HashiCorp Certified: Vault Operations Advanced - Exam Prep

Enable and configure Vault secrets engines to support diverse back ends, including cloud providers and databases, and learn to enable generic engines via CLI, API, or UI.

Enable and use the key value secrets engine to store static secrets, compare version 1 and 2, and enforce access with policies under 256-bit encryption via UI, CLI, and API.

Explore the key value secrets engine with Vault cave, using put, get, delete, list, and destroy across version 1 and 2, plus patch and rollback for data management.

Enable a key value secrets engine version 1 in Vault, mount at training, write and read data with cave puts and gets, update and delete keys, and list stored entries.

Explore how the database secrets engine in Vault generates dynamic credentials for multiple databases through roles, leases, and automatic revocation, using plug-ins and configuration to securely rotate and manage access.

Connect to a PostgreSQL database using the database secrets engine, configure the database, create a role, generate dynamic credentials, rotate root credentials, and revoke leases as needed.

Explore Vault's identity secrets engine, including entities, aliases, and policies, and how a single entity consolidates multiple login methods. Learn about internal and external groups and policy inheritance.

Demonstrates using the identity secrets engine to create an entity and an entity alias, assign the manager policy, and observe how login with user pass combines policies.

Explains how the transit secrets engine centralizes encryption in vault, encrypting data with per-application keys and returning ciphertext for secure storage and later decryption.

discover how the cubbyhole secrets engine stores per-token data with individual cubbyholes, revoked when the token expires, and how response wrapping uses wrap tokens for secure, single-use sharing.

Learn production hardening for vault deployments through defense in depth, secure deployment models, and vault-specific configurations that protect memory, keys, and audit data.

Explore integrated storage in vault, a raft-based backend that stores data on local disks and replicates across nodes for high availability, with auto snapshots and cloud auto join.

Learn how to build a highly available Vault cluster using integrated storage with three nodes, Raft replication, and leader election, including joining peers, unsealing, and auto unseal.

Enable, configure, and integrate Vault off methods with back-end systems, distinguish human versus system off methods, and manage tokens and policies across providers like Okta, LDAP, Azure, and Kubernetes.

Explore the AppRole auth method in Vault, enabling machines and apps to authenticate with a role ID and a unique secret ID, supporting secret injection and token issuance.

Enable the AppRole auth method, create a policy and an automation role, fetch the role ID and secret ID, then authenticate to Vault to obtain a token with 24-hour TTL.

Enable the userpass authentication in vault, create a local user with a policy, and obtain a time-limited token for lab and testing workflows.

Enable and configure the userpass authentication method in vault on a specific path, create users with attached policies, and log in to obtain a token bound to that policy.

Explore Vault tokens as the core authentication method, distinguishing service and batch tokens, including periodic, use limit, and orphan token options for secure access.

Initialize a vault cluster securely by encrypting all recovery keys and the root token output by vault operator init using three public PGP keys and a recovery threshold.

Regenerate a root token in vault using unseal or recovery keys with a quorum, enabling emergency access. Run vault operator generate root with init, nonce, otp, and decode steps.

Regenerate a root token by initializing a Vault cluster, using recovery keys to generate a one time password, and decoding the encoded token to regain access and resume operations.

Rekey vault to replace recovery or unseal keys and rotate the data encryption key, compare rekey versus rotation, and note thresholds, nonce flow, and production impact.

Vault telemetry collects performance metrics—request durations, GC pauses, and memory use—aggregates every 10 seconds, and sends data to upstream systems like Datadog or Prometheus.

Understand vault audit logs and devices (file, syslog, or socket) that securely log requests with sha-256 hashing, require at least two devices, and route to centralized dashboards and alerts.

Demonstrates how to enable and configure a file audit device in Vault, generate sample audit logs, and view or disable audits using Vault audit commands and log parsing with jq.

Explore troubleshooting vault startup and auto unseal using journal logs and vault operational logs, attaching an IAM role to access the CMS key and verify unseal and replication status.

Describe the Vault security model and analyze the secure introduction of Vault clients, along with the security implications of running Vault on Kubernetes, in a conceptual, exam-focused context.

Explore secure introduction of vault clients by managing secret zero, using unique per-application credentials, and injecting dynamic, short-lived secrets at runtime through trusted platforms and orchestrators.

Configure highly available vault clusters and enable disaster recovery replication to replicate across data centers, then promote secondary clusters to primary during primary failures for fault-tolerant deployments.

Demonstrates building a three-node Vault cluster using manual configuration and raft joins, including initialization and auto unseal, then outlines leadership failover.

This demo shows building a three-node raft vault cluster using retry join stanzas, updating the configuration, starting services, and verifying the cluster with vault operator raft list.

Learn how to promote a secondary cluster to a primary in Vault replication, using a DR operation token or an orphan batch token with unseal keys and thresholds.

This demo shows promoting a secondary Vault cluster to primary after demoting primary, using replication with DRT, vault commands, and generating an operation token via a one time password.

This section introduces hardware security module integration with Vault, outlining the benefits of auto unsealing with HSM and the use cases for seal wrap, with a focus on conceptual understanding.

Explore how to scale Vault for performance by using batch tokens, leveraging performance standby nodes, enabling performance replication, and creating a path filter.

Create and use batch tokens in Vault, noting they are non-renewable and non-revocable, differ from service tokens, and may be marked as orphan for use across performance replicated clusters.

Explore how Vault enterprise performance standby nodes scale reads by offloading to standby nodes, while rights remain on the active node, with health checks and load balancer routing.

Enable and configure performance replication in Vault Enterprise to offload reads to secondary clusters while forwarding writes to the primary, with tokens not replicated to secondaries.

Discover how path filters in Vault replication control what data moves between clusters. Configure allow or deny lists and local mounts to meet compliance, such as GDPR in the EU.

Explore configuring path filters for Vault replication with the user interface, setting up a performance primary and secondary, and applying a deny list to block specific namespaces.

Explore configuring access control in vault by interpreting identity entities and groups, writing and troubleshooting ACL policies, and understanding sentinel policies, control groups, and namespaces.

Explore vault identity entities and groups, where an entity and aliases map login methods to policies; tokens inherit policies from aliases, entities, and groups, including internal and external groups.

Write vault policies to grant or deny path-based access with rbac-like granular capabilities, follow least privilege, understand token policy attachments and explicit deny precedence.

Explore sentinel policies as code embedded in vault for fine-grained path and token access, using RFPs and IPS with enforcement levels and external data.

Control groups add an extra authorization on a Vault path. Vault returns a wrapping token that requires identity group approvals, such as account managers, before unwrapping the data.

Explore Vault namespaces to enable multi-tenant isolation within a single Vault cluster. Create root and child namespaces, delegate administration, and manage policies, secrets, engines, and tokens across teams.

Explore vault namespaces via CLI and UI, create namespaces, route commands with dash namespace or vault namespace env var, and manage policies and secret engines within namespaces.

Explore how the vault agent runs alongside applications to auto authenticate with vault, store a token in a sink, renew it automatically, and optionally wrap the token for secure delivery.

Discover how the vault agent templating renders vault secrets into a destination file for legacy apps, using auto auth and console template.

Enhance your HashiCorp Vault operations skills by leaving or updating a course review, sharing how it helped you learn a new skill, pass a certification, or accelerate your career.