Vault Associate (003) deep review — September 28, 2026

Read the complete guide and all 40 objectives. The detailed objective/status snapshots still match the content-list monitor. However, the credential page now states Vault 1.19 while the learning path still states 1.16, and content-list references point to 1.16 documentation. Preserve both claims, mark the review blocked on this discrepancy and schedule October 5 follow-up. Do not invent an effective date, change the exam code or rewrite accepted snapshots from this disagreement. No retirement notice was found on the checked certification pages.

Learning improvements

Add missing environment-variable instruction, clarify policy path priority and unfiltered list names, distinguish root authority from service/batch lifecycle, and bound periodic renewal by explicit maximum TTL. Add KV soft deletion/destruction/metadata deletion and concurrent CAS decisions, wrapping-token delivery checks, seal-key recovery limits and current VSO CSI context. Correct the transit lab: raising the minimum decryption version can exclude old ciphertext. Add 20 original answers and five worked reasoning exercises.

The September 1 agentic IAM article is useful adjacent reading for identity/delegation/enforcement, clearly labeled beyond the exam. The 2.x release notes corroborate Enterprise 2.1 GA and bounded JWT revocation. Web retrieval read the article; the direct HTTP checker was blocked. A current feature announcement does not redefine Associate scope.

Validation limits

All six labs remain proposed; no Vault server, cloud account, Kubernetes cluster, HCP service, real secret or Enterprise feature was executed. Worked cases are documentation-based reasoning, not product test results. Official learning catalogs were inspected; no exact additional paid course was accepted. Independent human review remains pending.

The operational receipt preserves prior records, objective mapping hashes, source fetch results and the unresolved version finding. An unchanged content-list monitor result cannot clear a conflict on a different credential page.