Create Vault policies →hardMultiple ChoiceObjective-mapped

VA-003 Create Vault policies Practice Question

A company wants to grant developers the ability to read and write secrets under the path 'secret/dev/*', but only they should be able to delete their own secrets. Which policy design best meets this requirement?

⚠ Common exam trap

HashiCorp often tests the distinction between wildcard '*' (matches any number of segments) and '+' (matches exactly one segment), and the use of identity template variables to scope permissions per entity, which candidates may overlook by choosing a broad delete permission.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "secret/dev/{{identity.entity.name}}/*" { capabilities = ["delete"] }

It grants full CRUDL access to 'secret/dev/*' for reading and writing, but then restricts delete to only the path 'secret/dev/{{identity.entity.name}}/*', which uses the entity's name to ensure developers can only delete secrets under their own sub-path. This leverages Vault's identity entity name templating to enforce per-developer delete scoping.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] }
Why it's wrong here
This allows delete on all secrets, not just the user's own.
✗
path "secret/dev/*" { capabilities = ["read", "list"] }
Why it's wrong here
This only allows read and list, not write or delete.
✗
path "secret/dev/+/{{identity.entity.name}}" { capabilities = ["create", "read", "update", "delete"] }
Why it's wrong here
The '+' wildcard matches a single directory level, but the path pattern may not cover all desired paths; also missing 'list'.
✓
path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] } path "secret/dev/{{identity.entity.name}}/*" { capabilities = ["delete"] }
Why this is correct
Correctly grants full access to the dev path, but delete is only allowed on the user's own sub-path using entity name.

Go deeper

VA-003 Create Vault policies Practice Question

Why each option matters

Option-by-option breakdown

Related to this question