VA-003 Create Vault policies Practice Question
An organization is implementing Vault policies for the first time. They want to ensure that policies are easy to manage and follow the principle of least privilege. Which approach should they take when creating policies?
⚠ Common exam trap
A common misconception in Vault is that using broad policies with wildcards simplifies management, but the correct approach is to create granular, application-specific policies to enforce least privilege and maintain auditability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate policies for each application and use group aliases to attach them.
It aligns with the principle of least privilege by creating separate policies for each application, ensuring that each application only has access to the specific paths and capabilities it requires. Using group aliases to attach these policies allows for centralized management and simplifies policy updates, as changes can be made at the group level rather than per user or token. This approach also leverages Vault's identity-based policies, which are evaluated based on the entity's group memberships, providing a scalable and maintainable policy structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create policies with broad paths and then restrict via ACL tokens.
Why it's wrong here
ACL tokens do not restrict policies; tokens inherit policies.
- ✗
Create a single policy with a wildcard path '*' and full capabilities for all administrators.
Why it's wrong here
This grants excessive permissions and is insecure.
- ✗
Create a single policy with all paths and capabilities for all users.
Why it's wrong here
Monolithic policies violate least privilege and are hard to manage.
- ✓
Create separate policies for each application and use group aliases to attach them.
Why this is correct
This enables granular, least-privilege access based on application needs.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.