VA-003 Utilize Vault CLI and API Practice Question
A DevOps engineer is tasked with automating the rotation of a static secret stored in Vault's KV secrets engine (version 2). The secret is currently stored at path 'secret/data/app/config' with keys 'username' and 'password'. The engineer wants to update the 'password' key using the Vault CLI from a CI/CD pipeline. The pipeline uses a token with a policy that grants 'create', 'update', and 'read' capabilities on 'secret/data/app/*'. Which CLI command should the engineer use to update only the 'password' key, leaving other keys unchanged?
⚠ Common exam trap
HashiCorp often tests the distinction between `vault kv put` (full overwrite) and `vault kv patch` (partial update) in KV v2, and candidates mistakenly assume `vault write` or `vault kv put` can selectively update keys, not realizing they replace the entire secret data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault kv patch secret/data/app/config password=newpass
`vault kv patch` is specifically designed for KV v2 secrets engines to update individual keys without overwriting other keys. It performs a read-modify-write operation under the hood, sending a PATCH request to the API, which only modifies the specified fields. The policy grants 'create', 'update', and 'read' on 'secret/data/app/*', which aligns with the required capabilities for patching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vault kv put secret/data/app/config password=newpass
Why it's wrong here
'vault kv put' overwrites the entire secret; 'username' would be lost.
- ✗
vault update secret/data/app/config password=newpass
Why it's wrong here
'vault update' is not a valid Vault CLI command.
- ✓
vault kv patch secret/data/app/config password=newpass
Why this is correct
'vault kv patch' performs a partial update; only the specified key is changed.
- ✗
vault write secret/data/app/config password=newpass
Why it's wrong here
'vault write' also overwrites the entire secret data, similar to 'vault kv put'.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.