Explain Vault architecture →easyMultiple ChoiceObjective-mapped

VA-003 Explain Vault architecture Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "path": {
    "secret/data/production/*": {
      "capabilities": ["read", "list"]
    },
    "secret/data/staging/*": {
      "capabilities": ["create", "update", "delete"]
    }
  }
}
```

A user has the above policy attached. What operation can the user perform on 'secret/data/production/db_password'?

⚠ Common exam trap

HashiCorp often tests the distinction between capabilities on the data path versus the metadata path, tricking candidates into thinking 'read' on the data path allows modifying metadata when it only allows reading it.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Read the secret

The policy grants 'read' capability on 'secret/data/production/db_password'. In Vault's KV Secrets Engine v2, the 'read' capability allows retrieving the secret data and its metadata. Therefore, the user can read the secret, which includes both the data and metadata. Option B is correct because the policy explicitly allows the read operation on that path.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Update the metadata of the secret
Why it's wrong here
Update metadata requires 'update' capability, which is not granted.
✓
Read the secret
Why this is correct
Read capability is explicitly granted.
✗
Delete the secret
Why it's wrong here
Delete is not included in the capabilities for production path.
✗
Write a new version of the secret
Why it's wrong here
Write, create, update are not allowed on production path.

Go deeper

VA-003 Explain Vault architecture Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question