VA-003 Assess Vault tokens Practice Question
A Vault user wants to check the capabilities of their token on a specific path. Which command should they use?
⚠ Common exam trap
HashiCorp often tests the distinction between commands that inspect token metadata (`vault token lookup`) versus commands that evaluate policy-based permissions on a specific path (`vault token capabilities`), and candidates may confuse `vault policy capabilities` (which does not exist) with the correct command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault token capabilities <path>
The `vault token capabilities` command is specifically designed to check what operations (e.g., read, create, update, delete, list) a given token is allowed to perform on a particular path. It evaluates the token's attached policies against the path and returns the effective capabilities, making it the correct tool for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vault token list
Why it's wrong here
vault token list enumerates accessor IDs of tokens, revealing nothing about what actions a token may perform on a given path. It suits auditing or revoking issued tokens, whereas capability checking requires querying the token against a specific path.
- ✓
vault token capabilities <path>
Why this is correct
`vault token capabilities <path>` queries the token's effective capabilities on that exact path, returning a permission list such as read, create or sudo. It satisfies the stem's constraint of checking one token against one specific path, unlike `vault capabilities`, which inspects the calling token only.
- ✗
vault policy capabilities <policy_name> <path>
Why it's wrong here
vault policy capabilities inspects the capabilities granted by a named policy, not those of the caller's own token, and it needs a policy name rather than the token in use. It suits verifying policy definitions during authoring, not a user checking their own effective permissions.
- ✗
vault token lookup <token>
Why it's wrong here
vault token lookup returns metadata such as policies, TTL and display name for a token, but not the effective capabilities on a specific path. It suits inspecting or debugging token properties, whereas determining permitted operations on a path needs a capabilities query.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.