VA-003 Create Vault policies Practice Question
A Vault administrator is writing a policy for a monitoring tool that must be able to list all secrets under the 'secret/metadata/finance/' path and read the metadata of individual secrets, but must not read the secret data itself. Which policy snippet correctly grants only these permissions?
⚠ Common exam trap
The trap here is assuming that list and read on the data/ path will allow listing secrets and reading metadata, when in fact KV v2 separates metadata and data operations into distinct paths.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
path "secret/metadata/finance/*" { capabilities = ["list", "read"] }
In Vault's KV v2 secrets engine, metadata operations such as listing secrets and reading secret metadata are performed on the metadata/ path, while reading and writing secret data uses the data/ path. To allow listing and reading metadata without accessing secret data, the policy must grant list and read on secret/metadata/finance/*. The other options either target the wrong path or omit required capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
path "secret/data/finance/*" { capabilities = ["list", "read"] }
Why it's wrong here
This snippet targets the data/ path, which is used to read and write the actual secret data, not metadata. Granting read here would allow reading the secret contents, violating the requirement that the tool must not read secret data. List on the data path is also not the correct way to list secrets in KV v2.
- ✗
path "secret/metadata/finance/*" { capabilities = ["read"] }
Why it's wrong here
This snippet allows reading metadata of individual secrets but omits the list capability. The monitoring tool must be able to list all secrets under the finance path, which requires the list capability on the metadata path. Therefore, this does not satisfy the requirement to list secrets.
- ✓
path "secret/metadata/finance/*" { capabilities = ["list", "read"] }
Why this is correct
This snippet grants list and read capabilities on the metadata path for all secrets under finance. In KV v2, metadata operations like listing and reading secret metadata are performed on the metadata/ path, so this precisely meets the requirement without granting access to the actual secret data.
- ✗
path "secret/finance/*" { capabilities = ["list", "read"] }
Why it's wrong here
This snippet uses a path without the metadata/ or data/ prefix, which is incorrect for KV v2 secrets engine. Vault would not match the actual metadata or data paths, so the policy would not grant the intended permissions and would likely result in permission denied errors when the tool attempts to list or read metadata.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.