VA-003 Utilize Vault CLI and API Practice Question
A junior administrator is writing a shell script that will be used by other team members to retrieve static secrets from Vault. The secrets are stored in the KV v2 secrets engine mounted at `secret/`. One particular secret, `credentials`, is located under the path `secret/data/credentials`. The administrator has already authenticated using the Vault CLI with a token that has read access specifically to that path. The environment variables `VAULT_ADDR` and `VAULT_TOKEN` are set correctly to point to the Vault server at `https://vault.example.com:8200` and the valid token. The script needs to run the correct command to retrieve the secret and output its key-value pairs for use by an application. Which command should the administrator include in the script?
⚠ Common exam trap
A common pitfall in Vault exams is confusing KV v1 and KV v2 path handling. With `vault kv get`, Vault automatically appends `/data/` to the path, so using the full path `secret/data/credentials` would cause a double `/data/` and fail. Candidates often use `vault read` for KV v2 secrets, which requires the full `/data/` path, or incorrectly omit the mount path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault kv get secret/credentials
`vault kv get secret/credentials` is the proper command for the KV v2 secrets engine. The KV v2 engine automatically appends `/data/` to the path when reading secrets, so specifying the full path `secret/data/credentials` would result in a double `/data/` prefix, causing a 404 error. Since the environment variables are set and the token has read access, this command will retrieve the secret and output its key-value pairs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vault kv get secret/data/credentials
Why it's wrong here
This would attempt to read `secret/data/data/credentials`, which does not exist.
- ✗
vault read secret/data/credentials
Why it's wrong here
This is valid but `vault kv get` is the standard CLI command for KV v2.
- ✗
vault read secret/credentials
Why it's wrong here
This would attempt to read `secret/credentials` which does not exist for KV v2 (actual path is `secret/data/credentials`).
- ✓
vault kv get secret/credentials
Why this is correct
Correct command; the CLI abstracts the /data/ prefix for KV v2 engines.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.