VA-003 Create Vault policies Practice Question
A DevOps team is managing secrets for a microservices application using Vault. They have created a policy named 'app-policy' that grants read access to secrets under the path 'secret/data/app/*'. The policy is assigned to an AppRole role. When a service authenticates with the role ID and secret ID, it receives a token but is unable to read secrets from 'secret/data/app/db-creds'. The token's identity metadata shows the policies associated with the token include 'default' and 'app-policy'. The Vault server logs show no errors. The service can successfully read other secrets from the same path, like 'secret/data/app/config'. What is the most likely cause of the issue?
⚠ Common exam trap
HashiCorp often tests the distinction between a missing secret and a policy denial, trapping candidates who assume that a 'permission denied' response always indicates a policy issue, when in fact Vault returns a 404 for non-existent paths without logging an error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The secret 'secret/data/app/db-creds' does not exist in Vault.
The most likely cause is that the secret 'secret/data/app/db-creds' does not exist in Vault. The token has the 'app-policy' policy attached, which grants read access to 'secret/data/app/*', and the service can successfully read other secrets under that path (e.g., 'secret/data/app/config'). The absence of Vault server errors indicates that the policy is correctly evaluated and the path is valid, but a read on a non-existent secret returns a 404 (or a permission-denied-like response) without logging an error. The token's metadata confirms the policy is present, ruling out policy assignment issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The secret 'secret/data/app/db-creds' does not exist in Vault.
Why this is correct
Other secrets work, so this specific secret likely does not exist.
- ✗
The token does not have the 'app-policy' policy attached due to a misconfiguration in the role.
Why it's wrong here
The token's metadata shows 'app-policy' is attached.
- ✗
There is an explicit deny rule in the policy that denies access to 'db-creds'.
Why it's wrong here
The policy shown does not contain any deny rules.
- ✗
The token is periodic and does not have the correct capabilities for the path.
Why it's wrong here
Periodic tokens are not required for AppRole; the policy is attached correctly.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.