IT, Cloud & Cybersecurity • Certification
HashiCorp Certified: Vault Associate
Validate secrets management and encryption with Vault.
Researched and maintained by TestPrepPilot Editorial BoardCloud, security & DevOps certifications desk · Figures last verified August 2026
The short version
What is the HashiCorp Certified: Vault Associate and is it worth it?
Vault Associate is a 60-minute exam with about 57 questions costing $70.50. A roughly 70% score is required to pass, and one free retake is included.
- Vendor-neutral secrets-management credential
- Covers tokens, policies and encryption
- Free retake bundled with the voucher
- Two-year validity
- Affordable at $70.50
What is it?
What exactly is the HashiCorp Certified: Vault Associate?
Validate secrets management and encryption with Vault.
The HashiCorp Certified: Vault Associate validates knowledge of HashiCorp Vault for secrets management, authentication, policies, tokens, dynamic credentials and encryption as a service. It is a multiple-choice associate exam suited to security, platform and DevOps engineers who operate or consume Vault.
The path in brief
- Learn Vault architecture and auth methods
- Book the Vault Associate
- Study policies, tokens and secrets
- Pass at about 70%
- Recertify every two years
Before you book
Who is eligible to sit the HashiCorp Certified: Vault Associate?
Who it is for: Security, platform and DevOps engineers using Vault.
The test itself
What is the format of the HashiCorp Certified: Vault Associate?
The HashiCorp Certified: Vault Associate is administered by Remote proctored (PSI) and runs 60 minutes, contains 57 questions (multiple choice and multi-select) questions and requires ~70% (cut score not officially published) to pass.
| Administered by | Remote proctored (PSI) |
|---|---|
| Questions | 57 questions (multiple choice and multi-select) |
| Time limit | 60 minutes |
| Pass mark | ~70% (cut score not officially published) |
| Exam fee | $70.50 |
| Format | Multiple choice, online proctored |
Content outline
What topics are on the HashiCorp Certified: Vault Associate?
The HashiCorp Certified: Vault Associate is weighted across 6 domains; the largest are Secrets Engines (—), Authentication (—), Policies (—).
Weightings come from the official exam outline. Study time is best allocated in roughly these proportions rather than evenly across domains.
- Secrets Engines —
KV, databases, PKI
- Authentication —
Methods, entities, groups
- Policies —
ACL, path scoping
- Tokens —
TTL, renewal, revocation
- Encryption as a Service —
Transit engine
- Leasing & Renewal —
Leases, expiry
Money & time
How much does the HashiCorp Certified: Vault Associate cost?
For the HashiCorp Certified: Vault Associate, the exam fee is $70.50; the all-in cost is typically $70.50; most candidates spend 3-6 weeks preparing.
Cost breakdown
| Exam fee | $70.50 |
|---|---|
| Typical total | $70.50 |
Standard HashiCorp list price, plus tax where applicable.
Timeline
- Study 3-6 weeks
- Exam 60 minutes
Typical prep: 3-6 weeks
The path
How do you register for the HashiCorp Certified: Vault Associate?
- 1
Create a HashiCorp account5 minutes
Register at the HashiCorp certification portal; it handles scheduling, score and badge.
- 2
Pick Associate or Professional
Associate exams (Terraform, Vault, Consul) suit foundational users; Professional exams (Terraform Authoring & Operations, Vault Operations) require deep production experience.
- Associate: Terraform, Vault, Consul
- Professional: Terraform Ops, Vault Ops
- 3
Schedule and pay10 minutes
Book through PSI online proctoring. Associate exams are $70.50; Professional exams are $295 and include one free retake.
- 4
Prepare with official material3-10 weeks
Use HashiCorp Learn tutorials and the official exam objectives. Professional candidates need extensive hands-on lab time.
- 5
Sit the proctored exam
Associate exams are multiple choice; Professional exams combine labs with multiple choice in a four-hour session.
The fine print
What are the retake and renewal rules for the HashiCorp Certified: Vault Associate?
- Proctoring & delivery
- Delivered online with a live proctor via PSI. A government photo ID is required and the workspace is checked before the exam.
- Retake policy
- Associate exams: no free retake (a new voucher is required). Professional exams include one free retake. Wait times apply after a fail.
- Score reporting
- Associate exams report pass/fail with an approximate 70% cut score (not officially published). Professional lab exams report pass/fail on the completed tasks.
- Recertification
- All HashiCorp certifications are valid for two years. Recertify by passing the current version of the same exam again.
- Refunds & rescheduling
- Vouchers are generally non-refundable; review PSI terms at purchase for the specific exam.
Context
HashiCorp certification tracks
| Track | Format | Fee | Validity | |
|---|---|---|---|---|
| Associate (Terraform, Vault, Consul) | Multiple choice, 1 hour | $70.50 | 2 years | |
| Professional (Terraform Ops, Vault Ops) | Lab + multiple choice, 4 hours | $295 (1 retake) | 2 years |
What it pays
How much does this credential pay?
$132,270 median for software developers (SOC 15-1252, BLS May 2024) — the closest official occupation to the Vault Associate role
There is no Bureau of Labor Statistics occupation called "secrets engineer" or "Vault administrator", so the honest answer is that the closest official fit for the Vault Associate role is Software Developers, SOC 15-1252, which had a May 2024 median wage of $132,270, with the lowest 10 percent earning less than $79,850 and the highest 10 percent more than $211,450. We have chosen this code deliberately over infrastructure or security-analyst categories: the exam’s own target audience is the cloud engineer with security, development or operations responsibility, and the day-to-day work of standing up Vault, writing policies, enabling auth methods, managing leases and building dynamic secrets sits closer to developer-platform work than to pure network security. BLS projects 15 percent employment growth for the combined software developers, quality assurance analysts and testers occupation from 2024 to 2034, with about 129,200 openings a year, which is the strongest tailwind of any occupation quoted on this page. The caveats matter. First, the credential is an associate-level, foundational certificate aimed at people with basic terminal skills and a basic grasp of cloud or on-premises architecture; it is not a senior-security ticket on its own, and the salary distribution above reflects the occupation, not Vault holders specifically. Second, the actual earning effect of holding the certificate is not something BLS measures, and we will not invent a salary premium for it. Third, most of the work that justifies the top of that range — production Vault clustering, disaster recovery replication, auto-unseal design, integration with Kubernetes and cloud KMS — is examined in the separate Vault Operations Professional exam, so candidates who want the high end of the developer distribution should plan past this credential rather than stopping at it.
| Measure | Figure | Source / note |
|---|---|---|
| Median annual wage, software developers | $132,270 | BLS OEWS, SOC 15-1252, May 2024 |
| Lowest 10 percent | less than $79,850 | BLS OEWS, SOC 15-1252, May 2024 |
| Highest 10 percent | more than $211,450 | BLS OEWS, SOC 15-1252, May 2024 |
| Employment, 2024 | 1,895,500 jobs (combined software dev/QA) | BLS OOH Quick Facts, 2024 |
| Projected annual openings | ~129,200 per year | BLS OOH Job Outlook, 2024-34 |
Job growth.15% projected change 2024-34 for software developers, QA analysts and testers — much faster than the 3% all-occupations average
Source: BLS Occupational Outlook Handbook — Software Developers, Quality Assurance Analysts, and Testers
Your odds
What are the pass rates?
HashiCorp publishes no pass rate for Vault Associate — and no official cut score either; third-party sources consistently estimate a ~70% passing threshold
The core fact is that HashiCorp does not publish pass-rate statistics for the Vault Associate exam, and it also does not publish an official cut score in its public certification materials — the exam is reported as a pass or fail, and third-party training sites consistently estimate the passing threshold at roughly 70 percent of questions correct, which is what a "700 out of 1000" framing refers to on a normalised 1,000-point scale. Because HashiCorp equates exam forms to keep difficulty constant, a raw percentage and a scaled threshold are not interchangeable, and we present 70 percent as an estimate rather than as a vendor-published number. What is published and verifiable on the official page: the exam is multiple choice, delivered online and proctored, lasts one hour, costs $70.50 USD plus local taxes, is offered in English, and carries a credential expiration of two years from the pass date. The retake policy is also documented in the HashiCorp support knowledge base: there is a seven-day wait between attempts, and the number of attempts in a year is limited. Because there is no pass rate to quote, the practical planning guidance is to treat the domain weights as the syllabus — authentication methods, policies, tokens, leases, secrets engines, encryption as a service, architecture fundamentals, deployment architecture, and access management — and to aim for sustained scores meaningfully above 70 percent on practice items, since the real exam mixes single-answer and multi-select items and the clock is only sixty minutes. Two further policy details belong in the same planning picture: the $70.50 fee includes no free retake, so a failed attempt is a full-price re-sit, and the two-year validity is renewed by retaking the current exam or by passing the Vault Operations Professional exam, which extends the Associate credential. Candidates who treat the credential as a set of applied objectives rather than a memory test, and who rehearse the one-minute-per-question clock, are preparing for the exam that actually exists rather than for a rumour of it.
Read this before quoting the number.No pass rate is published by HashiCorp, and no official cut score appears in the vendor’s public materials. The ~70% threshold is a consistent third-party estimate, not a vendor figure, and the two-year validity and $70.50 fee are the officially published details this narrative relies on instead.
Source: HashiCorp Developer — Vault Associate (003) certification page
Your schedule
How long should I study for it?
40-60 hours over 4-8 weeks depending on experience of focused study
Plan for four to six weeks and 40 to 60 hours of study if you already work in cloud or infrastructure, or eight to ten weeks at roughly six hours a week if you are coming in cold, and spend the largest share of that time actually running Vault locally rather than reading about it. The exam is 60 minutes for 60 multiple-choice questions in a single sitting, which is the tightest time-per-question ratio of any exam in this group, so the pacing plan matters as much as the content plan. The current objectives for Vault Associate (003) group the material into nine areas — authentication methods, Vault policies, Vault tokens, leases, secrets engines, encryption as a service, architecture fundamentals, deployment architecture, and access management architecture — and every objective is written as an action ("choose an auth method based on use case", "explain orphaned tokens") which tells you the exam tests applied judgment rather than recall. The plan below runs in four blocks: fundamentals and architecture in the first two weeks, secrets engines, encryption and tokens in the middle, deployment and access management in week five, and timed rehearsal in the final week — a shape that front-loads the concepts and closes with the clock. The plan assumes you have a local Vault instance you can start, seal, unseal and break freely. If you do not, the first task on the list is to install the open-source binary and take it through the official tutorials, because a candidate who has only watched videos will struggle with the scenario items that ask you to reason through a policy or an auth method under a one-minute clock. Candidates who already operate Vault in production can compress the plan to two or three weeks, while newcomers to secrets management entirely should take the upper end of the range; either way, the exam rewards having typed the commands, so the lab is the plan.
- Weeks 1-26-8 hrs/week
Vault fundamentals and architecture
- Install Vault locally, initialise it, capture the unseal keys and root token, and seal and unseal it repeatedly until the lifecycle is reflex
- Work the official Vault Associate tutorial path: auth methods, policies, tokens, leases
- Start and stop the dev server, understand the difference between dev mode and a real production config
- Set up environment variables and the VAULT_ADDR flow the exam objectives call out
- Weeks 3-48-10 hrs/week
Secrets engines, encryption and tokens
- Enable and use the KV v2 engine; write, read, list and delete secrets via CLI, API and UI
- Configure database dynamic secrets end to end so you can watch short-lived credentials get issued and revoked
- Use the transit engine to encrypt and decrypt, and rotate the encryption key
- Work service tokens versus batch tokens, TTLs, orphaned tokens and accessors — the highest-density token facts on the paper
- Week 58-10 hrs
Deployment, access management and gaps
- Explain cluster strategy for self-managed versus HashiCorp-managed clusters, storage backends, and Shamir sharing
- Cover Vault Agent and the Vault Secrets Operator, which are explicit objectives under access management
- Identify your weakest domain from practice-test results and re-do that section of the objectives literally
- Write a one-page sheet of the distinctions the exam repeats: service vs batch tokens, dynamic vs static secrets, seal vs unseal, performance vs DR replication
- Week 66-8 hrs
Timed rehearsal
- Two or three full 60-minute practice exams under real timing — this is where the 60-seconds-per-question clock is learned
- Re-lab every miss to the specific objective it came from rather than just reviewing the topic
- Drill the "choose the auth method" and "choose the secrets engine" scenario items, which punish guessing
- One quiet day before the exam
Adjusting the pace
Already operating Vault in production.Two to three weeks. Your day job covers most of objectives 1 through 6; spend the recovered time on architecture fundamentals, deployment architecture, Vault Agent and the Secrets Operator, which hands-on operators routinely under-study.
Coming from Terraform Associate or another HashiCorp exam.Three to four weeks. The exam-style and delivery are identical, so you only need content time; concentrate on the Vault-specific token and lease model, which nothing in the Terraform syllabus covers.
No prior Vault experience.Eight to ten weeks at 5-6 hrs/week. Front-load the local lab before any theory: install, initialise, unseal, write a policy, generate a dynamic secret, then read the objectives with the feel of the tool already in your hands.
How to study
How do I prepare most effectively?
The strategy that reliably moves a Vault Associate score is "run a local Vault, reason from use cases, and rehearse the one-minute clock", and the single biggest error is reading documentation without ever issuing a token. Every objective on the current blueprint is an action verb — choose, explain, configure, differentiate — which means the exam rewards candidates who have performed the actions, not candidates who have memorised the glossary. The highest-yield habit is the local lab: install the open-source binary, initialise it, unseal it, and then deliberately exercise each objective through the CLI and UI until the token lifecycle, policy syntax and seal process are reflexive. The second proven approach is learning the "which one" scenarios: the exam repeatedly asks you to select an authentication method or a secrets engine for a stated use case, so build a decision table of when to reach for AppRole versus Kubernetes versus LDAP, and KV v2 versus database versus transit, and drill it until the distinctions are automatic. Third, use the official HashiCorp tutorials and documentation as your primary reference — they are the same material the objectives are built from, and third-party summaries drift. Fourth, practise the time discipline: sixty questions in sixty minutes is a real constraint, and candidates who treat practice exams as untimed review arrive at the test without a pacing instinct. Finally, understand that multi-select items are scored all-or-nothing, so a candidate who knows 80 percent of a question loses it entirely; when in doubt, apply the policy and least-privilege lens that runs through the whole paper.
Build a local Vault before touching theory
Install the open-source binary, initialise it, capture the unseal keys, and work every objective through the CLI and UI. The exam’s objectives are action verbs, and a candidate who has issued a token and written a policy reads scenario items differently from one who has only studied them.
Learn the "which one" decision tables
The exam repeatedly asks you to choose an auth method or a secrets engine for a use case. Build and drill tables — when AppRole, when Kubernetes auth, when LDAP; when KV v2, when database, when transit — until the choice is a reflex rather than a debate.
Study the official tutorials and docs, not summaries
HashiCorp’s official tutorials and documentation are the source material the objectives are written from. Third-party study guides compress and occasionally misstate the token and lease model, which is the area candidates lose the most points on.
Rehearse the 60-minute clock
Sixty questions in sixty minutes leaves no room to dwell. Run full timed practice exams and build the instinct to answer and move on; a flagged question returned to in the final minutes beats an unfinished paper.
Respect all-or-nothing multi-select items
Multi-select questions are scored as a whole, so partial knowledge loses the entire item. When a multi-select answer is uncertain, apply the least-privilege and policy lens the exam is built around rather than selecting every plausible-sounding option.
Memorise the distinctions, not the definitions
Service vs batch tokens, dynamic vs static secrets, seal vs unseal, performance vs disaster-recovery replication, Shamir sharing vs auto-unseal with cloud KMS — the paper is full of paired concepts and rewards candidates who can state what separates the two halves in one sentence.
What to buy
Which study resources are worth paying for?
The buying decision here is unusually simple because the vendor publishes everything you need: the official certification page, the free official tutorials, the free open-source Vault binary and a $70.50 exam. That means the cheapest competent study path is a local Vault installation plus the official tutorial track, and the only paid resources worth considering are practice exams and video courses that accelerate time to readiness for candidates who learn better by watching or who need a readiness calibration before spending the exam fee. The table below compares the main options with prices current to this review, and the honest cost ranking is: the official materials and the lab are the value core, practice exams are optional calibration, and video courses are conveniences rather than necessities. Three buying rules follow from how the exam actually works. First, because the objectives are written as action verbs and the paper is scenario-based, anything that gives you hands-on time in a real Vault environment is worth more per dollar than anything that just explains concepts. Second, the $70.50 fee is low enough that the voucher itself is rarely the financial risk — the risk is a wasted attempt followed by a seven-day wait, so the money is better spent on a practice-exam pass that tells you honestly whether you are ready than on a course that only reassures you. Third, the one thing to avoid paying for is a "braindump" or leaked-question bank: HashiCorp retires and replaces items, and memorising recycled questions trains you for a paper that no longer exists while the applied, scenario-style objectives reward genuine lab time. If you already hold Terraform Associate, the exam-style and delivery will feel familiar, which shortens the learning curve on everything except the Vault-specific content.
| Resource | Price | Format | Best for |
|---|---|---|---|
| HashiCorp official certification page + exam registration | $70.50 + local taxes | Official vendor site; online proctored via PSI | The exam itself and the authoritative syllabus |
| HashiCorp official Vault tutorials (Associate path) | Free | Interactive online tutorials with live terminal | Learning every objective hands-on before reading about it |
| Open-source Vault binary + your own machine | Free | Local lab | The single highest-value resource; a broken-and-rebuilt lab is what the exam rewards |
| Practice exams (e.g. Whizlabs, ExamTopics-style sites) | ~$20-60 | Online timed exams with explanations | Calibrating readiness against the 60-minute, 60-question format |
| Video courses (e.g. Udemy Vault Associate) | ~$15-30 during sales | Video lectures with demonstrations | Candidates who learn by watching; use them to supplement, not replace, the lab |
Prices checked 2026-08 in USD before tax; Udemy-style list prices are near-meaningless outside a sale and practice-question sites vary widely in quality, so confirm what you are buying and prefer vendors that cite the official objectives. The exam fee of $70.50 does not include a free retake.
Avoid these
What mistakes do candidates most often make?
The two most damaging mistakes on Vault Associate are studying from compressed third-party summaries instead of the official materials, and never running Vault locally — the exam’s applied, scenario-style objectives punish both. A third recurring error is mismanaging the 60-minute clock by spending minutes debating a single item, which is how candidates run out of time on the final stretch of a paper that gives roughly one minute per question. Candidates also routinely conflate the paired concepts the paper is built on, particularly service versus batch tokens, dynamic versus static secrets, and seal versus unseal, and the near-miss distractors are engineered to catch exactly that confusion. A fifth pattern is treating the exam as a beginner certificate: the objectives assume basic terminal skills and a working grasp of cloud or on-premises architecture, and candidates who book the seat without either arrive under-equipped for the scenario items that expect applied judgment. Finally, some candidates spend their study budget on braindump-style question banks, which train them for recycled items that HashiCorp has already retired, instead of building the policy, token and secrets reasoning the current form actually tests. The common thread across all six failures is preparing for a different exam than the one that exists: the paper rewards hands-on familiarity with the tool, precision on the paired concepts, and pace under the clock, and every mistake above is a way of avoiding one of those three demands. A candidate who runs the local lab, drills the distinctions until they are instant, and rehearses the 60-minute format has addressed the entire list at once.
✕Studying summaries instead of official materials
✓The objectives are written from the official HashiCorp tutorials and documentation, and third-party guides compress and sometimes misstate the token and lease model. Use the vendor’s own pages as the primary syllabus and treat third-party content as revision, not as the source of truth.
✕Never running Vault locally
✓Every objective is an action verb — configure, choose, explain, differentiate. Install the open-source binary, initialise and unseal it, write a policy, generate a dynamic secret, and rotate a transit key. A candidate who has done these things reads scenario items entirely differently from one who has only read about them.
✕Burning the clock on single items
✓Sixty questions in sixty minutes means about one minute per question with no slack. Mark anything you are unsure of, move on, and return only if time allows. Candidates who dwell on early items are the ones who rush the final stretch of the paper.
✕Conflating the paired concepts
✓Service vs batch tokens, dynamic vs static secrets, seal vs unseal, performance vs DR replication, Shamir sharing vs cloud KMS auto-unseal — the exam returns to these pairs repeatedly. Practise stating what separates the two halves in one sentence until the distinction is instant.
✕Treating it as a beginner certificate
✓The exam assumes basic terminal skills and a working grasp of cloud or on-premises architecture, and the scenario items expect applied judgment. If you have neither, add hands-on time before booking the seat — the $70.50 fee is cheap, but a wasted attempt costs a seven-day retake wait as well.
What you'll face
What question types will I see?
The Vault Associate exam is 60 minutes long and made up of multiple-choice questions, mixing single-answer items with multi-select items, all delivered online through a proctored PSI environment in English. The exact question count is not listed on the official page, but sixty is the figure consistently cited across public materials and matches the one-hour duration, so the pacing reality is roughly one question per minute. The paper is organised around nine objective areas — authentication methods, Vault policies, Vault tokens, Vault leases, secrets engines, encryption as a service, architecture fundamentals, deployment architecture, and access management architecture — and the dominant question style is scenario-based: a described use case followed by a choice of auth method, secrets engine, token type or operational decision. These scenario items are the reason the official objectives are written as action verbs: the exam wants you to choose between AppRole and Kubernetes auth for a workload, or between KV v2 and the transit engine for a stated need, and the distractors are usually real options that fit a slightly different scenario, so reading for the deciding condition is the skill being tested. Single-answer items make up the bulk of the paper, multi-select items are scored all-or-nothing, which makes partial knowledge expensive, and a smaller share of items test the paired-concept distinctions the syllabus repeats, such as service versus batch tokens and seal versus unseal. Because HashiCorp does not publish a score breakdown or an official cut score, the practical preparation target is to answer accurately across all nine areas rather than to chase a percentage; the samples below are editor-written illustrations of the published blueprint’s question styles, not live exam items.
A described use case followed by one correct choice — which auth method, which secrets engine, which token type, which operational action. Distractors are usually real options that fit a slightly different scenario, so reading for the deciding condition is the skill being tested.
The stem lists several statements or options and asks you to select all that apply; scoring is all-or-nothing, so partial knowledge loses the entire item. These cluster in policies, tokens and leases where multiple conditions are true at once.
Direct questions on the paired concepts the blueprint repeats — service vs batch tokens, dynamic vs static secrets, seal vs unseal, Shamir sharing vs auto-unseal. They reward one-sentence precision over deep exposition.
Straight questions on lease IDs, accessors, TTL behaviour and storage backends. These are the cheapest points on the paper and are usually won by drilling the official objective list.
Try these
Q1An application running in a Kubernetes cluster must authenticate to Vault without using a long-lived token or static credentials. Which authentication method fits this use case?
Answer:B
The Kubernetes auth method is designed for exactly this case: it lets a pod authenticate through its Kubernetes service account, issuing short-lived, per-workload tokens without static credentials. A is wrong because userpass is for human users with managed usernames and passwords. C is for centralising human identity against an existing directory. D is a security anti-pattern — the root token is meant for initial setup and recovery only, never for application workloads.
Q2A secrets engine must store versioned key-value data that can be written, read, listed and deleted via CLI, API and UI. Which secrets engine fits?
Answer:C
KV v2 is the key-value secrets engine and supports versioning, plus read, write, list and delete operations through every interface the objective names. A is wrong because the database engine generates dynamic, short-lived credentials for database users rather than storing versioned key-value data. B is wrong because transit performs encryption as a service on data passed through Vault and stores no secrets. D is wrong because the PKI engine issues and manages certificates.
Q3A Vault cluster must remain available if the primary storage backend fails, and the configuration must be kept in sync across two separate clusters in different geographic regions. Which capability addresses this?
Answer:B
Disaster recovery replication copies encrypted data to a second cluster so it can be promoted in a regional failure, which is exactly the described requirement. A is wrong because performance replication is about scaling read throughput to local sites, not about failover. C is wrong because Shamir sharing is how unseal keys are split among operators, not a replication mechanism. D inverts the requirement — one backend is a single point of failure.
Samples are editor-written illustrations of the published blueprint, not live exam items.
The big day
What should I expect on exam day?
The Vault Associate exam is a 60-minute, multiple-choice, online proctored test delivered through PSI, so exam day is a remote-proctoring exercise rather than a test-centre visit, and the practical preparation is mostly about your room and your machine. You must complete the system check on the exact computer, webcam, microphone and network you will use, in a private room with a closed door and a clear desk; PSI proctors require a full room scan and the space must be free of phones, smartwatches, second monitors and any printed material. Plan to begin check-in at least 15 to 30 minutes early, because the identity verification and room scan happen before the clock starts, and a proctor who cannot approve the space will not release the exam. Your 60-minute clock begins once the exam loads, and the paper is all multiple choice, so there is no whiteboard-heavy component — but pacing is everything: roughly one question per minute, mark anything uncertain, and use the final minutes to revisit flagged items. The exam is delivered in English only, and the candidate name on the registration must match the photo ID presented, so check the spelling of your name in your HashiCorp account the week before. The fee is $70.50 plus local taxes and includes no free retake, and retakes carry a seven-day wait, so a calm, tested environment is the cheapest insurance you can buy — a candidate who has rehearsed the room, the machine and the clock is far less likely to waste the fee on a proctor or connection failure. After you submit, the pass or fail result is reported through the proctoring platform, and a passed credential is valid for two years from the pass date.
Bring
- A valid, government-issued photo ID whose name matches your registration exactly
- The same laptop or desktop you system-tested, with webcam, microphone and a stable wired or strong wireless connection
- A quiet, private room with a door you can close and a clean desk surface
- A phone only for the check-in process if PSI requires it, then out of reach
- A bottle of water placed outside the immediate work area if allowed by the proctor
Leave at home
- Phones, smartwatches and fitness trackers — out of the room or placed far out of reach after check-in
- Any notes, cheat sheets, printed documentation or open browser tabs — the exam is fully closed-book
- Second monitors, which must be unplugged and turned away, and any other person in the room
- Headphones and earbuds unless medically approved, and any background audio
- Any exam materials or books on the desk surface
How the day runs
Rules in the room
- The exam is online and proctored via PSI; there is no test-centre delivery option for this exam.
- 60 minutes for the paper; the clock does not stop once it starts.
- The exam is delivered in English only.
- The exam is closed-book: no external reference material, no open browser tabs, no printed notes.
- Multi-select items are scored all-or-nothing, so treat every option as load-bearing.
- Retakes require a seven-day wait between attempts, and the number of attempts in a year is limited.
- A passed credential is valid for two years from the pass date; renewal is by retaking the current exam or advancing to Vault Operations Professional.
Afterwards.Your pass or fail result is reported through the proctoring platform, and the credential is valid for two years from the pass date. On a pass, update your résumé and profile with the full credential name and the exam version you passed (the three-digit code on the credential), because the version tells employers which Vault product line your knowledge aligns with. HashiCorp recertification is exam-based rather than CEU-based: you renew by passing the current Vault Associate exam within six months before expiry, or by passing the Vault Operations Professional exam, which extends the Associate credential while adding a professional-level badge. On a fail, respect the seven-day retake wait and use it properly: take the score context you have, re-run the specific objective areas you know were weak in your practice results, and re-sit — the $70.50 fee makes this the cheapest retake economics of any exam on this site, which is all the more reason not to burn attempts on unprepared sittings.
Reference
What are the key facts about the HashiCorp Certified: Vault Associate?
HashiCorp Certified: Vault Associate is a certification credential; awarded by HashiCorp; the exam fee is $70.50; typical preparation is 3-6 weeks; holders typically earn $120,000-$160,000.
| Credential | HashiCorp Certified: Vault Associate |
|---|---|
| Abbreviation | Vault Associate |
| Type | Certification |
| Profession | IT, Cloud & Cybersecurity |
| Specialty | Cloud Native & DevOps |
| Awarded by | HashiCorp |
| Difficulty | Moderate |
| Typical prep time | 3-6 weeks |
| All-in cost | $70.50 |
| Typical salary range | $120,000-$160,000 |
| Delivery | Remote proctored by PSI |
| Retake | One free retake included |
| Validity | 2 years |
| Level | Associate |
| Scope | National / Multi-state |
| Also known as | Vault Associate 003 |
Real questions
Frequently asked questions about the HashiCorp Certified: Vault Associate
Is Vault Associate hard?
It is conceptual and multiple choice, so the challenge is breadth rather than syntax. Understanding auth methods, policy path scoping and the transit engine covers most of the weight.
Do I need a running Vault?
A local dev server is the best preparation because the questions are practical. Spinning up Vault, enabling engines and writing policies teaches more than reading alone.
How does it compare with the Vault Professional?
The associate is multiple choice on concepts; the professional is a hands-on lab on operating production Vault. Take the associate first to build the foundation.
Is the free retake included?
Yes, the standard voucher includes one free retake, which reduces the cost of a first attempt.
How do I recertify?
Pass the current Vault Associate again within two years. The credential is inexpensive, so recertification is straightforward.
What is encryption as a service?
It is the transit secrets engine, which encrypts data in your application without storing it, and is a recurring exam theme worth practising directly.
Do I need the Associate before the Professional?
HashiCorp strongly recommends the Associate first and it is effectively expected, but the Professional exams are not strictly gated; equivalent production experience can substitute.
Are HashiCorp certifications hands-on?
Associate exams are multiple choice. The two Professional exams are lab-based: you perform real tasks in a live environment.
How long are they valid?
Two years. You recertify by passing the current version again.
What happened to Consul Associate?
Consul Associate (003) was retired on 15 July 2026 with no announced successor; credentials earned before then remain valid for two years from the pass date.
In short
Is the HashiCorp Certified: Vault Associate worth it?
- HashiCorp associate Vault certification
- 57 questions, 60 minutes, ~70% to pass
- $70.50 with one free retake
- Valid for two years
Same awarding body
What other credentials does HashiCorp award?
Worth comparing
How does the HashiCorp Certified: Vault Associate compare with similar credentials?
Trust
Where does this information come from?
Everything above is taken from the awarding body's own published material. Fees, question counts and domain weights are revised regularly — check the official page before you pay.
- HashiCorp Awarding body
- Official HashiCorp Certified: Vault Associate exam page Exam page
Research confidence: high · Last reviewed 2026-08