VA-003 Create Vault policies Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. An application needs to encrypt data using the transit engine with key "app-key". It currently has this policy. Which statement is true?

Accepted Answer

The policy allows both encryption and decryption, which is correct for the transit engine.. Option C is correct. In Vault Transit, encryption and decryption operations require 'create' or 'update' capabilities on the respective endpoints. The policy provides both, allowing the application to encrypt and decrypt as needed.

Answer

The policy allows both encryption and decryption, but the capabilities should be "read" and "write" instead.

Answer

The policy allows encryption but not decryption, which is sufficient.

Answer

The policy incorrectly uses "create" and "update" for transit operations; it should use "read" and "write".

Question 2

Refer to the exhibit. A user with this policy tries to write a new secret to "secret/data/production/db". What will happen?

Accepted Answer

The write fails because the policy only allows read on production.. Option B is correct. The policy for production only allows read, so write operations (create/update) are denied. The path does match the production glob, but capabilities do not permit write.

Answer

The write succeeds if the secret already exists.

Answer

The write succeeds because the path matches.

Answer

The write fails because the user does not have list capability.

Question 3

A company uses Vault's KV v2 secrets engine. A policy is needed to allow a service to only update existing secrets at path "secret/data/service/config", but not create new ones. Which capabilities should be included?

Accepted Answer

["update"]. Option C is correct. The 'update' capability alone allows modifying existing secrets without creating new ones. 'create' would allow new secrets, and 'read' would add unnecessary read access. 'write' is not a valid capability.

Answer

["read", "update"]

Answer

["write"]

Answer

["create", "update"]

Question 4

An administrator wants to create a policy that grants the ability to list all authentication methods enabled on the Vault server. Which path and capability are required?

Accepted Answer

path "sys/auth" { capabilities = ["list"] }. Option B is correct. The path 'sys/auth' with 'list' capability lists all auth methods. Option A with 'read' would give details but not list. Option C includes both, which is overkill. Option D uses a wildcard that may also list unrelated items.

Answer

path "sys/auth" { capabilities = ["read", "list"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Answer

path "auth/*" { capabilities = ["list"] }

Question 5

A Vault policy includes the following statement: path "secret/data/+/app" { capabilities = ["read"] }. Which paths would match this policy? (Assume KV v2)

Accepted Answer

secret/data/team-a/app. Option A is correct. The '+' glob matches exactly one path segment. So 'secret/data/team-a/app' has one segment between 'data/' and '/app', matching. Option B has two segments, so no match. Option C has no segment. Option D has an additional segment after app, so no match.

Answer

secret/data/team-a/app/db

Answer

secret/data/team-a/team-b/app

Answer

secret/data/app

Question 6

A policy must allow a user to revoke their own token. Which endpoint and capability are required?

Accepted Answer

path "auth/token/revoke-self" { capabilities = ["update"] }. Option A is correct. The endpoint 'auth/token/revoke-self' with 'update' capability allows a user to revoke their own token. 'write' is not a standard capability. The other options either use wrong endpoints or capabilities.

Answer

path "auth/token/revoke" { capabilities = ["update"] }

Answer

path "auth/token/revoke-self" { capabilities = ["write"] }

Answer

path "sys/leases/revoke" { capabilities = ["update"] }

Question 7

A Vault policy has the following: path "identity/entity/id/*" { capabilities = ["read", "list"] }. What does this policy allow?

Accepted Answer

Listing all identity entities and reading their details.. Option D is correct. The path matches entity IDs. 'list' allows listing all entity IDs, and 'read' allows reading the details of each entity. Option A is too broad (might include aliases). Option B is partially correct but D is more precise. Option C includes update which is not allowed.

Answer

Reading and updating all identity entities.

Answer

Reading and listing all identity entities.

Answer

Reading and listing all identity entity IDs.

Question 8

A Vault cluster has several policies. One policy, "app-policy", contains: path "secret/data/app/*" { capabilities = ["create", "update"] }. Another policy, "admin-policy", includes: path "secret/data/app/db" { capabilities = ["deny"] }. A token is attached with both policies. Can the token write to "secret/data/app/db"?

Accepted Answer

No, because deny takes precedence over allow.. Option B is correct. In Vault, deny statements override any other capabilities regardless of policy ordering. Therefore, the explicit deny on the specific path prevents the write, even though the first policy allows create/update.

Answer

No, because the paths conflict.

Answer

Yes, because policies are additive.

Answer

Yes, because the first policy allows create/update.

Question 9

A DevOps team has configured a Vault policy to allow reading secrets from the 'secret/data/engineering' path. The policy contains:

path "secret/data/engineering/*" {
  capabilities = ["read", "list"]
}

However, when a user attempts to read a secret at 'secret/data/engineering/db/password', they receive a permission denied error. What is the most likely cause?

Accepted Answer

The policy uses a single asterisk, which does not match nested paths; it should use double asterisk or specify the exact path.. Option A is correct because Vault's path glob treats a single asterisk (*) as matching any sequence of characters except '/'. Therefore, it does not match nested paths. To match nested paths, use double asterisk (**). Option B is incorrect because 'deny' is not a valid capability. Option C is possible but less likely given the policy pattern. Option D is incorrect; the mount path is correct for KV v2.

Answer

The policy lacks the 'deny' capability to override the default deny.

Answer

The secret engine's mount path is different; it is mounted at 'secret/' but the policy expects 'secret/data/'.

Answer

The user's token does not have the correct identity policies attached.

Question 10

An organization is implementing Vault policies for the first time. They want to ensure that policies are easy to manage and follow the principle of least privilege. Which approach should they take when creating policies?

Accepted Answer

Create separate policies for each application and use group aliases to attach them.. Option D is correct because creating separate policies per application and using group aliases to attach them allows granular control and follows least privilege. Option A is monolithic and insecure. Option B gives too much power. Option C is backwards; tokens inherit policies, not the other way.

Answer

Create policies with broad paths and then restrict via ACL tokens.

Answer

Create a single policy with a wildcard path '*' and full capabilities for all administrators.

Answer

Create a single policy with all paths and capabilities for all users.

Question 11

A Vault administrator needs to create a policy that grants users read access only to the secrets that belong to their own team. The team membership is stored in an external identity provider and mapped to Vault entity aliases. The administrator wants to use a templated policy that references the entity's metadata. Which policy syntax accomplishes this goal?

Accepted Answer

path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }. Option C is correct because Vault's policy templating uses the format {{identity.entity.metadata.<key>}} to reference entity metadata. Option A misses the 'identity.' prefix. Option B uses 'entity' without 'identity'. Option D uses an invalid template syntax.

Answer

path "secret/data/{{entity.metadata.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{.team}}/*" { capabilities = ["read", "list"] }

Answer

path "secret/data/{{identity.entity.aliases.team}}/*" { capabilities = ["read", "list"] }

Question 12

A developer has a policy that grants 'create' capability on path 'secret/data/team/*'. They successfully create a new secret using 'vault kv put secret/data/team/db', but when they try to update the same secret with new data, they get a permission denied error. What is the most likely cause?

Accepted Answer

The policy does not include the 'update' capability, which is required for modifying existing secrets.. Option B is correct because in KV v2, creating a new secret requires the 'create' capability, while updating an existing secret requires the 'update' capability. The policy only grants 'create', so updates fail. Option A is incorrect because the developer already created a secret. Option C is incorrect; 'list' is not needed for updates. Option D is incorrect; 'sudo' is not required.

Answer

The developer does not have the 'create' capability on the parent path.

Answer

The policy needs the 'list' capability on the path.

Answer

The developer's token lacks the 'sudo' capability for updates.

Question 13

An organization is creating Vault policies to manage access to secrets across multiple application teams. According to HashiCorp best practices, which two approaches should be taken when designing policies? (Choose two.)

Accepted Answer

Use path templating to incorporate entity metadata.. Options B and D are correct. Path templating with entity metadata reduces policy duplication, and naming policies by application or team improves manageability. Option A is monolithic and insecure. Option C violates least privilege. Option E is not a recommended practice; deny can be useful for exceptions.

Answer

Avoid using negative capabilities (deny) when possible.

Answer

Grant maximum permissions initially and then restrict as needed.

Answer

Use a single all-encompassing policy for each environment.

Question 14

A company has deployed Vault with an LDAP auth method and has created entity aliases for all users. The company uses KV v2 secrets engine mounted at 'secret/'. Each team's secrets are stored under a path like 'secret/data/team_<team_name>/'. They have multiple teams (engineering, marketing, sales). Currently, an administrator manually creates a separate policy for each team, e.g., path "secret/data/team_engineering/*" { capabilities = ["read", "list"] }. This is becoming cumbersome as new teams are added. The administrator wants to create a single policy that dynamically grants read access to the secrets path corresponding to the user's team, which is stored in the entity's metadata as 'team'. The LDAP auth method is configured to sync group memberships and map to entity aliases, and the entity metadata is correctly populated. Which approach should the administrator take?

Accepted Answer

Create a policy using a templated path: path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }.. Option B is correct because Vault's policy templating allows using {{identity.entity.metadata.team}} to dynamically insert the team name from the entity's metadata into the path. This creates a single policy that works for all teams without manual updates. Option A gives too broad access. Option C is not a valid policy mechanism. Option D is insecure and not scalable.

Answer

Create a policy using a wildcard alias for each team in the entity alias.

Answer

Create a policy that uses the 'default' policy to allow all reads and then restrict with ACL tokens.

Answer

Create a policy with path "secret/data/*" { capabilities = ["read", "list"] } and assign it to all users.

Question 15

A development team is using the Vault transit secrets engine to encrypt sensitive data in their application. They have created a policy that includes: path "transit/keys/*" { capabilities = ["encrypt", "decrypt"] } and attached it to their application tokens. However, when the application calls the '/v1/transit/encrypt/my-key' endpoint, it receives a permission denied error. The key 'my-key' exists in the transit engine. The team has verified that the token is not expired and has the correct policy attached. What is the most likely cause of the error?

Accepted Answer

The encrypt and decrypt capabilities must be applied to the specific encrypt/decrypt paths, not the key metadata path.. Option B is correct because the encrypt and decrypt operations are performed at the 'transit/encrypt/' and 'transit/decrypt/' endpoints, not at the 'transit/keys/' path which is used for key management (create, read, delete, etc.). The policy must grant the encrypt capability on 'transit/encrypt/my-key' or a wildcard under that path. Option A is not required for encryption. Option C is not a cause; token expiration was verified. Option D is incorrect; 'create' is not needed for encryption.

Answer

The policy also needs 'read' capability on 'transit/keys/*'.

Answer

The application token has expired.

Answer

The transit engine requires the 'create' capability on the key to perform encryption.

VA-003 Create Vault policies Practice Test 2 — 15 Questions

Exhibit

VA-003 Create Vault policies Practice Test 2 — 15 Questions

Exhibit