Secrets management is now a core platform skill, and the HashiCorp Certified: Vault Associate (003) is the most direct way to show you understand how Vault authenticates clients, issues tokens and hands out secrets. This guide sets out what HashiCorp publishes about the exam: who it is for, the one-hour multiple-choice format, the nine objective areas, prerequisites, how to prepare, the fee, the two-year validity and the recertification routes, including the step up to the lab-based Vault Operations Advanced exam. It is written for cloud, platform and DevSecOps engineers, and for identity teams who now own machine credentials. Exam facts were checked on HashiCorp's certification pages and knowledge base in November 2026; fees and versions change, so confirm them with HashiCorp before you register.
This is an independent guide from NHI Mgmt Group, based on HashiCorp's public certification documentation as of November 2026. It is not sponsored or reviewed by HashiCorp. Exam details change, so confirm them against HashiCorp's current documentation.
Key takeaways
- Short, focused and affordable. The exam is one hour, online proctored, in English, and HashiCorp lists the fee as $70.50 USD plus local taxes and fees, with no free retake included.
- Nine objective areas, tested on Vault 1.19. Authentication methods, policies, tokens, leases, secrets engines, encryption as a service, architecture fundamentals, deployment architecture and access management architecture.
- Tokens and policies are the heart of it. Service versus batch tokens, root token lifecycle, accessors, time-to-live, orphan tokens and policy path and capability syntax are all named objectives.
- Valid for two years, renewable from month 18. You can retake the current Associate exam in the last six months, or pass Vault Operations Advanced at any time before expiry, to extend it.
- It is an identity credential as much as a tooling one. Most objectives are about how machines and people prove who they are and what they may read, which is why it suits non-human identity work.
Who the certification is for
HashiCorp names the intended audience as a cloud engineer with foundational Vault knowledge and skills. In practice that covers several roles:
- Platform and cloud engineers: people who stand up Vault clusters, enable auth methods and secrets engines, and wire applications to them. The Cloud Security Engineer Career Guide shows where that sits.
- DevSecOps engineers: people removing static credentials from pipelines and replacing them with short-lived, dynamically generated secrets. See the DevSecOps Engineer Career Guide.
- Identity and NHI teams: teams that govern service accounts, API keys and workload credentials, who need to read Vault policies and token settings with confidence. The Identity Certifications Guide covers the wider identity credential landscape.
- Security architects and auditors: people who review Vault designs and need a shared vocabulary for seals, leases, replication and response wrapping. The How to audit HashiCorp Vault tokens, policies and auth methods guide is the practical companion.
Exam format and domains
What HashiCorp publishes about the exam
| Item | What HashiCorp states | Source page |
|---|---|---|
| Exam | Vault Associate (003) | Vault Associate exam page |
| Product version tested | Vault 1.19 | Vault Associate exam page |
| Duration | 1 hour | Vault Associate exam page |
| Question types | Multiple choice on the exam page; the sample questions describe true or false, multiple choice and multiple answer items, some with a UI screenshot, command output or policy snippet | Exam page; Sample questions |
| Delivery | Online proctored through Certiverse on your own computer; Chrome recommended | Exam page; Exam rules article |
| Language | English | Vault Associate exam page |
| Fee | $70.50 USD plus locally applicable taxes and fees; free retake not included | Vault Associate exam page |
| Credential expiry | 2 years | Exam page; Recertification article |
HashiCorp does not publish a question count, passing score or domain weightings on the pages checked. Treat every objective as examinable.
The nine objective areas
| Objective area | What HashiCorp lists | NHI Mgmt Group guide for depth |
|---|---|---|
| 1. Authentication methods | Purpose; choosing a method by use case; human versus system methods; identities and groups; authenticating and configuring through API, CLI and UI | Secrets Zero Problem Guide |
| 2. Vault policies | Value of policies; path and capabilities syntax; choosing a policy from requirements; configuring in UI and CLI | How to audit HashiCorp Vault tokens, policies and auth methods |
| 3. Vault tokens | Service versus batch tokens; root token uses and lifecycle; accessors; time-to-live; orphaned tokens; creating tokens to need | HashiCorp Vault Guide |
| 4. Vault leases | Lease IDs; renewing and revoking leases | Dynamic Secrets and Ephemeral Credentials Guide |
| 5. Secrets engines | Choosing an engine; dynamic versus static secrets; transit; response wrapping; value of short-lived secrets; enabling and reading through CLI, API and UI | Secrets Management Guide |
| 6. Encryption as a service | Encrypt and decrypt; rotate the encryption key | Secrets Rotation Runbook Template |
| 7. Architecture fundamentals | How Vault encrypts data; sealing and unsealing; environment variables | HashiCorp Vault Guide |
| 8. Deployment architecture | Cluster strategy for self-managed and HashiCorp-managed clusters; storage backends; Shamir secret sharing and unsealing; disaster recovery and performance replication | Secrets Management Maturity Model |
| 9. Access management architecture | Vault Agent; Vault Secrets Operator | Kubernetes Secrets Security Guide |
How the objectives map to control frameworks
The exam is not built against a control framework, but the skills it tests are the ones auditors look for. This mapping helps teams justify training spend and use the objectives as a design review checklist.
| Exam skill | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|
| Auth methods, identities and groups | IA-2 Identification and Authentication; IA-5 Authenticator Management | PR.AA-01 |
| Policy paths and capabilities | AC-3 Access Enforcement; AC-6 Least Privilege | PR.AA-01 |
| Token TTLs, leases and dynamic secrets | IA-5 Authenticator Management | PR.AA-01 |
| Transit engine and key rotation | SC-12 Cryptographic Key Establishment and Management | PR.DS-01 |
| Barrier encryption, seal and unseal | SC-28 Protection of Information at Rest | PR.DS-01 |
| Audit of access to Vault | AU-2 Event Logging | Not mapped here |
Prerequisites and experience
There is no formal eligibility requirement or application. HashiCorp lists three prerequisites and a recommendation:
- Basic terminal skills: many objectives ask you to do things through the CLI as well as the API and UI.
- Understanding of on-premises and cloud architecture: needed for the deployment and replication objectives.
- Understanding of security: the exam assumes you know why least privilege, short credential lifetimes and encryption at rest matter.
- Experience: HashiCorp recommends professional experience, and also says you can prepare by practising the objectives in a personal demo setup.
Practical requirements for exam day come from HashiCorp's exam rules article: one unexpired, physical, government-issued photo ID whose names exactly match your Certification Exam Portal account; a private, quiet, well-lit room with a clear desk; phones, smartwatches and headphones not allowed; a single monitor; and an environment scan before the exam. Sign in to the portal with the same GitHub account every time. Breaks are allowed only on Professional-level exams, so plan for the full hour.
Preparation plan
HashiCorp publishes three official resources for the 003 exam: a learning path (study guide), an exam content list (review guide) and a set of sample questions. Build your plan around them and a local lab.
- Set up a lab (day 1): run a Vault dev server locally, or a small non-production cluster, so you can practise every CLI, API and UI objective. Never practise on a production cluster.
- Work the learning path (weeks 1 to 2): go objective by objective. For each, do it once in the CLI, once through the HTTP API and once in the UI, because HashiCorp lists all three.
- Drill tokens and policies (week 3): create service and batch tokens, inspect accessors, set and observe TTLs, create an orphan token and write policies with specific paths and capabilities. Then read your policies back and explain what each grants.
- Exercise secrets engines (week 3): enable a key/value engine and a dynamic engine, issue and revoke leases, use response wrapping, and use transit to encrypt, decrypt and rotate a key.
- Study architecture (week 4): seal and unseal with Shamir shares, compare storage backend roles, and read the replication and managed-cluster documentation until you can explain disaster recovery replication and performance replication in plain words.
- Close with the review guide and sample questions (week 4): use the exam content list to find gaps, then take the sample questions to get used to true or false, multiple choice and multiple answer items.
- Book and check (final week): run the Certiverse network test, check your ID matches your portal name, and book with at least 24 hours of margin for changes.
Measuring readiness
- Objective coverage: all 40 sub-objectives practised hands-on at least once.
- Three-interface rate: share of tasks you can do in CLI, API and UI without notes.
- Policy read-back accuracy: given a policy snippet, you can say exactly which paths and capabilities it grants.
- Sample question score: consistent, confident answers with the reasoning, not just the letter.
Common failure patterns
- Studying only the CLI: the objectives repeatedly name the API and UI too.
- Treating tokens as one thing: service and batch tokens, orphans, accessors and TTL inheritance are separate objectives with distinct behaviour.
- Skipping architecture: engineers who use a managed or existing cluster often have never unsealed Vault or thought about replication.
- Ignoring the newer objectives: Vault Agent and the Vault Secrets Operator have their own objective area.
- Name mismatch on exam day: the portal name must match your ID exactly, including characters and language.
Cost, renewal and continuing education
| Item | What HashiCorp states |
|---|---|
| Associate fee | $70.50 USD plus locally applicable taxes and fees; free retake not included |
| Validity | Credentials expire 2 years after issuance |
| Recertification window | Opens 18 months after earning the credential; reminders are emailed 6, 3 and 1 month before expiry |
| Extend by retaking | Pass the same Associate exam from month 18 until expiry; the new expiry is 2 years from the new pass date |
| Extend by stepping up | Pass the Vault Operations Advanced exam any time before expiry; you earn that credential and the Associate is extended by 2 years |
| Newer exam version | Pass a newer version at any time for a new, separate credential; the older one stays valid to its original date |
| After expiry | Pass the current version at any time; you receive new credentials |
| Rescheduling | Cancel or reschedule at least 24 hours ahead; later changes or no-shows may forfeit the fee |
| Accounts | One valid credential per exam per account |
HashiCorp uses re-examination rather than continuing education credits. If you also hold credentials with CPE schemes, Vault study often counts toward them; see the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
- Entry point to secrets engineering: the Associate proves you can operate Vault's core concepts safely. It pairs well with hands-on work moving teams off static secrets.
- Next step, Vault Operations Advanced: HashiCorp's exam page names it "Vault Authoring and Operations Advanced": four hours with one 15-minute break, lab-based scenarios and multiple choice, tested on Vault 1.16, $295 USD plus taxes with a free retake included, and two-year validity. HashiCorp strongly recommends the Associate (or equivalent experience) plus production Vault experience, PKI familiarity and container skills first. Searchers often call this level "Vault Professional".
- Adjacent HashiCorp skills: Vault is usually deployed alongside infrastructure as code. The Terraform and IaC Pipeline Credential Security Guide shows how the two meet.
- Non-human identity roles: auth methods, policies and short-lived tokens are the building blocks of machine identity governance, so the credential supports NHI programme and workload identity roles.
Practitioner checklist
- Confirm the current exam version and Vault release tested on HashiCorp's exam page before you study.
- Build a local lab and practise every objective through CLI, API and UI.
- Write, read back and test at least five policies with different paths and capabilities.
- Create and inspect service, batch and orphan tokens and watch TTLs expire.
- Issue, renew and revoke leases from a dynamic secrets engine, and use response wrapping.
- Encrypt, decrypt and rotate a key with the transit engine.
- Seal and unseal a test cluster with Shamir shares.
- Work through the official learning path, exam content list and sample questions.
- Check your ID against your portal name, run the network test and book with 24 hours of margin.
- Diary month 18 for recertification, or plan the Advanced exam before expiry.
Standards and references
- HashiCorp: Vault Associate (003) certification exam
- HashiCorp: Security automation certifications
- HashiCorp: Vault Associate (003) preparation tutorials
- HashiCorp: Sample questions, Vault Associate (003)
- HashiCorp Certifications: Exam rules
- HashiCorp Certifications: Recertification
- HashiCorp: Vault Operations Advanced certification exam
- NIST: SP 800-53 Rev 5, Security and Privacy Controls
Related NHI Mgmt Group resources: HashiCorp Vault Guide · Secrets Management Guide · Identity Certifications Guide · Dynamic Secrets and Ephemeral Credentials Guide · DevSecOps Engineer Career Guide