VA-003 Create Vault policies — 25 Questions

Question 1

A company wants to grant developers the ability to read and write secrets under the path 'secret/dev/*', but only they should be able to delete their own secrets. Which policy design best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "secret/dev/{{identity.entity.name}}/*" { capabilities = ["delete"] }. It grants full CRUDL access to 'secret/dev/*' for reading and writing, but then restricts delete to only the path 'secret/dev/{{identity.entity.name}}/*', which uses the entity's name to ensure developers can only delete secrets under their own sub-path. This leverages Vault's identity entity name templating to enforce per-developer delete scoping.

Answer

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] }

Answer

path "secret/dev/*" { capabilities = ["read", "list"] }

Answer

path "secret/dev/+/{{identity.entity.name}}" { capabilities = ["create", "read", "update", "delete"] }

Question 2

Which TWO of the following are valid capabilities that can be specified in a Vault policy?

Accepted Answer

create. In HashiCorp Vault policies, capabilities are the specific actions a token can perform on a path, and the valid set includes create, read, update, delete, list, patch, sudo, and deny. Option A (create) is correct because it allows a client to create new entries at a given path, such as generating a new secret version or writing a new key where none existed. Option E (update) is correct because it permits modifying existing data at a path, and Vault distinguishes it from create so policies can allow updates without permitting initial creation. Option B (write) is not a Vault capability keyword; it is a legacy/HTTP-style verb that Vault maps internally to create and update, so it cannot be specified directly in a policy. Option C (sudo) is a real Vault capability but it is not one of the two marked correct here, and option D (rename) is not a Vault capability at all, as Vault has no rename operation on paths.

Answer

write

Answer

sudo

Answer

rename

Question 3

A DevOps team is managing secrets for a microservices application using Vault. They have created a policy named 'app-policy' that grants read access to secrets under the path 'secret/data/app/*'. The policy is assigned to an AppRole role. When a service authenticates with the role ID and secret ID, it receives a token but is unable to read secrets from 'secret/data/app/db-creds'. The token's identity metadata shows the policies associated with the token include 'default' and 'app-policy'. The Vault server logs show no errors. The service can successfully read other secrets from the same path, like 'secret/data/app/config'. What is the most likely cause of the issue?

Accepted Answer

The secret 'secret/data/app/db-creds' does not exist in Vault.. The most likely cause is that the secret 'secret/data/app/db-creds' does not exist in Vault. The token has the 'app-policy' policy attached, which grants read access to 'secret/data/app/*', and the service can successfully read other secrets under that path (e.g., 'secret/data/app/config'). The absence of Vault server errors indicates that the policy is correctly evaluated and the path is valid, but a read on a non-existent secret returns a 404 (or a permission-denied-like response) without logging an error. The token's metadata confirms the policy is present, ruling out policy assignment issues.

Answer

The token does not have the 'app-policy' policy attached due to a misconfiguration in the role.

Answer

There is an explicit deny rule in the policy that denies access to 'db-creds'.

Answer

The token is periodic and does not have the correct capabilities for the path.

Question 4

A security team wants to ensure that all Vault policies for applications follow the principle of least privilege. They have a policy 'app-kv' that grants read access to secrets under 'secret/data/app/*'. An auditor finds that a developer can also read secrets under 'secret/data/team/*'. The policy currently uses a path-based glob. Which change should the team make to restrict access to only the app path?

Accepted Answer

Change the path to 'secret/data/app/' (without glob) and ensure the policy only grants 'read' capability.. The essential fix is to change the path to the exact glob 'secret/data/app/*' so that it only matches secrets under that directory. In Vault, policies are additive and only allow capabilities; there is no 'deny' capability, but the path change itself restricts access to the intended path. Other options are incorrect: A uses '+' which matches a single segment and 'list' does not grant read; C incorrectly applies a deny policy which is invalid; D removes the glob, which only allows listing the directory, not reading secrets within it.

Answer

Change the path to 'secret/data/app/+' and use 'list' capability.

Answer

Change the path to 'secret/data/app/*' and add 'deny' capability for other paths.

Answer

Keep the path as 'secret/data/app/*' but add a policy with path 'secret/data/team/*' and 'deny' capability.

Question 5

A DevOps team is writing a Vault policy for a CI/CD pipeline that needs to authenticate using AppRole, read specific secrets, and write dynamic database credentials. Which THREE capabilities should be included in the policy to meet these requirements? (Choose three.)

Accepted Answer

read. The only capability required for the described tasks is 'read'. Reading specific secrets from KV v2 or generating dynamic database credentials (via database/creds/<role-name>) both use the 'read' operation. AppRole authentication is handled before the policy applies; the policy itself does not need to grant capabilities for the login process.

Answer

write

Answer

create

Answer

sudo

Answer

update

Question 6

Refer to the exhibit. A developer reports that they cannot read secrets under 'secret/data/kv-v2/engineering/db-pass' using a token that has the above policy attached. What is the most likely cause?

Accepted Answer

The token does not have the policy attached.. The policy shown in the exhibit defines a path with a glob pattern (`secret/data/kv-v2/engineering/*`), which matches the secret path `secret/data/kv-v2/engineering/db-pass`. However, the developer reports they cannot read the secret, indicating the token likely does not have this policy attached. In Vault, a token must have a policy explicitly attached to it; merely having the policy defined in Vault does not grant permissions unless the token is associated with that policy.

Answer

The policy requires the 'sudo' capability for reading secrets.

Answer

The secret does not exist because the path is incorrect.

Answer

The path uses a glob that does not match the exact secret path.

Question 7

Match each Vault command to its function.

Accepted Answer

vault kv put: Stores a secret at a specified path in the KV secret engine.. The correct matches are: A (vault kv put) stores secrets in KV, D (vault kv delete) deletes secrets, and F (vault read) reads data from any path. Options B and C are incorrect because their descriptions are swapped: vault kv get retrieves a secret (not lists), and vault kv list lists keys (not retrieves). Option E is incorrect because vault write is a generic command that writes to any path, not specifically to the KV secret engine; the KV-specific command for storing secrets is vault kv put.

Answer

vault kv get: Lists all secrets at a given path.

Answer

vault kv list: Retrieves a secret from a specified path.

Answer

vault write: Stores a secret at a specified path in the KV secret engine.

Question 8

A DevOps team needs to create a Vault policy that allows reading secrets from path "secret/data/app" but only for the key "db_password". They want to enforce this using Vault's policy syntax. Which policy statement achieves this?

Accepted Answer

path "secret/data/app" { capabilities = ["read"]; allowed_parameters = {"db_password"=[]} }. Vault policy syntax uses `allowed_parameters` to restrict which keys within a path can be read. By setting `allowed_parameters = {"db_password"=[]}`, the policy permits reading only the `db_password` key under `secret/data/app`, while denying access to any other keys at that path. This enforces the requirement precisely.

Answer

path "secret/data/app" { capabilities = ["read"] }

Answer

path "secret/data/app/db_password" { capabilities = ["read"] }

Answer

path "secret/data/app" { capabilities = ["read"]; required_parameters = ["db_password"] }

Question 9

A Vault administrator is designing a policy for a CI/CD pipeline that must be able to read dynamic database credentials from "database/creds/my-role" and also write to "secret/data/ci-cd" for storing build artifacts. The policy should follow the principle of least privilege. Which policy statements should be used?

Accepted Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["create", "update"] }. It grants the minimum required capabilities: 'read' for reading dynamic database credentials from 'database/creds/my-role', and 'create' and 'update' for writing to 'secret/data/ci-cd'. The principle of least privilege dictates that 'delete' is unnecessary for storing build artifacts, and the path must be exact without a wildcard to avoid granting unintended access to sub-paths.

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["create", "update", "delete"] }

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd/*" { capabilities = ["create", "update"] }

Answer

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["write"] }

Question 10

A Vault operator is crafting a policy for a new application. Which two of the following are valid capabilities in a Vault policy path statement? (Select two.)

Accepted Answer

sudo. 'sudo' is a valid capability in Vault policy path statements that allows a token to access paths and perform operations that would normally be denied by the policy, effectively granting elevated privileges for those paths. It is used to enable certain administrative actions, such as reading or writing to paths that require sudo-like permissions, and is explicitly supported in Vault's policy language.

Answer

modify

Answer

patch

Answer

encrypt

Question 11

Which three of the following are valid capabilities in a Vault policy path statement? (Select three.)

Accepted Answer

list. In Vault policy path statements, capabilities define the allowed operations on secrets. The 'list' capability is valid and allows listing keys at a given path, which is essential for enumerating secrets without reading their values. This is a core capability in Vault's policy system, distinct from 'read' or 'write'.

Answer

encrypt

Answer

patch

Question 12

Refer to the exhibit. An application needs to encrypt data using the transit engine with key "app-key". It currently has this policy. Which statement is true?

Accepted Answer

The policy allows both encryption and decryption, which is correct for the transit engine.. The transit engine in Vault uses the `encrypt` and `decrypt` capabilities to allow encryption and decryption operations, respectively. The policy shown uses `create` and `update` capabilities, which are correct for the transit engine because `create` is used to encrypt data (creating ciphertext) and `update` is used to decrypt data (updating the ciphertext back to plaintext). Therefore, the policy allows both encryption and decryption, making option B correct.

Answer

The policy allows both encryption and decryption, but the capabilities should be "read" and "write" instead.

Answer

The policy allows encryption but not decryption, which is sufficient.

Answer

The policy incorrectly uses "create" and "update" for transit operations; it should use "read" and "write".

Question 13

A company uses Vault's KV v2 secrets engine. A policy is needed to allow a service to only update existing secrets at path "secret/data/service/config", but not create new ones. Which capabilities should be included?

Accepted Answer

["update"]. In Vault's KV v2 secrets engine, the 'update' capability is specifically required to modify an existing secret at a given path without the ability to create a new one. The 'create' capability is needed only for initial creation, and 'read' is not required for the update operation itself. Since the policy must allow updating existing secrets but not creating new ones, only the 'update' capability is necessary.

Answer

["read", "update"]

Answer

["write"]

Answer

["create", "update"]

Question 14

A Vault policy has the following: path "identity/entity/id/*" { capabilities = ["read", "list"] }. What does this policy allow?

Accepted Answer

Listing all identity entities and reading their details.. The policy grants 'read' and 'list' capabilities on the path `identity/entity/id/*`. In Vault, the 'list' capability returns entity IDs (a summary), while the 'read' capability retrieves the full details of a specific entity. Option C correctly captures both actions: listing all entities and reading their details.

Answer

Reading and updating all identity entities.

Answer

Reading and listing all identity entities.

Answer

Reading and listing all identity entity IDs.

Question 15

A DevOps team has configured a Vault policy to allow reading secrets from the 'secret/data/engineering' path. The policy contains:

path "secret/data/engineering/*" {
  capabilities = ["read", "list"]
}

However, when a user attempts to read a secret at 'secret/data/engineering/db/password', they receive a permission denied error. What is the most likely cause?

Accepted Answer

The policy uses a single asterisk, which does not match nested paths; it should use double asterisk or specify the exact path.. In Vault's policy path matching, a single asterisk (`*`) matches only a single level of the path, not nested sub-paths. The path `secret/data/engineering/*` matches `secret/data/engineering/foo` but does NOT match `secret/data/engineering/db/password` because the latter has an additional sub-path level. To match all nested paths, you must use a double asterisk (`**`) or explicitly list the full path. This is a common pitfall when writing Vault policies for hierarchical secret structures.

Answer

The policy lacks the 'deny' capability to override the default deny.

Answer

The secret engine's mount path is different; it is mounted at 'secret/' but the policy expects 'secret/data/'.

Answer

The user's token does not have the correct identity policies attached.

Question 16

A development team is using the Vault transit secrets engine to encrypt sensitive data in their application. They have created a policy that includes: path "transit/keys/*" { capabilities = ["encrypt", "decrypt"] } and attached it to their application tokens. However, when the application calls the '/v1/transit/encrypt/my-key' endpoint, it receives a permission denied error. The key 'my-key' exists in the transit engine. The team has verified that the token is not expired and has the correct policy attached. What is the most likely cause of the error?

Accepted Answer

The encrypt and decrypt capabilities must be applied to the specific encrypt/decrypt paths, not the key metadata path.. The Vault transit secrets engine exposes encryption and decryption operations under specific API paths like `/v1/transit/encrypt/my-key` and `/v1/transit/decrypt/my-key`, not under the key metadata path `transit/keys/*`. The policy must grant `encrypt` and `decrypt` capabilities on the exact operation paths (e.g., `transit/encrypt/*` and `transit/decrypt/*`), not on the key configuration path. Since the policy only covers `transit/keys/*`, the token lacks permission to call the encrypt endpoint, resulting in a permission denied error.

Answer

The policy also needs 'read' capability on 'transit/keys/*'.

Answer

The application token has expired.

Answer

The transit engine requires the 'create' capability on the key to perform encryption.

Question 17

A Vault administrator needs to create a policy for a developer who must read and list secrets from the path 'secret/data/engineering/' and create new secrets under 'secret/data/engineering/projects/'. Which two policy statements should the administrator include? (Choose two.)

Accepted Answer

path "secret/data/engineering/projects/*" { capabilities = ["create"] }. Option E is correct because the developer must read and list secrets under 'secret/data/engineering/', and the wildcard path 'secret/data/engineering/*' with capabilities ["read","list"] grants exactly those permissions on all secrets beneath that KV v2 path. Option C is correct because creating new secrets under 'secret/data/engineering/projects/' requires the 'create' capability on the path 'secret/data/engineering/projects/*', which matches any new secret name in that subtree. Option A is not selected because it adds 'update' capability, which was not requested and would allow modifying existing secrets. Option B is not selected because it targets the exact path 'secret/data/engineering' without a wildcard, so it would not cover secrets stored under that prefix. Option D is not selected because 'secret/engineering/*' omits the 'data/' segment required by the KV v2 API path, so it would not match the actual secret paths.

Answer

path "secret/data/engineering/projects/*" { capabilities = ["create","update"] }

Answer

path "secret/data/engineering" { capabilities = ["read","list"] }

Answer

path "secret/engineering/*" { capabilities = ["read","list"] }

Question 18

Refer to the exhibit. Based on the policy shown, which statement is true?

Accepted Answer

A user can read all secrets under secret/data/engineering/.. The policy shown grants 'read' capability on the path 'secret/data/engineering/*'. In Vault, the 'read' capability allows listing and reading secrets at that path, but not creating, updating, or deleting them. Therefore, a user can read all secrets under secret/data/engineering/.

Answer

A user can create secrets under secret/data/engineering/.

Answer

A user can delete secrets under secret/data/engineering/.

Answer

A user can update secrets under secret/data/engineering/.

Question 19

A platform team manages a Vault KV v2 secrets engine mounted at 'kv-prod'. They need a policy for a batch job that must read the current version of the secret at 'kv-prod/data/reporting/api' and must also be able to permanently remove the secret's data at that same path when the reporting cycle ends. Which policy snippet correctly grants exactly these permissions?

Accepted Answer

path "kv-prod/data/reporting/api" { capabilities = ["read", "destroy"] }. KV v2 splits operations across data, metadata, delete, and destroy endpoints. Reading the current value requires the read capability on the data path, while permanently erasing a version's data requires the destroy capability on that same data path. Combining read and destroy on 'kv-prod/data/reporting/api' grants precisely the requested behavior without exposing metadata management or soft-delete operations.

Answer

path "kv-prod/metadata/reporting/api" { capabilities = ["read", "delete"] }

Answer

path "kv-prod/data/reporting/api" { capabilities = ["read", "delete"] }

Answer

path "kv-prod/delete/reporting/api" { capabilities = ["read", "destroy"] }

Question 20

A Vault administrator is creating a policy named 'app-read' that must allow reading secrets at path 'secret/data/app/config'. The policy is written in HCL as:

path "secret/data/app/config" {
  capabilities = ["read"]
}

The administrator saves this to a file 'app-read.hcl' and runs `vault policy write app-read app-read.hcl`. However, when a token with this policy attempts to read the secret, it receives a 403 permission denied error. The secret exists at that path. What is the most likely cause?

Accepted Answer

The policy was written to the wrong namespace or the token does not have the policy attached.. Even if a policy is correctly written and saved, a token must have that policy attached at creation time or via token update. Vault does not automatically apply policies to tokens. Additionally, policies are namespace-specific; a policy in one namespace does not apply to tokens in another. The 403 error indicates the token lacks the required capability, so checking policy attachment and namespace is the correct troubleshooting step.

Answer

The policy path must start with a forward slash, e.g., "/secret/data/app/config".

Answer

The policy was written without the 'list' capability, so Vault denies read access.

Answer

The policy path is missing the wildcard at the end to match the actual secret path, which includes a trailing data element.