VA-003 KV v2 Policy Path Practice Question
A company runs a monolithic application that reads database credentials from Vault KV v2 secrets engine at path 'app/db'. The application authenticates using an AppRole with a periodic token that renews automatically. Recently, the application started failing with permission denied errors when reading the secret. The administrator checks the AppRole's secret-id and token but they are valid. The administrator then runs `vault token capabilities $(cat /tmp/token) app/db/data` and gets an empty list. The administrator knows that the token has the 'app-policy' policy attached. They also run `vault read sys/policy/app-policy` and see the policy rules. The policy allows explicit 'read' on 'app/db/data'. What could be the issue?
⚠ Common exam trap
Candidates often overlook that a missing secret can also cause permission denied errors, even when the policy is correct. The capabilities command will show an empty list for non-existent paths if no policy grants access to that exact path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The secret at 'app/db/data' does not exist
The policy explicitly allows 'read' on 'app/db/data', so the issue is not a policy path mismatch. The empty capabilities list from `vault token capabilities` suggests that the secret at 'app/db/data' does not exist, and Vault returns an empty capabilities list for non-existent paths when no policy grants access to that exact path. Since the application receives permission denied errors, the most likely cause is that the secret has not been created or has been deleted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The secret at 'app/db/data' does not exist
Why this is correct
Correct. If the secret does not exist, Vault returns permission denied errors, and the capabilities command returns an empty list because there is no path to evaluate.
- ✗
The policy path is incorrect because KV v2 requires granting access to 'app/db/data' but the policy might be written for KV v1 syntax
Why it's wrong here
Incorrect. The STEM states the policy explicitly allows 'read' on 'app/db/data', so the policy path is correct for KV v2.
- ✗
The token has expired and needs to be renewed
Why it's wrong here
Incorrect. The token is valid and renews automatically, so expiration is not the issue.
- ✗
The Capabilities command does not work with AppRole tokens
Why it's wrong here
Incorrect. The `vault token capabilities` command works with any token, including AppRole tokens.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.