VA-003 Explain Vault architecture Practice Question
Exhibit
path "secret/data/team/*" {
capabilities = ["create", "update", "read", "delete"]
}
path "secret/data/team/billing" {
capabilities = ["read"]
}Refer to the exhibit. A developer issues a Vault CLI command to write a secret to path 'secret/data/team/billing'. What will be the outcome?
⚠ Common exam trap
This question tests the most-specific-path-wins rule in Vault policy evaluation, where candidates mistakenly assume that a broader wildcard rule will always apply, ignoring that an exact or more specific path rule can override it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The write is denied because the second rule only allows read capability on the exact path, overriding the wildcard rule.
Vault policies are evaluated using a most-specific-path-wins model. The second rule explicitly allows 'read' on 'secret/data/team/billing', which is more specific than the wildcard rule 'secret/data/team/*'. Since the write operation requires 'create' or 'update' capabilities, and the specific rule only grants 'read', the write is denied even though the wildcard rule would have allowed it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The write is denied because the policy does not include a 'write' capability.
Why it's wrong here
Vault uses 'create' and 'update' for write operations, but even if it used 'write', the specific rule overrides the wildcard and only allows read.
- ✓
The write is denied because the second rule only allows read capability on the exact path, overriding the wildcard rule.
Why this is correct
Vault evaluates the most specific path first; the second rule matches exactly and only allows read, so the write is denied.
- ✗
The write is denied unless the developer is authenticated with a token that has sudo privileges.
Why it's wrong here
Sudo privileges are not required for writing; the policy itself denies the operation regardless of authentication method.
- ✗
The write is allowed if the developer uses the 'vault kv put' command with the -force flag.
Why it's wrong here
The -force flag is used to allow overwriting of metadata, but it does not bypass policy restrictions.
- ✗
The write is allowed because the first rule grants create and update to all paths under team/.
Why it's wrong here
The first rule is a wildcard, but the second rule is more specific and takes precedence, restricting access to read only.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.