HashiCorp Security Automation Certification HCVA0-003 Exam Questions and Answers PDF

An identity group is a collection of entities that share some common attributes. An identity group can have one or more policies attached to it, which are inherited by all the members of the group. An identity group can also have subgroups, which can further refine the policies and attributes for a subset of entities.

One of the use cases of an identity group is to consistently apply the same set of policies to a collection of entities. For example, an organization may have different teams or departments, such as engineering, sales, or marketing. Each team may have its own identity group, with policies that grant access to the secrets and resources that are relevant to their work. By creating an identity group for each team, the organization can ensure that the entities belonging to each team have the same level of access and permissions, regardless of which authentication method they use to log in to Vault. References:  Identity: entities and groups | Vault | HashiCorp Developer ,  vault_identity_group | Resources | hashicorp/vault | Terraform | Terraform Registry

The statement is false. HCP Vault Dedicated supports cross-region disaster recovery, but it is not automatically enabled by default for every cluster. It must be enabled and configured as part of the HCP Vault Dedicated cluster architecture. HashiCorp documentation describes a setup process for enabling cross-region DR, including creating a cross-region HVN and enabling DR for new or existing clusters. That wording matters: a supported feature is not the same as an automatically enabled feature. Disaster recovery replication is an Enterprise/HCP capability used to protect against catastrophic failure and maintain continuity, but operators must deliberately configure it. Therefore, the correct answer is False. HashiCorp’s HCP cluster management documentation explicitly refers to enabling cross-region DR rather than it being automatic.

================

The Google Cloud secrets engine is the correct choice because it is designed to manage GCP credentials and can generate access credentials for Google Cloud workloads. In this scenario, the VMs need OAuth tokens for GCP services during IaC provisioning. The Identity secrets engine manages Vault identities and aliases, not GCP OAuth credentials. KV v2 stores static secrets and versions them, but it does not dynamically generate GCP access tokens. The SSH secrets engine is for SSH credential workflows, not Google Cloud API access. The Google Cloud secrets engine supports access-token workflows and service-account based credential management for GCP resources, making it the only option that matches the requirement for GCP OAuth access during provisioning. HashiCorp documents GCP access-token behavior under the Google Cloud secrets engine.

The statement is true. Vault CLI commands support structured output formats through the -format flag, and valid formats include table, json, and yaml. Table output is commonly used for human-readable CLI work, while JSON and YAML are useful for automation, scripts, CI/CD pipelines, and parsing command output with tools such as jq. This is important for the Vault Associate exam because Vault administration often requires reading command output and knowing how to produce machine-readable results. For example, vault write -format=json ... can return JSON output instead of the default table format. HashiCorp’s command documentation confirms that the output format can be set to table, JSON, or YAML, including through the VAULT_FORMAT environment variable.

================