Compare and configure secrets engines →mediumMultiple ChoiceObjective-mapped

VA-003 Compare and configure secrets engines Practice Question

Exhibit

$ vault secrets list -detailed
Path          Type         Accessor              Options    Description
----          ----         --------              -------    -----------
cubbyhole/    cubbyhole    cubbyhole_xxx         map[]      per-token private secret storage
database/     database     database_xxx          map[]      dynamic database credentials
secret/       kv           kv_xxx                map[]      key-value (unversioned)

Refer to the exhibit. A user has a token with a policy that grants 'read' on 'secret/*'. The user attempts to read the secret at 'secret/data/app' using `vault kv get secret/data/app` but receives a '404 Not Found' error. The user can successfully list the engine at 'secret/' with `vault secrets list`. What is the most likely cause of the 404 error?

⚠ Common exam trap

HashiCorp Vault often tests the distinction between KV v1 and KV v2 path formats, and the trap here is that candidates assume a 404 error always means the secret doesn't exist or permissions are wrong, rather than recognizing the `/data/` prefix is only valid for KV v2 engines.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The secrets engine is KV v1, but the user is using the KV v2 path format with '/data/'.

The KV v2 secrets engine requires the path format `secret/data/<path>` for reading secret data, while KV v1 uses `secret/<path>` directly. The user is using `vault kv get secret/data/app`, which is the correct command for KV v2, but the error indicates the engine is actually KV v1. Since KV v1 does not have a `/data/` prefix, the path `secret/data/app` does not exist, resulting in a 404 Not Found error. The successful `vault secrets list` confirms the engine is enabled at `secret/`, ruling out option D.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The secrets engine is KV v1, but the user is using the KV v2 path format with '/data/'.
Why this is correct
KV v1 secrets are accessed without '/data/'; KV v2 uses '/data/'. The exhibit confirms v1.
✗
The user's policy does not cover the sub-path 'secret/data/app'.
Why it's wrong here
The policy grants 'read' on 'secret/*', which would cover 'secret/data/app' if it existed.
✗
The secret path is mistyped; it should be 'secret/application'.
Why it's wrong here
There is no indication of a typo; the user is following a common KV v2 pattern.
✗
The secret engine at 'secret/' is not enabled.
Why it's wrong here
The exhibit shows the engine is enabled at 'secret/'.

Go deeper

VA-003 Compare and configure secrets engines Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question