VA-003 Create Vault policies Practice Test 2 — 15 Questions

Question 1

A development team is using the Vault transit secrets engine to encrypt sensitive data in their application. They have created a policy that includes: path "transit/keys/*" { capabilities = ["encrypt", "decrypt"] } and attached it to their application tokens. However, when the application calls the '/v1/transit/encrypt/my-key' endpoint, it receives a permission denied error. The key 'my-key' exists in the transit engine. The team has verified that the token is not expired and has the correct policy attached. What is the most likely cause of the error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The encrypt and decrypt capabilities must be applied to the specific encrypt/decrypt paths, not the key metadata path.. The Vault transit secrets engine exposes encryption and decryption operations under specific API paths like `/v1/transit/encrypt/my-key` and `/v1/transit/decrypt/my-key`, not under the key metadata path `transit/keys/*`. The policy must grant `encrypt` and `decrypt` capabilities on the exact operation paths (e.g., `transit/encrypt/*` and `transit/decrypt/*`), not on the key configuration path. Since the policy only covers `transit/keys/*`, the token lacks permission to call the encrypt endpoint, resulting in a permission denied error.

Answer

The policy also needs 'read' capability on 'transit/keys/*'.

Answer

The application token has expired.

Answer

The transit engine requires the 'create' capability on the key to perform encryption.

Question 2

A Vault administrator needs to create a policy for a developer who must read and list secrets from the path 'secret/data/engineering/' and create new secrets under 'secret/data/engineering/projects/'. Which two policy statements should the administrator include? (Choose two.)

Accepted Answer

path "secret/data/engineering/projects/*" { capabilities = ["create"] }. Option E is correct because the developer must read and list secrets under 'secret/data/engineering/', and the wildcard path 'secret/data/engineering/*' with capabilities ["read","list"] grants exactly those permissions on all secrets beneath that KV v2 path. Option C is correct because creating new secrets under 'secret/data/engineering/projects/' requires the 'create' capability on the path 'secret/data/engineering/projects/*', which matches any new secret name in that subtree. Option A is not selected because it adds 'update' capability, which was not requested and would allow modifying existing secrets. Option B is not selected because it targets the exact path 'secret/data/engineering' without a wildcard, so it would not cover secrets stored under that prefix. Option D is not selected because 'secret/engineering/*' omits the 'data/' segment required by the KV v2 API path, so it would not match the actual secret paths.

Answer

path "secret/data/engineering/projects/*" { capabilities = ["create","update"] }

Answer

path "secret/data/engineering" { capabilities = ["read","list"] }

Answer

path "secret/engineering/*" { capabilities = ["read","list"] }

Question 3

Refer to the exhibit. Based on the policy shown, which statement is true?

Accepted Answer

A user can read all secrets under secret/data/engineering/.. The policy shown grants 'read' capability on the path 'secret/data/engineering/*'. In Vault, the 'read' capability allows listing and reading secrets at that path, but not creating, updating, or deleting them. Therefore, a user can read all secrets under secret/data/engineering/.

Answer

A user can create secrets under secret/data/engineering/.

Answer

A user can delete secrets under secret/data/engineering/.

Answer

A user can update secrets under secret/data/engineering/.

Question 4

A platform team manages a Vault KV v2 secrets engine mounted at 'kv-prod'. They need a policy for a batch job that must read the current version of the secret at 'kv-prod/data/reporting/api' and must also be able to permanently remove the secret's data at that same path when the reporting cycle ends. Which policy snippet correctly grants exactly these permissions?

Accepted Answer

path "kv-prod/data/reporting/api" { capabilities = ["read", "destroy"] }. KV v2 splits operations across data, metadata, delete, and destroy endpoints. Reading the current value requires the read capability on the data path, while permanently erasing a version's data requires the destroy capability on that same data path. Combining read and destroy on 'kv-prod/data/reporting/api' grants precisely the requested behavior without exposing metadata management or soft-delete operations.

Answer

path "kv-prod/metadata/reporting/api" { capabilities = ["read", "delete"] }

Answer

path "kv-prod/data/reporting/api" { capabilities = ["read", "delete"] }

Answer

path "kv-prod/delete/reporting/api" { capabilities = ["read", "destroy"] }

Question 5

A Vault administrator is creating a policy named 'app-read' that must allow reading secrets at path 'secret/data/app/config'. The policy is written in HCL as:

path "secret/data/app/config" {
  capabilities = ["read"]
}

The administrator saves this to a file 'app-read.hcl' and runs `vault policy write app-read app-read.hcl`. However, when a token with this policy attempts to read the secret, it receives a 403 permission denied error. The secret exists at that path. What is the most likely cause?

Accepted Answer

The policy was written to the wrong namespace or the token does not have the policy attached.. Even if a policy is correctly written and saved, a token must have that policy attached at creation time or via token update. Vault does not automatically apply policies to tokens. Additionally, policies are namespace-specific; a policy in one namespace does not apply to tokens in another. The 403 error indicates the token lacks the required capability, so checking policy attachment and namespace is the correct troubleshooting step.

Answer

The policy path must start with a forward slash, e.g., "/secret/data/app/config".

Answer

The policy was written without the 'list' capability, so Vault denies read access.

Answer

The policy path is missing the wildcard at the end to match the actual secret path, which includes a trailing data element.

Question 6

A platform team is onboarding a third-party monitoring tool that authenticates to Vault with a token and must only be able to check whether a specific secret exists at 'secret/data/monitoring/api-key' without ever retrieving its contents. Which policy grants exactly this minimal access?

Accepted Answer

path "secret/metadata/monitoring/api-key" { capabilities = ["read"] }. KV v2 separates data operations from metadata operations. Reading the metadata path reveals version and deletion information, which confirms a secret exists, while reading the data path returns the stored values. Because the monitoring tool only needs an existence check, scoping the policy to the metadata path with the read capability enforces least privilege and keeps the API key value out of reach.

Answer

path "secret/data/monitoring/api-key" { capabilities = ["list"] }

Answer

path "secret/data/monitoring/api-key" { capabilities = ["read", "list"] }

Answer

path "secret/data/monitoring/api-key" { capabilities = ["read"] }

Question 7

A Vault administrator is creating a policy for a token that must be able to create child tokens and also revoke its own token. Which two capabilities should be included in the policy? (Choose two.)

Accepted Answer

update on "auth/token/revoke-self". Creating a child token requires write access to auth/token/create, which is granted via update (or create) capability. Revoking the token itself requires write access to auth/token/revoke-self, also granted via update capability. Read on lookup-self and list on accessors are not required for these actions, and sudo on revoke-self does not grant the necessary write permission.

Answer

list on "auth/token/accessors"

Answer

read on "auth/token/lookup-self"

Answer

sudo on "auth/token/revoke-self"

Question 8

A Vault administrator needs to write a policy that allows a user to read secrets from 'secret/data/team/*' but denies access to any secrets under 'secret/data/team/confidential/*'. The policy must use a deny rule. Which policy correctly implements this?

Accepted Answer

path "secret/data/team/*" { capabilities = ["read"] }
path "secret/data/team/confidential/*" { capabilities = ["deny"] }. Vault policies evaluate deny rules with higher priority than allow rules when the deny rule is more specific. To allow reading all team secrets except those under confidential, the policy must grant read on secret/data/team/* and add a deny rule on secret/data/team/confidential/*. The deny rule must include the wildcard to cover all subpaths under confidential. Combining allow and deny on the same path is invalid.

Answer

path "secret/data/team/*" { capabilities = ["read", "deny"] }

Answer

path "secret/data/team/*" { capabilities = ["read"] }
path "secret/data/team/confidential/*" { capabilities = ["read"] }

Answer

path "secret/data/team/*" { capabilities = ["read"] }
path "secret/data/team/confidential" { capabilities = ["deny"] }

Question 9

A security engineer is writing a policy for an application that authenticates through the userpass auth method. The application must be able to rotate its own password by calling the password update endpoint for its own username, but must not be able to change any other user's password or create new users. Which policy statement accomplishes this?

Accepted Answer

path "auth/userpass/users/app-svc" { capabilities = ["update"] }. Vault evaluates policies against the exact request path, so the path must name the specific userpass user record. The update capability on that single record allows the application to set a new password for itself. Omitting wildcards and the create capability enforces least privilege, preventing the service from touching other accounts or provisioning new ones.

Answer

path "auth/userpass/users/app-svc/password" { capabilities = ["update"] }

Answer

path "auth/userpass/users/*" { capabilities = ["update"] }

Answer

path "auth/userpass/users/app-svc" { capabilities = ["create", "update"] }

Question 10

A junior administrator is asked to give a reporting tool read-only access to all secrets under the KV v2 mount named 'kv-prod', including the ability to enumerate secret names for a directory listing feature. Which single policy block provides the required access?

Accepted Answer

path "kv-prod/data/*" { capabilities = ["read"] } and path "kv-prod/metadata/*" { capabilities = ["list"] }. KV v2 splits value retrieval from name enumeration: the data prefix holds values and the metadata prefix holds version and listing information. A read-only consumer therefore needs read on the data prefix and list on the metadata prefix. Combining those two statements grants the reporting tool exactly the access described without exposing administrative or destructive capabilities.

Answer

path "kv-prod/metadata/*" { capabilities = ["read", "list"] }

Answer

path "kv-prod/*" { capabilities = ["read", "list"] }

Answer

path "kv-prod/data/*" { capabilities = ["read"] }

Question 11

A Vault administrator needs to grant a user the ability to create and manage policies. Which Vault policy capability is required on the 'sys/policies/acl/*' path to allow writing new policies?

Accepted Answer

create. In Vault, the 'create' capability on the 'sys/policies/acl/*' path is required to write new policies. This capability allows the creation of new ACL policies. The 'update' capability is needed to modify existing policies, but creating a new policy requires 'create'. Administrators typically grant both create and update to allow full policy management.

Answer

write

Answer

sudo

Answer

update

Question 12

Drag and drop the steps to create and use a periodic service token in Vault into the correct order.

Accepted Answer

Create role, generate token, use token, renew periodically. First create the role, then generate a token with a TTL, use it, and renew periodically.

Answer

Generate token, create role, use token, renew periodically

Answer

Create role, use token, renew periodically, generate token

Answer

Generate token, use token, renew periodically, create role

Question 13

A security administrator wants to create a policy that allows a service to renew its own token and list its own token capabilities, but not create new tokens. Which policy statements should be included?

Accepted Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["read"] }. It uses the correct endpoints and capabilities: update for renew-self and read for capabilities-self. Option B uses create for renew-self, which is incorrect (renew-self requires update). Option C uses update for capabilities-self, which is wrong (capabilities-self requires read). Option D uses non-self endpoints (renew and capabilities) which would allow renewing or checking capabilities of any token, granting broader privileges than intended.

Answer

path "auth/token/renew-self" { capabilities = ["create"] }; path "auth/token/lookup-self" { capabilities = ["read"] }

Answer

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["update"] }

Answer

path "auth/token/renew" { capabilities = ["update"] }; path "auth/token/capabilities" { capabilities = ["read"] }

Question 14

A Vault policy must allow a service to read secrets from "secret/data/app" and also be able to renew its own token. Which two policy statements are necessary and sufficient for this requirement? (Select two.)

Accepted Answer

path "secret/data/app" { capabilities = ["read"] }. The policy must grant read access to the specific path 'secret/data/app' for the service to retrieve secrets. Option B is correct because renewing a token requires the 'update' capability on the 'auth/token/renew-self' endpoint, which allows the service to extend its own token's TTL without needing broader token management privileges.

Answer

path "auth/token/renew" { capabilities = ["update"] }

Answer

path "secret/data/app/*" { capabilities = ["read"] }

Answer

path "sys/auth" { capabilities = ["read"] }

Question 15

Refer to the exhibit. A user with this policy attempts to read the secret at path "secret/data/team-a/admin". What will happen?

Accepted Answer

The read is denied because the deny policy takes precedence.. The deny policy takes precedence over any allow policy in Vault, regardless of the path specificity. Even though the first path grants read access to 'secret/data/team-a/*', the second path explicitly denies all capabilities (including read) on 'secret/data/team-a/admin', which is a more specific path. Vault's policy evaluation uses a deny-overrides model, so the deny action blocks the read operation.

Answer

The read fails because the path does not exist.

Answer

The read succeeds because the first path grants read.

Answer

The read succeeds because deny only applies to write operations.