Back to top
101 articles on Vault certification prep and technical concepts
101 articles
Vault Core Concepts: Sealed/Unsealed, Auth, Secrets (2026)
Vault fundamentals — sealed/unsealed state, auth methods, secrets engines, policies. The conceptual basis for every Vault exam.Vault Operations Professional (VOP-003): Complete Guide (2026)
Pass the Vault Operations Professional exam — enterprise patterns, replication, DR, audit, HSM. Tactics and scope.Vault Path-Based Routing: API URL Structure (2026)
How Vault's path-based routing works — mount points, sub-paths, ACL semantics. The mental model for policies.Vault Tokens: Auth Token Mechanics (2026)
Token fundamentals — service vs. batch tokens, accessor, renewal, revocation. The core auth currency in Vault.Vault Token Types: Service, Batch, Periodic (2026)
Service vs. batch tokens compared — performance, ACL behavior, storage. When each fits and exam coverage.Vault Token Accessors: Audit Without Auth (2026)
Accessor usage — list active tokens, revoke without auth, common SOC patterns.Vault Token Renewal: TTLs & max_ttl (2026)
Renewal mechanics — ttl, max_ttl, periodic interaction, common renewal loops. Required for long-lived workloads.Vault Periodic Tokens: No max_ttl (2026)
Periodic token semantics — when periodic beats explicit renewal, security implications, common patterns.Vault Orphan Tokens: Detached from Parent (2026)
Orphan token mechanics — when revocation cascade breaks, common DR patterns, security considerations.Vault Root Token: Use Sparingly (2026)
Root token semantics — initial root, regeneration via unseal keys, common operational gotchas.Vault Policies (HCL): Access Control (2026)
Policy syntax — paths, capabilities, denied list. The right way to express least-privilege in Vault.Vault Templated Policies: Dynamic ACLs (2026)
Policy templating with identity metadata — common multi-tenant patterns, syntax gotchas.Vault Policy Capabilities: read, write, list, sudo (2026)
Capability semantics in policies — read, create, update, delete, list, sudo, root, deny. Exam-relevant nuances.Vault Identity Secrets Engine: Entities and Groups (2026)
Identity engine fundamentals — entities, aliases, groups. The unification layer across auth methods.Vault Entities: One Identity Across Auth Methods (2026)
Entity creation, aliases, merging. How Vault tracks a single human across auth methods.Vault Groups: Internal and External (2026)
Internal vs. external groups — auto-membership via auth method, common SSO group patterns.Vault Auth Methods: Overview & Selection (2026)
Every auth method type — when each fits, security trade-offs, common production setups.Vault userpass Auth: Username/Password Login (2026)
userpass mechanics — bcrypt storage, token issuance, common bootstrap scenarios.Vault AppRole Auth: Application-to-Vault (2026)
AppRole flow — role_id + secret_id, response wrapping, common production patterns.Vault AWS Auth Method: EC2 & IAM (2026)
AWS auth fundamentals — EC2 vs. IAM auth, instance role binding, common multi-account setups.Vault Azure Auth Method: Managed Identity (2026)
Azure auth via JWT and managed identity — role config, common subscription/resource-group patterns.Vault GCP Auth Method: GCE & IAM (2026)
GCP auth flow — GCE metadata, IAM credentials, common production patterns.Vault Kubernetes Auth: Service Account Tokens (2026)
K8s auth flow — service account JWT, TokenReview, common Helm/Operator patterns.Vault JWT/OIDC Auth: Modern SSO (2026)
JWT and OIDC auth — bound claims, OIDC discovery, common SSO provider integrations.Vault LDAP Auth: Directory Integration (2026)
LDAP auth — bind DN, user/group filters, common Active Directory integration patterns.Vault GitHub Auth: Token-Based Login (2026)
GitHub auth flow — personal access tokens, team mapping, common dev workflow patterns.Vault TLS Cert Auth: Mutual TLS Login (2026)
TLS cert auth — CA bundle, allowed CN, common service-to-service mTLS patterns.Vault Okta Auth: SSO via Okta API (2026)
Okta auth integration — API token, group mapping, MFA push flow.Vault Secrets Engines: Overview & Selection (2026)
Every secrets engine type — static vs. dynamic, when each fits, common adoption patterns.Vault KV v1 Secrets Engine: Legacy Static Storage (2026)
KV v1 mechanics — no versioning, simple semantics, migration path to v2.Vault KV v2 Secrets Engine: Versioned Static Storage (2026)
KV v2 features — versioning, metadata, cas, soft delete. The recommended static-secret engine.Vault Database Secrets Engine: Dynamic Credentials (2026)
Database engine flow — connection, role config, credential rotation. Patterns for PostgreSQL, MySQL, Mongo.Vault PKI Engine: Certificate Authority (2026)
PKI engine — root and intermediate CAs, role config, common short-TTL cert patterns.Vault Transit Engine: Encryption as a Service (2026)
Transit engine fundamentals — keys, encrypt/decrypt, key rotation, datakey export. The crypto vault.Vault AWS Secrets Engine: Dynamic IAM Credentials (2026)
AWS engine flow — STS assumed role vs. user, common short-TTL credential patterns.Vault Azure Secrets Engine: Service Principal Generation (2026)
Azure engine flow — app registration, role assignment, common subscription patterns.Vault GCP Secrets Engine: Service Account Key Issuance (2026)
GCP engine flow — key vs. impersonated token, role binding, common short-TTL patterns.Vault SSH Engine: One-Time Passwords & Signed Certs (2026)
SSH engine modes — OTP, CA signing. The right way to do ephemeral SSH access.Vault TOTP Engine: Generate One-Time Codes (2026)
TOTP engine usage — generate vs. verify, common MFA proxy patterns.Vault Transform Engine: Format-Preserving Encryption (2026)
Transform engine — FPE, masking, tokenization. Enterprise-only, common data-in-place encryption patterns.Vault Kubernetes Secrets Engine: Dynamic K8s Credentials (2026)
Kubernetes secrets engine — generate ServiceAccount tokens, bind roles. Dynamic K8s auth without service accounts.Vault cubbyhole: Per-Token Private Storage (2026)
Cubbyhole mechanics — token-bound, no cross-token access. Response wrapping foundation.Vault Dynamic Secrets: Why They Beat Static (2026)
Dynamic secrets benefits — lease lifecycle, auto-revoke, audit trail. The Vault distinguishing feature.Vault Storage Backends: Integrated Storage vs Consul vs Other (2026)
Storage backend comparison — Integrated (Raft) vs. Consul vs. legacy. Recommendation: Integrated since 1.4.Vault Integrated Storage (Raft): The Modern Default (2026)
Raft storage internals — peers, snapshots, autopilot. The recommended HA storage backend.Vault Consul Storage Backend: Legacy HA Path (2026)
Consul backend — HA mechanics, prerequisites, migration to Raft. Why Raft replaced it as default.Vault Filesystem Storage Backend: Dev Only (2026)
Filesystem backend — no HA, dev/POC only, why it's never production. The bare-minimum starter.Vault HA Cluster: Active/Standby Architecture (2026)
Vault HA architecture — active/standby, request forwarding, leader election, common multi-AZ patterns.Vault Raft Peers: Voter vs Non-Voter (2026)
Raft peer types — voters, non-voters (read-replicas), suffrage transition. Sizing and rebalance.Vault Raft Snapshots: Backup and Restore (2026)
Raft snapshot mechanics — snapshot take, restore, automated snapshots. The DR primitive for Vault.Vault Autopilot: Raft Cluster Health Automation (2026)
Autopilot features — dead-server cleanup, upgrade migrations, redundancy zones. Operational simplification.Vault Performance Standby Nodes: Read Scale-Out (2026)
Performance standby — read scaling, write forwarding. Enterprise-only feature for read-heavy workloads.Vault Request Forwarding: Active Node Routing (2026)
Request forwarding internals — how standby nodes proxy to active, common load-balancer patterns.Vault Seal/Unseal: The Boot Process (2026)
Seal/unseal mechanics — Shamir, auto-unseal options, common DR patterns.Vault Shamir Secret Sharing: Manual Unseal (2026)
Shamir unseal — key shares, threshold, rotation. The original Vault unseal mechanism.Vault Auto-Unseal: KMS-Backed Boot (2026)
Auto-unseal options — AWS KMS, GCP KMS, Azure Key Vault, Transit, HSM. The path away from Shamir for production.Vault AWS KMS Auto-Unseal: Setup (2026)
AWS KMS auto-unseal — key policy, IAM role, common multi-region patterns.Vault GCP KMS Auto-Unseal: Setup (2026)
GCP Cloud KMS auto-unseal — key ring, service account, common Cloud KMS patterns.Vault Transit Auto-Unseal: Vault Encrypts Vault (2026)
Transit unseal architecture — meta-Vault pattern, when it fits, common DR considerations.Vault Rekey Operation: Rotating Unseal Keys (2026)
Rekey mechanics — share threshold change, key rotation, common compliance patterns.Vault Recovery Keys: Auto-Unseal Recovery (2026)
Recovery keys — auto-unseal recovery, root token regen, common DR processes.Vault Replication: Performance & DR (Enterprise) (2026)
Replication modes — performance vs. DR, paths, common multi-region patterns. Enterprise-only feature.Vault Performance Replication: Read-Local (2026)
Performance replication — read serving in secondary regions, common geographic deployment patterns.Vault DR Replication: Standby Cluster (2026)
DR replication semantics — failover promotion, RPO, common cross-region DR patterns.Vault DR Promotion: Failover Procedure (2026)
DR promotion steps — disaster declaration, secondary promotion, common DR runbook patterns.Vault Filtered Paths: Replication Scope (2026)
Filtered paths in replication — selective replication, common compliance and data sovereignty patterns.Vault Mount Filters: Replication Mount Selection (2026)
Mount filter mechanics — performance replication scope, common multi-region setups.Vault Namespaces: Multi-Tenancy (Enterprise) (2026)
Namespace fundamentals — isolation, hierarchical structure, common multi-team patterns.Vault Sentinel Policies: Policy-as-Code (Enterprise) (2026)
Sentinel in Vault — RGP, EGP, common compliance use cases. Enterprise-only fine-grained governance.Vault Control Groups: Multi-Party Approval (2026)
Control group flow — request authorization, factor count, common break-glass patterns.Vault MFA: Login Multi-Factor (2026)
MFA mechanisms — TOTP, Duo, PingID, Okta. Login MFA vs. step-up MFA via Sentinel.Vault EGP Policies: Endpoint Governing Policies (2026)
EGP semantics — endpoint-level enforcement, paths, common compliance patterns. Enterprise feature.Vault RGP Policies: Role Governing Policies (2026)
RGP semantics — identity-attached policies, common role-based compliance patterns. Enterprise feature.Vault Mount Tuning: TTLs, Audit, Description (2026)
tune command options — default TTL, max TTL, audit hooks. Per-mount configuration patterns.Vault License Management (Enterprise) (2026)
Vault Enterprise licensing — application, expiration handling, common license-renewal patterns.Vault Performance Limits & Tuning (2026)
Performance limits — request rate, lease creation, common bottleneck symptoms. Scale-up vs. scale-out.Vault HSM Integration: PKCS#11 (Enterprise) (2026)
HSM integration — PKCS#11 driver, seal wrap, common FIPS compliance patterns. Enterprise feature.Vault Audit Devices: Tamper-Evident Logging (2026)
Audit device types — file, syslog, socket. Hash chain, hmac_accessor, common SIEM integrations.Vault File Audit Device: Local Logging (2026)
File audit device — log rotation, common centralized log shipping patterns.Vault Syslog Audit Device: Centralized Logging (2026)
Syslog audit device — facility, tag, common SIEM integration patterns.Vault Upgrade Procedure: Rolling Restart (2026)
Vault upgrade workflow — standby first, leader last, common version-skew handling.Vault Backup and Restore: Raft Snapshots (2026)
Backup workflow — periodic snapshots, restore on new cluster, common DR runbook patterns.Vault Telemetry: Prometheus & StatsD (2026)
Telemetry config — Prometheus, StatsD, common dashboard/alert patterns for Vault observability.Vault Agent: Auto-Auth + Templating + Caching (2026)
Vault Agent fundamentals — auto-auth, templating, caching. The sidecar pattern for app integration.Vault Agent Auto-Auth: Hands-Off Token Acquisition (2026)
Auto-auth flow — method config, sink, common K8s/EC2/instance auth patterns.Vault Agent Templating: Secret-to-File (2026)
Agent template syntax — Consul Template, common app config rendering patterns.Vault Secrets Operator (VSO) for Kubernetes (2026)
VSO architecture — sync secrets to K8s, common CRD patterns. The Kubernetes-native Vault integration.Vault CSI Driver for Kubernetes (2026)
Secrets Store CSI driver — pod-mounted secrets, common K8s integration patterns. Alternative to VSO.Vault CI/CD Patterns: Secrets in Pipelines (2026)
CI/CD secret patterns — short-TTL credentials, dynamic provisioning, common GitHub Actions/GitLab integration.HashiCorp Vault Associate (VA-003): Complete Guide (2026)
Pass the Vault Associate exam — domains, weighting, sample questions, focused study plan.Vault Engineer Career & Salary (2026)
Career value of Vault certifications — market demand, salary, role progression for VA-003 and VOP-003 holders.HashiCorp Vault Certifications: Associate & Pro (2026)
Compare Vault Associate vs. Operations Professional — scope, difficulty, prerequisites.Vault Cert Difficulty: Associate vs Pro (2026)
Honest difficulty comparison — study time, prerequisites, exam style. Make an informed choice.Vault Certification Cost: Fees, Vouchers, Retakes (2026)
Cost breakdown — base fees, voucher options, retake policies for both Vault certifications.Vault Exam: Test-Day Experience (2026)
First-hand VA-003 and VOP-003 exam accounts — proctoring, time pressure, common question styles.HCP Vault Free Tier: Hands-On Learning Setup (2026)
HCP Vault's free tier for cert study — what's free, limitations, common practice scenarios.Vault Metrics: What to Monitor (2026)
Key Vault metrics — token usage, lease counts, request latency, audit failures. The right operational dashboard.Vault Sample Questions: Format & Walkthroughs (2026)
Real-format Vault Associate sample questions with detailed answers. Calibrate before paid prep.Vault Study Guide: 3-Week Associate Pass Plan (2026)
Focused 3-week plan for the Vault Associate exam — official docs, hands-on, mock exam strategy.Vault Troubleshooting: Common Errors (2026)
Common Vault errors — sealed state, ACL denies, performance, replication. Diagnose and recover.Vault Study Time: How Long Each Cert Takes (2026)
Realistic study-time estimates for VA-003 and VOP-003 by background and prior Vault experience.