VA-003 Create Vault policies Practice Question
A Vault administrator needs to create a policy that grants users read access only to the secrets that belong to their own team. The team membership is stored in an external identity provider and mapped to Vault entity aliases. The administrator wants to use a templated policy that references the entity's metadata. Which policy syntax accomplishes this goal?
⚠ Common exam trap
Vault often tests the distinction between entity metadata and alias metadata, and the trap here is that candidates confuse `{{identity.entity.metadata}}` with `{{identity.entity.aliases}}` or use invalid shorthand like `{{entity.metadata}}` or `{{.team}}`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }
It uses the proper templating syntax `{{identity.entity.metadata.team}}` to reference the `team` metadata key stored on the Vault entity. This allows the policy to dynamically grant read and list access to the path `secret/data/<team>/*`, ensuring users only see secrets belonging to their own team as defined by the external identity provider.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
path "secret/data/{{identity.entity.metadata.team}}/*" { capabilities = ["read", "list"] }
Why this is correct
Correctly references the entity metadata key 'team'.
- ✗
path "secret/data/{{entity.metadata.team}}/*" { capabilities = ["read", "list"] }
Why it's wrong here
Missing 'identity.' prefix: correct is {{identity.entity.metadata.team}}.
- ✗
path "secret/data/{{.team}}/*" { capabilities = ["read", "list"] }
Why it's wrong here
Invalid template syntax; not a valid Vault policy template.
- ✗
path "secret/data/{{identity.entity.aliases.team}}/*" { capabilities = ["read", "list"] }
Why it's wrong here
Entity aliases do not have metadata; use entity.metadata.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.