Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Hashicorp
Exam Format
240 min
57
Pass/Fail (approximately 70%)
Professional
Registration
$295 USD
PSI (Online Proctored) or online proctoring
English
Validity
2 years
Retake the Vault Operations Professional exam starting 6 months before expiration (extends current credentials); If expired, retake the exam at any time (receives new credentials with new expiration date)
VAULT-OPERATIONS-PROFESSIONAL Exam Topics and Domains
VAULT-OPERATIONS-PROFESSIONAL is organized into 8 weighted domains. Expect to work with /sys/health endpoint, AWS, Azure, vault agent, and more.
1
Create a Working Vault Server Configuration Given a Scenario
20%
Enable and configure secret engines
Secrets engine lifecycle managementSecrets engine configuration parameters
- Enable secrets engines using the Vault CLI and UI
- Configure secrets engines with appropriate parameters
- Understand the differences between various secrets engine types and their use cases
Practice production hardening
Vault security model and hardening practices
- Apply production hardening best practices to a Vault deployment
- Configure TLS for Vault listeners
- Understand the Vault security model and threat vectors
Auto unseal Vault
Auto unseal configuration and operation
- Understand the benefits of Vault auto-unseal
- Configure Vault auto-unseal using Transit or cloud KMS
- Explain the difference between recovery keys and unseal keys
Implement integrated storage for Community and Enterprise Vault
Integrated Storage (Raft) configuration
- Create a Vault server configuration file with Integrated Storage (Raft)
- Join Vault nodes to an Integrated Storage cluster
- Manage Raft snapshots for backup and recovery
- Understand Raft autopilot features
Enable and configure authentication methods
Auth method lifecycle and configuration
- Enable and configure various authentication methods using CLI and UI
- Understand use cases for different auth methods (human vs. machine)
- Configure role mappings and policy attachments for auth methods
Practice secure Vault initialization
Vault initialization process
- Initialize a Vault server securely with appropriate key shares and threshold
- Understand the importance of secure key distribution
- Complete the initial unseal process
Regenerate a root token
Root token generation process
- Regenerate a root token using the vault operator generate-root command
- Understand when root token regeneration is necessary
- Complete the multi-step root token generation process
Rekey Vault and rotate encryption keys
Rekeying and key rotation
- Rekey Vault to change the number of key shares or threshold
- Rotate the Vault encryption key
- Understand the difference between rekeying (changing unseal keys) and rotation (changing the encryption key)
2
Monitor a Vault Environment
10%
Monitor and understand Vault telemetry
Telemetry configuration and metrics
- Configure Vault telemetry collection
- Identify and interpret key Vault metrics
- Use telemetry data to monitor Vault health and performance
Monitor and understand Vault audit logs
Audit device configuration and log analysis
- Enable and configure Vault audit devices
- Understand audit log format and how sensitive data is hashed
- Query audit device logs for troubleshooting
- Understand the blocking behavior of audit devices
Monitor and understand Vault operational logs
Vault server logs and log levels
- Configure Vault server operational log levels
- Change log levels at runtime
- Use operational logs to troubleshoot Vault issues
3
Employ the Vault Security Model
8%
Describe secure introduction of Vault clients
Secure introduction patterns
- Describe the trusted orchestrator and platform integration patterns for secure introduction
- Explain how response wrapping supports secure client introduction
- Choose appropriate secure introduction methods for different scenarios
Describe the security implications of running Vault in Kubernetes
Vault on Kubernetes security considerations
- Describe security best practices for running Vault on Kubernetes
- Explain why mlock should be enabled and core dumps disabled
- Understand the implications of running Vault containers as non-root
4
Build Fault-Tolerant Vault Environments
17%
Configure a highly available (HA) cluster
HA cluster architecture and configuration
- Configure a highly available Vault cluster using Integrated Storage
- Understand active and standby node roles and leader election
- Verify cluster health and membership
[Vault Enterprise] Enable and configure disaster recovery (DR) replication
DR replication setup and management
- Enable and configure DR replication on primary and secondary clusters
- Generate DR secondary tokens and activate secondary clusters
- Monitor DR replication status
[Vault Enterprise] Promote a secondary cluster
DR failover and promotion
- Generate a DR operation token
- Promote a DR secondary cluster to primary
- Understand the complete DR failover and recovery process
5
Understand the Hardware Security Module (HSM) Integration
7%
[Vault Enterprise] Describe the benefits of auto unsealing with HSM
HSM auto-unseal benefits
- Describe the benefits of using HSM for Vault auto-unseal
- Understand FIPS 140-2 compliance requirements addressed by HSM
- Compare HSM auto-unseal with other auto-unseal methods
[Vault Enterprise] Describe the benefits and use cases of seal wrap (PKCS#11)
Seal wrap functionality and use cases
- Describe what seal wrap provides and when to use it
- Understand the relationship between seal wrap and FIPS compliance
- Identify use cases that benefit from seal wrap
6
Scale Vault for Performance
13%
Use batch tokens
Batch tokens vs service tokens
- Understand the differences between batch and service tokens
- Create batch tokens and configure auth methods to issue batch tokens
- Identify scenarios where batch tokens improve performance
[Vault Enterprise] Describe the use cases of performance standby nodes
Performance standby node architecture
- Describe how performance standby nodes handle read requests
- Understand the difference between performance standbys and regular standbys
- Identify use cases for performance standby nodes
[Vault Enterprise] Enable and configure performance replication
Performance replication setup
- Enable and configure performance replication on primary and secondary clusters
- Understand which data is replicated and which remains local
- Compare DR replication with performance replication
[Vault Enterprise] Create a paths filter
Performance replication paths filter
- Create and configure paths filters for performance replication
- Understand allow and deny modes for path filters
- Identify use cases for filtering replication paths
7
Configure Access Control
15%
Interpret Vault identity entities and groups
Identity secrets engine entities and groups
- Understand Vault identity entities and their aliases
- Create and manage internal and external groups
- Attach policies at entity and group levels for unified access control
Write, deploy, and troubleshoot ACL policies
ACL policy authoring and management
- Write HCL-based ACL policies with correct paths and capabilities
- Deploy and assign policies to auth methods and tokens
- Troubleshoot access issues using -output-policy and token capabilities
[Vault Enterprise] Understand Sentinel policies
Sentinel policy framework
- Understand the purpose and types of Sentinel policies
- Differentiate between RGPs and EGPs
- Describe enforcement levels for Sentinel policies
[Vault Enterprise] Define control groups and describe their basic workflow
Control groups workflow
- Define what control groups are and their purpose
- Describe the basic control group workflow
- Understand how to configure control group factors in ACL policies
[Vault Enterprise] Describe and interpret multi-tenancy with namespaces
Namespace architecture and management
- Create and manage Vault Enterprise namespaces
- Understand namespace isolation and tenant separation
- Configure namespace-scoped auth methods, secrets engines, and policies
8
Configure Vault Agent
10%
Securely configure auto-auth and token sink
Vault Agent auto-auth configuration
- Configure Vault Agent auto-auth with appropriate auth methods
- Set up token sinks with proper file permissions
- Understand the Vault Agent auto-auth lifecycle
Configure templating
Vault Agent template configuration
- Configure Vault Agent templates using Consul-Template syntax
- Set up template rendering for secrets retrieval
- Manage multiple templates for different secrets
How do I earn this certification?
Passing VAULT-OPERATIONS-PROFESSIONAL earns the HashiCorp Certified: Vault Operations Professional certification. It sits in the Security Automation (Vault) track.
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for VAULT-OPERATIONS-PROFESSIONAL is by using the PlanetCert Simulator to practice questions and review detailed explanations.
Who should take this exam?
- HashiCorp Certified: Vault Associate Certification (strongly recommended)
- Linux skills (navigate file system, edit files, change permissions, create folders/files via terminal)
- Understanding of IP networking
- Experience with Public Key Infrastructure (PKI), including PGP and TLS
- Information security fundamentals (network security, RBAC)
- Understanding of infrastructure running in containers (starting/stopping services, reading logs)
- Production-level experience operating Vault
- Ability to evaluate Vault Enterprise functionality and use cases
Related practice tests
- Vault-Associate-003HashiCorp Certified Vault Associate 003
- CA-003HashiCorp Certified: Consul Associate (003)
- Terraform AssociateTerraform Associate (003)
- terraform-associate-003HashiCorp Certified: Terraform Associate (003)
- TA-004HashiCorp Certified: Terraform Associate (004)