HCVA0-003 Free Exam Questions & Answers (Updated 2026)

Question No 1

Select the policies below that permit you to create a new entry of environment=prod at the path /secrets/apps/my_secret (select three).

Choose the Choices:

path "secrets/+/my_secret" { capabilities = ["create"] allowed_parameters = { "*" = [] } }

path "secrets/apps/my_secret" { capabilities = ["update"] }

path "secrets/apps/my_secret" { capabilities = ["create"] allowed_parameters = { "environment" = [] } }

path "secrets/apps/*" { capabilities = ["create"] allowed_parameters = { "environment" = ["dev", "test", "qa", "prod"] } }

Question No 2

Below is a list of parent and child tokens and their associated TTL. Which token(s) will be revoked
first?
A.
├ ───hvs.y4fUERqCtUV0xsQ jWLJar5qX - TTL 4 hours
B.
├ ───hvs.FNiIFU14RUxxUYAl4ErLfPVR - TTL 6 hours
C.
├ ───hvs.Jw9LMpu7oCQgxiKbjfyzyg75 - TTL 4 hours (child of B)
D.
├ ───hvs.3IrlhEvcerEGbae11YQf9FvI - TTL 3 hours
E.
├ ───hvs.hOpweMVFvqfvoVnNgvZq8jLS - TTL 5 hours (child of D)

Choose the Choices:

Question No 3

Your company's security policies require that all encryption keys must be rotated at least once per year. After using the Transit secrets engine for a year, the Vault admin issues the proper command to rotate the key named ecommerce that was used to encrypt your dat a. What command can be used to easily re - encrypt the original data with the new version of the key?

Choose the Choices:

vault write - f transit/keys/ecommerce/rotate <old data>

vault write - f transit/keys/ecommerce/update <old data>

vault write transit/encrypt/ecommerce v1v2 <old data>

vault write transit/rewrap/ecommerce ciphertext=<old data>

Question No 4

From the unseal options listed below, select the options you can use if you're deploying Vault on - premises (select four).

Choose the Choices:

Question No 5

How does the Vault Secrets Operator (VSO) assist in integrating Kubernetes - based workloads with Vault?

Choose the Choices:

By enabling a local API endpoint to allow the workload to make requests directly from the VSO

By using client - side caching for KVv1 and KVv2 secrets engines

By injecting a Vault Agent directly into the pod requesting secrets from Vault

By watching for changes to its supported set of Custom Resource Definitions (CRD)

Next Question

HashiCorp HCVA0-003 Free Exam Questions (Updated 2026)

PDF Questions

Bundle Pack

Online Engine

Question No 1

Question No 2

Question No 3

Question No 4

Question No 5