VA-003 Create Vault policies Practice Question
Exhibit
# Vault policy snippet
path "transit/encrypt/app-key" {
capabilities = ["create", "update"]
}
path "transit/decrypt/app-key" {
capabilities = ["create", "update"]
}Refer to the exhibit. An application needs to encrypt data using the transit engine with key "app-key". It currently has this policy. Which statement is true?
⚠ Common exam trap
A common misconception is that `read` and `write` capabilities are used for all operations, but in the transit engine, `create` and `update` are the correct capabilities for encrypt and decrypt actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy allows both encryption and decryption, which is correct for the transit engine.
The transit engine in Vault uses the `encrypt` and `decrypt` capabilities to allow encryption and decryption operations, respectively. The policy shown uses `create` and `update` capabilities, which are correct for the transit engine because `create` is used to encrypt data (creating ciphertext) and `update` is used to decrypt data (updating the ciphertext back to plaintext). Therefore, the policy allows both encryption and decryption, making option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy allows both encryption and decryption, but the capabilities should be "read" and "write" instead.
Why it's wrong here
'create' and 'update' are the correct capabilities for transit operations.
- ✓
The policy allows both encryption and decryption, which is correct for the transit engine.
Why this is correct
The policy correctly provides the necessary capabilities for both operations.
- ✗
The policy allows encryption but not decryption, which is sufficient.
Why it's wrong here
The policy includes both encrypt and decrypt endpoints, so decryption is also allowed.
- ✗
The policy incorrectly uses "create" and "update" for transit operations; it should use "read" and "write".
Why it's wrong here
'create' and 'update' are correct; 'read' and 'write' are not used for transit.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.