VA-003 Assess Vault tokens Practice Question
Exhibit
Refer to the exhibit.
```json
{
"policy": [
{
"path": "secret/data/engineering/*",
"capabilities": ["read"]
},
{
"path": "secret/engineering/special",
"capabilities": ["create", "update"]
}
]
}
```A token with this policy attempts to read the secret at path 'secret/data/engineering/special'. Will the read succeed?
⚠ Common exam trap
A common trap is thinking that a more specific path overrides a less specific one. In Vault, ACL policies are additive; permissions are merged unless there is an explicit denial.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because the first path grants read on all secrets under 'secret/data/engineering/'
The first path grants read on secret/data/engineering/*, which includes 'special'. The second path grants create/update on a different path (without 'data' prefix) and does not deny read. Vault merges capabilities, so read is allowed. Option B is wrong because ACL merging does not cause one statement to override another unless there is an explicit deny. Option C is wrong because the token already has a policy covering that path. Option D is wrong because the second path does not grant read but also does not deny it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Yes, because the first path grants read on all secrets under 'secret/data/engineering/'
Why this is correct
The wildcard includes 'special'.
- ✗
No, because the token needs an additional policy to read from that specific path
Why it's wrong here
The first policy already covers it.
- ✗
Yes, because the second path implicitly allows read
Why it's wrong here
The second path explicitly only allows create/update; it does not grant read.
- ✗
No, because the second path is more specific and only allows create/update
Why it's wrong here
Specificity does not override; Vault merges capabilities.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.