Be able to write correct HCL policies, choose the right capability for a KV v2 read scenario, and explain token_ttl versus token_max_ttl. The most important thing: grant exactly the capabilities the path needs, including list and metadata where required.
Start practicing
Access Control Configuration — choose a session length
Free · No account required
Domain overview
The Access Control Configuration domain covers how Vault Enterprise authorizes requests: policies, tokens, roles, identity entities and groups, and Sentinel governance. Questions are scenario-based, asking you to pick the correct capability, token TTL behavior, or policy semantics, and to distinguish root policy powers from ordinary policy grants.
Exam objectives
Writing HCL policies with capabilities like read, list, create, update, delete, sudo, and deny on KV v2 paths
Token lifecycle controls including token_ttl, token_max_ttl, periodic tokens, and explicit max TTL on auth roles
Root policy semantics and why it grants unrestricted access across all paths and operations
Sentinel in Vault Enterprise for fine-grained, role-based control beyond standard ACL policies
Using read on KV v2 data paths without also granting the required list or metadata capabilities, causing the application to fail.
Assuming token_ttl is a hard limit; it is only the initial TTL, and tokens can renew up to token_max_ttl unless explicitly bounded.
Confusing root policy with sudo capability; sudo bypasses specific path restrictions but is not global unrestricted access.
Click any question to see the full explanation and answer options, or start a focused practice session above.
What is the result of assigning a policy with 'deny' capability to a path that is also covered by an 'allowed' capability in a different policy?
2An organization wants to enforce that a specific group of users can only request secrets if a manager approves the request via a Control Group. Which object must be created to define the approval workflow?
3You are writing a Sentinel policy to restrict secret access. Which parameter provides the current request's metadata, such as the path or operation type?
4In a multi-tenant environment using Namespaces, an administrator accidentally created a policy in the root namespace that they intended for a child namespace. What is the impact?
5An application is authenticated via AppRole. You want to ensure the resulting token is limited to a specific CIDR range. Where do you configure this restriction?
6A Vault administrator needs to grant an application read access to a specific path in the KV v2 secrets engine. Which policy capability must be included?
7What is the function of an Identity Alias in Vault?
8What does the 'root' policy in Vault provide?
9What is the effect of setting 'token_ttl' on a Role?
10Which THREE capabilities are commonly used in Vault ACL policies to manage secrets engines?
11Which TWO fields are essential in an ACL policy defined in HCL?
12Which THREE features are specific to Vault Enterprise when managing access control?
13Which TWO statements are true regarding the use of Sentinel in Vault Enterprise?
14Which TWO of the following are valid ways to assign policies to a token?
15A Vault Enterprise administrator is configuring an external group mapping using the LDAP auth method. They want to ensure that members of the LDAP group 'vault-admins' automatically receive the 'admin' policy when they authenticate. Which configuration is required to achieve this?
16A Vault Enterprise cluster uses a Control Group to require approval for reading secrets at "secret/data/prod/*". A user with a token that has a policy granting read on that path attempts to read a secret but is blocked pending approval. Which statement accurately describes the token's capabilities during the pending approval?
17A Vault Enterprise administrator is configuring a new namespace for a subsidiary company. The subsidiary requires that only users authenticated via their corporate LDAP can access secrets in the namespace. Additionally, the subsidiary's security team must be able to manage policies and auth methods within the namespace but should not have access to the root namespace. Which combination of Vault Enterprise features should the administrator use to meet these requirements?
18A security engineer is configuring Vault Enterprise to allow an application to authenticate using AppRole. The application will run on a server that has a unique role ID and secret ID. The engineer wants to ensure that the secret ID can be used only once and expires after 24 hours. Which AppRole role configuration parameters should be set to achieve this?
19A Vault Enterprise administrator needs to delegate the management of a specific secrets engine to a team. The team should be able to create, update, and delete roles within the 'database' secrets engine but should not be able to modify the secrets engine's configuration or access other secrets engines. Which policy should the administrator create?
Be able to write correct HCL policies, choose the right capability for a KV v2 read scenario, and explain token_ttl versus token_max_ttl. The most important thing: grant exactly the capabilities the path needs, including list and metadata where required.
The Courseiva Vault Enterprise question bank contains 19 questions in the Access Control Configuration domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Access Control Configuration domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included