VA-003 Create Vault policies Practice Question
Exhibit
Refer to the exhibit.
```hcl
path "secret/data/kv-v2/engineering/*" {
capabilities = ["read", "list"]
}
path "secret/metadata/kv-v2/engineering/*" {
capabilities = ["read", "list"]
}
path "sys/policies/acl/engineering" {
capabilities = ["read"]
}
```Refer to the exhibit. A developer reports that they cannot read secrets under 'secret/data/kv-v2/engineering/db-pass' using a token that has the above policy attached. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that a policy defined in Vault automatically applies to all tokens, when in fact a token must have the policy explicitly attached via a token role, identity group, or direct token creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token does not have the policy attached.
The policy shown in the exhibit defines a path with a glob pattern (`secret/data/kv-v2/engineering/*`), which matches the secret path `secret/data/kv-v2/engineering/db-pass`. However, the developer reports they cannot read the secret, indicating the token likely does not have this policy attached. In Vault, a token must have a policy explicitly attached to it; merely having the policy defined in Vault does not grant permissions unless the token is associated with that policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy requires the 'sudo' capability for reading secrets.
Why it's wrong here
'sudo' is not required for reading secrets.
- ✗
The secret does not exist because the path is incorrect.
Why it's wrong here
The path appears correct for KV v2 secrets engine.
- ✓
The token does not have the policy attached.
Why this is correct
The policy itself looks correct; the most likely cause is that the token was not assigned this policy.
- ✗
The path uses a glob that does not match the exact secret path.
Why it's wrong here
The glob '*' matches any number of characters, so it should match the secret path.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.