VA-003 Create Vault policies Practice Question
A Vault cluster has several policies. One policy, "app-policy", contains: path "secret/data/app/*" { capabilities = ["create", "update"] }. Another policy, "admin-policy", includes: path "secret/data/app/db" { capabilities = ["deny"] }. A token is attached with both policies. Can the token write to "secret/data/app/db"?
⚠ Common exam trap
A common pitfall in Vault is assuming that policies are purely additive, overlooking that a 'deny' capability in any matching policy overrides all other capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No, because deny takes precedence over allow.
B is correct because in Vault, the 'deny' capability takes precedence over all other capabilities. When a token has multiple policies attached, Vault evaluates all matching paths and applies the most restrictive result. Since 'admin-policy' explicitly denies access to 'secret/data/app/db', the token cannot write to that path, regardless of the 'create' and 'update' capabilities granted by 'app-policy'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No, because the paths conflict.
Why it's wrong here
The conflict is resolved by deny taking precedence.
- ✓
No, because deny takes precedence over allow.
Why this is correct
Deny always takes precedence, so the token cannot write to that path.
- ✗
Yes, because policies are additive.
Why it's wrong here
Policies are additive but deny is an exception that blocks.
- ✗
Yes, because the first policy allows create/update.
Why it's wrong here
Deny overrides the allow, so the write is not permitted.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.