VA-003 Create Vault policies Practice Question
A DevOps team is writing a Vault policy for a CI/CD pipeline that needs to authenticate using AppRole, read specific secrets, and write dynamic database credentials. Which THREE capabilities should be included in the policy to meet these requirements? (Choose three.)
⚠ Common exam trap
Candidates often confuse 'write' with 'create' and 'update', not realizing that Vault uses specific capabilities: 'create' for new resources, 'update' for changes to existing ones, and 'read' for reading data (including generating dynamic credentials). The 'write' capability is a more generic permission that was used in older policies but is now replaced by finer-grained capabilities. Also, generating dynamic database credentials requires 'read' on the creds path, not 'create'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
read
The only capability required for the described tasks is 'read'. Reading specific secrets from KV v2 or generating dynamic database credentials (via database/creds/<role-name>) both use the 'read' operation. AppRole authentication is handled before the policy applies; the policy itself does not need to grant capabilities for the login process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
write
Why it's wrong here
Incorrect. 'write' is a generic capability that is not required; it is not used for generating dynamic credentials (which use 'read') or for authentication.
- ✗
create
Why it's wrong here
Incorrect. 'create' is not needed because the pipeline does not create AppRole roles or database roles; it only uses existing ones.
- ✓
read
Why this is correct
Correct. 'read' is required to read secrets and to generate dynamic database credentials (both are read operations).
- ✗
sudo
Why it's wrong here
Incorrect. 'sudo' is not required for any of the given tasks.
- ✗
update
Why it's wrong here
Incorrect. 'update' is not needed because the pipeline does not modify existing secrets; it only reads them and generates dynamic creds.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.