VA-003 Create Vault policies Practice Question
A Vault administrator needs to create a policy for a developer who must read and list secrets from the path 'secret/data/engineering/' and create new secrets under 'secret/data/engineering/projects/'. Which two policy statements should the administrator include? (Choose two.)
⚠ Common exam trap
The VA-003 exam often tests the distinction between KV v1 and KV v2 path structures — the trap here is that candidates forget the mandatory 'data/' prefix in KV v2 paths, leading them to select option D, or they overlook that 'create' alone (without 'update') is sufficient for creating new secrets, causing them to choose the overly permissive option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
path "secret/data/engineering/projects/*" { capabilities = ["create"] }
The developer needs to create new secrets under 'secret/data/engineering/projects/', which requires the 'create' capability on that path. Option E is correct because the developer needs to read and list secrets from 'secret/data/engineering/', and the wildcard 'secret/data/engineering/*' covers all paths under that prefix, including the base path itself when using KV v2 (the 'data/' prefix is part of the path).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
path "secret/data/engineering/projects/*" { capabilities = ["create","update"] }
Why it's wrong here
Incorrect: While it grants create, it also grants update which is not required, and it is not minimal.
- ✗
path "secret/data/engineering" { capabilities = ["read","list"] }
Why it's wrong here
Incorrect: Without a glob, this only matches an exact key named 'engineering', not subkeys.
- ✓
path "secret/data/engineering/projects/*" { capabilities = ["create"] }
Why this is correct
Correct: Grants create capability on the projects subpath, fulfilling the create requirement with minimal permissions.
- ✗
path "secret/engineering/*" { capabilities = ["read","list"] }
Why it's wrong here
Incorrect: Missing the 'data/' prefix, so this path does not match actual KV v2 secrets.
- ✓
path "secret/data/engineering/*" { capabilities = ["read","list"] }
Why this is correct
Correct: Grants read and list access to all secrets under the engineering path, fulfilling the read/list requirement.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.