VA-003 Assess Vault tokens Practice Question
A DevOps engineer is troubleshooting an issue where a token cannot read a secret from the KV v2 engine at path 'secret/team-alpha/db-creds'. The token's policy includes the following: path "secret/team-alpha/*" { capabilities = ["read"] }. Which TWO reasons could explain the failure?
⚠ Common exam trap
Hashicorp Vault often tests the distinction between KV v1 and KV v2 path structures, specifically that KV v2 requires the 'data/' prefix in policies, which candidates frequently overlook.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The path in the policy needs to be 'secret/data/team-alpha/*'
KV v2 engine requires the path prefix 'data/' after the mount path to access the actual secret data. The policy path 'secret/team-alpha/*' only covers the metadata and sub-paths, not the data endpoint. To read a secret, the policy must specify 'secret/data/team-alpha/*' with 'read' capability, as the actual secret retrieval occurs via the 'data/' sub-path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user needs to use the token's accessor to read the secret
Why it's wrong here
The accessor is used for management, not for access.
- ✓
The path in the policy needs to be 'secret/data/team-alpha/*'
Why this is correct
KV v2 requires the 'data' prefix in policy paths for secret access.
- ✓
The token may have an additional restrictive policy from a parent token
Why this is correct
Inherited policies from parent tokens or identity can impose additional restrictions.
- ✗
The secret engine is not tuned to allow reads
Why it's wrong here
Engine tuning does not alter policy permissions.
- ✗
The token is not a child of the root token
Why it's wrong here
Parentage does not affect path-level permissions.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.