VA-003 Compare and configure secrets engines Practice Question
A company uses Vault to store application configuration secrets for multiple teams. The Vault cluster is running in production and has the KV secrets engine enabled at the path 'secret/' using version 2. A DevOps engineer, using a Vault token with full admin access, creates a new secret at 'secret/data/team-a/app-config' using the CLI command 'vault kv put secret/team-a/app-config key=value'. The secret is intended for the CI/CD pipeline, which uses a token with a policy that grants 'read' capability on 'secret/data/*'. The pipeline is configured to read the secret by calling the Vault API at the path 'v1/secret/team-a/app-config'. The pipeline reports a 404 Not Found error. The pipeline engineer verifies that the token is valid and has the correct policy attached. All other secrets in the same path can be read successfully by the pipeline. What is the most likely cause of the 404 error?
⚠ Common exam trap
A common mix-up: candidates confuse the CLI path (which abstracts away the '/data/' prefix) with the raw API path, leading them to think the secret was written to a different path or that the policy is wrong, when the actual issue is the missing '/data/' segment in the API call.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pipeline is using the wrong API path: for KV v2, the path must include '/data/' before the secret path.
The KV secrets engine version 2 (v2) requires the '/data/' segment in the API path for reading secret data. The pipeline is calling 'v1/secret/team-a/app-config', which omits the mandatory '/data/' prefix, causing a 404 Not Found error. The CLI command 'vault kv put' automatically handles this path translation, but the direct API call does not.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The secret engine at 'secret/' is not enabled.
Why it's wrong here
The engine is enabled, as the admin successfully wrote the secret.
- ✗
The secret was written to a different path than expected.
Why it's wrong here
The CLI command 'vault kv put secret/team-a/app-config' writes to 'secret/data/team-a/app-config' in KV v2, which is the intended location.
- ✗
The token's policy does not cover the path 'secret/team-a/app-config'.
Why it's wrong here
The policy covers 'secret/data/*', which includes the correct path; the pipeline is using a different path.
- ✓
The pipeline is using the wrong API path: for KV v2, the path must include '/data/' before the secret path.
Why this is correct
KV v2 requires '/data/' in the path; the pipeline uses 'v1/secret/team-a/app-config' instead of 'v1/secret/data/team-a/app-config'.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.