HashiCorp

HashiCorp Vault Associate Certification

Q: What does the HashiCorp Vault Associate certification syllabus cover?

The HashiCorp Vault Associate exam syllabus covers multiple weighted domains. Each domain is weighted differently, so focus your training on higher-weighted domains first. Review the complete domain breakdown for objectives and key concepts.

VA-002 · 10 objectives

Last updated: March 31, 2026

Exam Syllabus & Domains

The HashiCorp Vault Associate certification exam covers the following domains. Focus your training time proportionally to each domain's weight.

Domain 1 ~15%

Compare Authentication Methods

1.1 Describe authentication methods
1.2 Choose an authentication method based on use case
1.3 Differentiate human vs machine authentication
1.4 Describe the process of creating and managing auth methods

Token Authentication MethodAppRole for Machine AuthenticationLDAP and Active Directory IntegrationOIDC/JWT AuthenticationAWS IAM/EC2 Auth MethodKubernetes Auth MethodGitHub Auth MethodUserpass Auth MethodAuth Method Mounting and TuningMulti-Factor Authentication (MFA)

Domain 2 ~15%

Create Vault Policies

2.1 Illustrate the value of Vault policies
2.2 Describe Vault policy syntax (path, capabilities)
2.3 Describe built-in policies (default, root)
2.4 Associate policies with tokens and identities

HCL Policy SyntaxPath-Based Permission RulesCapabilities (create, read, update, delete, list, sudo, deny)Default PolicyRoot Policy and Root TokensPolicy Assignment to TokensPolicy Assignment to Auth MethodsGlob Patterns in PathsFine-Grained Path Templating

Domain 3 ~12%

Assess Vault Tokens

3.1 Describe Vault token types
3.2 Describe how tokens are generated and managed
3.3 Describe token lifecycle (creation, renewal, revocation)

Service Tokens vs Batch TokensToken Hierarchy (Parent/Child)Token TTL and Max TTLOrphan TokensPeriodic TokensToken AccessorToken Role ConfigurationToken Renewal ProcessRoot Token Generation and Revocation

Domain 4 ~10%

Manage Vault Leases

4.1 Explain the purpose of a lease
4.2 Renew leases
4.3 Revoke leases

Lease ID StructureDefault and Max Lease TTLLease Renewal RequestsLease Revocation (Single and Prefix)Lazy RevocationDynamic Secret Lease ManagementSystem Backend Lease OperationsLease Duration vs Token TTL

Domain 5 ~18%

Compare and Configure Secret Engines

5.1 Choose a secret engine based on use case
5.2 Differentiate between static and dynamic secrets
5.3 Enable and configure secret engines
5.4 Describe KV secret engine versioning

KV Secret Engine v1 (No Versioning)KV Secret Engine v2 (Versioned)Transit Engine (Encryption as a Service)PKI Secret Engine (Certificate Authority)Database Secret Engine (Dynamic Credentials)AWS Secret Engine (Dynamic IAM/STS)SSH Secret Engine (Signed Certificates)TOTP Secret EngineCubbyhole Secret Engine (Token-Scoped)Secret Engine Mounting and Tuning

Domain 6 ~12%

Utilize the Vault CLI

6.1 Authenticate to Vault using the CLI
6.2 Manage secrets using the CLI
6.3 Use environment variables to configure the CLI

vault login (Token, OIDC, LDAP)vault read/write/list/deletevault kv get/put/delete/metadatavault secrets enable/disable/listvault auth enable/disable/listvault policy write/read/list/deletevault operator init/unseal/sealVAULT_ADDR Environment VariableVAULT_TOKEN Environment Variablevault token create/renew/revoke/lookup

Domain 7 ~8%

Utilize the Vault UI

7.1 Authenticate using the Vault UI
7.2 Navigate the Vault UI to manage secrets and auth methods

UI Authentication MethodsSecrets Engine BrowsingKV Secret Version HistoryPolicy Editor in UIAuth Method Configuration via UIToken Management in UIWrapping Token via UI

Domain 8 ~10%

Be Aware of Vault Enterprise Features

8.1 Describe key Vault Enterprise features
8.2 Identify differences between OSS, Cloud, and Enterprise

Namespaces for Multi-TenancyPerformance ReplicationDisaster Recovery ReplicationSentinel for EGP/RGP PoliciesControl GroupsHSM Auto-Unseal (Enterprise)Vault Enterprise vs HCP VaultIntegrated Storage (Raft) HATransform Secret Engine (FPE)

Where to Focus Your Study Time

Domains with higher weight have more exam questions — allocate your study hours accordingly.

D1 Compare Authentication Methods

~15%

D2 Create Vault Policies

~15%

D3 Assess Vault Tokens

~12%

D4 Manage Vault Leases

~10%

D5 Compare and Configure Secret Engines

~18%

D6 Utilize the Vault CLI

~12%

D7 Utilize the Vault UI

~8%

D8 Be Aware of Vault Enterprise Features

~10%

Study Tips

Create a 8-week study schedule and assign specific domains to each week
Focus more time on higher-weighted domains — they have more exam questions
Use practice quizzes to identify weak areas early, then revisit those domains
Study in focused 25-minute blocks (Pomodoro technique) with 5-minute breaks
Create flashcards for key terms, acronyms, and port numbers
Review domain objectives weekly to track your progress and adjust your plan

Free Study Resources

📋

Study Roadmap

Week-by-week study plan with free resources

✅

Study Tracker

Track objective completion with progress dashboard

💰

Cost Calculator

Total cost breakdown and ROI analysis

🧪

Practice Quiz

Test your knowledge with free practice questions

Practice Quiz

Test your knowledge before the exam with our free practice quiz.

Take the HashiCorp Vault Associate Practice Quiz

Get the HashiCorp Vault Associate Study Planner

Fillable PDF with 8-week schedule, domain trackers, flashcard templates, progress tracking, and quick reference sheets. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.

Get the Study Planner — $5.99

Also available as a 4-Format Bundle for $15.99

CyberFolio

Earned your certs? Show employers.

Build a shareable cybersecurity portfolio that highlights your certifications, projects, and skills — free.

Build Your Portfolio →

Free Training Resources

Use these free tools to support your HashiCorp Vault Associate certification training:

Cybersecurity Practice Tests — 3,150+ free questions across 66 certifications
Study Roadmap — Structured learning path for HashiCorp Vault Associate
Study Progress Tracker — Track hours and domain coverage
CVSS Calculator — Practice scoring vulnerabilities

Frequently Asked Questions

What is the HashiCorp Vault Associate certification?

The HashiCorp Vault Associate (VA-002) is a professional IT certification that validates your knowledge and skills in the exam domains covered. It is recognized globally by employers and is a valuable credential for career advancement in cybersecurity and IT.

What does the HashiCorp Vault Associate certification syllabus cover?

The HashiCorp Vault Associate exam syllabus covers 10 objectives. Each domain is weighted differently, so focus your training on higher-weighted domains first. Review the complete domain breakdown above for objectives and key concepts.

How should I study for HashiCorp Vault Associate?

Create a structured study plan covering all exam domains, use practice tests to identify weak areas, and review key concepts regularly. A fillable study planner can help you organize your training with weekly schedules and progress tracking.

How long does it take to prepare for HashiCorp Vault Associate?

Preparation time varies by experience level. Most candidates spend 8-12 weeks of dedicated training. Using a structured study planner with domain-by-domain breakdown helps ensure you cover all certification objectives efficiently.