VA-003 Utilize Vault CLI and API Practice Question
A team is migrating from a monolithic application to microservices. Each microservice needs to authenticate to Vault using its own AppRole. The security team wants to enforce that each AppRole can only read secrets from its own dedicated path (e.g., service-a can only read from 'services/service-a/*', service-b from 'services/service-b/*'). They have created the AppRoles and policies. However, during testing, they notice that service-a can read secrets from service-b's path. The administrator checks the policy for service-a and sees it has a 'capabilities' list on 'services/service-a/*' and also 'services/service-b/*' by mistake. They correct the policy, but the issue persists. What is the most likely reason that service-a still has access?
⚠ Common exam trap
HashiCorp often tests the misconception that policy updates are immediately enforced on all existing tokens, when in fact tokens carry a snapshot of policies at issuance and require re-issuance to reflect changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token was issued before the policy was corrected and still carries the old policy version; it must be replaced or renewed to get the updated permissions
Vault tokens are immutable once issued; they carry a snapshot of the policies at the time of creation. Correcting the policy on the Vault server does not retroactively update existing tokens. Service-a's token was issued before the policy fix and still contains the old policy that granted access to 'services/service-b/*'. The token must be replaced (revoked and re-issued) or renewed to pick up the updated policy permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy still contains an error that grants access to the wrong path
Why it's wrong here
The administrator already inspected and corrected the service-a policy, so a residual path error contradicts the stated remediation. It tempts because policy mistakes are the usual cause of cross-path access, and it would be correct had the correction not been verified as applied.
- ✗
The policy update has not been applied to the Vault cluster yet
Why it's wrong here
Vault policies are read from storage on each request, so a saved correction takes effect immediately; no cluster-wide push is pending. The persistence points to the AppRole's token retaining its original policy set until the secret ID or token is regenerated. Policy propagation is tempting because distributed systems often cache configuration, but Vault does not here.
- ✗
The service-a token has a second policy attached that grants access to service-b
Why it's wrong here
Vault merges all policies attached to a token, and the union of capabilities applies; a second policy granting services/service-b/* would preserve access after correcting the first. It tempts because the visible policy appears fixed, yet it would be correct only if another policy were actually attached.
- ✓
The token was issued before the policy was corrected and still carries the old policy version; it must be replaced or renewed to get the updated permissions
Why this is correct
Vault tokens embed a snapshot of their policies at issuance; policy edits do not retroactively alter existing tokens. Service-a's token still holds the pre-correction policy granting services/service-b/*, so it must be reissued or renewed to inherit the corrected policy.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.