VA-003 Create Vault policies Practice Question
An organization is creating Vault policies to manage access to secrets across multiple application teams. According to HashiCorp best practices, which two approaches should be taken when designing policies? (Choose two.)
⚠ Common exam trap
HashiCorp often tests candidates' understanding that Vault policies are purely additive (no deny) and that path templating is a key best practice for scaling policy management across multiple teams, tempting candidates to select 'avoid deny' or 'single policy' due to familiarity with other IAM systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use path templating to incorporate entity metadata.
HashiCorp recommends using path templating with entity metadata (e.g., {{identity.entity.metadata.team}}) to dynamically scope policies to specific teams or applications. This approach reduces policy sprawl and ensures that permissions are automatically applied based on the authenticated entity's attributes, aligning with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Avoid using negative capabilities (deny) when possible.
Why it's wrong here
Deny can be useful for specific exceptions and is not inherently bad.
- ✗
Grant maximum permissions initially and then restrict as needed.
Why it's wrong here
This is the opposite of least privilege; start minimal and expand.
- ✗
Use a single all-encompassing policy for each environment.
Why it's wrong here
Monolithic policies are hard to maintain and violate least privilege.
- ✓
Use path templating to incorporate entity metadata.
Why this is correct
Templating reduces duplication and ties access to identity attributes.
- ✓
Name policies based on the application or team they serve.
Why this is correct
Descriptive naming improves policy management and auditing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.