease ID differs from a leaked static password — those are the concepts this course teaches, and this exam assumes rather than tests them.
The reverse is also true and worth saying plainly: a strong DevSecOps engineer who has never touched Vault — because their organization runs AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager instead, all covered in the comparison table on the Vault tool page — loses nothing by skipping this exam. It certifies depth in one product among several credible choices, not a gap in security knowledge.
Because this exam is knowledge-based multiple choice, not performance-based like the CKA or CKS, passing it does not certify that you can actually operate a production Vault cluster under pressure — restore from a Raft snapshot during an incident, debug a policy that's silently denying a path, or reason live about why a lease didn't renew. Those are exactly the skills the tool page's command reference and gotchas section were written to build, and they're demonstrated by having actually run Vault, not by a multiple-choice score.
Who should sit it, and who should skip it
☺ Like you're 10: Take it if your team's toolbox already has this exact tool in it. Otherwise, there's probably a better use of your study time.
Sit it if your organization has genuinely standardized on Vault as its secrets-management platform — self-hosted or HCP — and you're the person (or about to become the person) who administers policies, auth methods, and secrets engines day to day. It's also a reasonable, low-cost way to structure your own study of Vault if you're new to the product but your team already runs it: working through the objectives is a decent forcing function for reading the parts of Vault's documentation you might otherwise skip. And it's a fast, cheap signal for a hiring manager who already knows their stack includes Vault and wants some evidence a candidate isn't starting from zero.
Skip it, at least for now, if any of these fit. Your organization doesn't run Vault — a cloud-native secrets store covers your actual day job, and this credential won't be legible to anyone evaluating you against that stack. You already operate Vault in production daily — the exam will teach you little you don't already know from doing the job, and your time is better spent on a credential that stretches you, like CKS if Kubernetes is also in your stack. You're looking for a general security or DevSecOps credential to put on a resume — this one won't read as that to anyone who knows what it is; look at CISSP, CSSLP, or this course's own practitioner-level credential instead. And you haven't used Vault at all yet — work through the tool page and the secrets management lesson hands-on first; a multiple-choice exam is a poor way to meet a tool for the first time.
Nutty: I filed this one under "verify before repeating" — HashiCorp doesn't publish a cut score, and the whole company changed hands to IBM recently. I'm not putting an exact percentage in the glossary until I've checked it twice.
Ellie: The content underneath doesn't move as fast, though. Auth methods, policies, secrets engines, leases — that's the same shape whether the logo on the certificate changes or not.
Foxy: Wait, so if I pass this, does it prove I could actually run Vault in an incident? Restore a snapshot, debug a policy, all of that?
Ellie: No. It's multiple choice — no live cluster, nothing graded on end state. It proves you know the concepts. Running the thing under pressure is what the tool page's command reference and gotchas section are actually for.
Timmy: So it's not a gate on anything in our pipeline. Nobody's blocking a merge because of it.
Ellie: Right — it's a resume signal, not a pipeline control. Worth having if your team lives in Vault every day. Not worth chasing if it doesn't.
1. Is the HashiCorp Vault Associate exam performance-based or knowledge-based, and what does that mean for what a passing score actually proves? 2. Name at least four of the nine published objectives. 3. Why doesn't this page publish percentage weights for those objectives the way the CKA and AWS Security – Specialty pages do? 4. Give one concrete reason a strong DevSecOps engineer might reasonably never take this exam. 5. Give one concrete reason a team that has standardized on Vault might value it anyway.
Check your answers
- Knowledge-based — multiple choice and multiple select, proctored online, with no live Vault instance to operate. A passing score proves familiarity with Vault's concepts and terminology, not demonstrated ability to operate a production cluster under pressure.
- Any four of: compare authentication methods; create Vault policies; assess Vault tokens; manage Vault leases; compare and configure Vault secrets engines; explain Vault architecture; explain the Vault security model; manage the lifecycle of secrets and certificates; use the Vault CLI, API, and UI (including Vault Agent).
- Because HashiCorp's own published study guidance for this exam is a flat list of objectives, not a curriculum with official per-domain percentage weights the way the CNCF and AWS publish for their exams — inventing weights here would imply a precision that doesn't exist in the source material.
- For example: their organization doesn't run Vault at all — it uses a cloud-native secrets store like AWS Secrets Manager or Azure Key Vault instead — so the credential wouldn't be legible to anyone evaluating them against their actual stack.
- For example: it's a fast, low-cost, structured way to confirm — to themselves or a hiring manager — that a candidate already administering Vault policies and secrets engines day to day isn't starting from zero on the specific product the team depends on.