VA-003 Compare and configure secrets engines Practice Question
Exhibit
path "database/creds/my-role" {
capabilities = ["read"]
}
path "database/roles/*" {
capabilities = ["list"]
}
path "sys/mounts" {
capabilities = ["read"]
}Refer to the exhibit. An application uses this policy to access Vault. The application is able to read database credentials from `database/creds/my-role`. However, attempts to list all roles at `database/roles/` fail. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the distinction between 'read' and 'list' capabilities, trapping candidates who assume that read access on sub-paths implies the ability to list the parent path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy does not allow the 'list' capability on the path `database/roles/`
The policy grants 'read' capability on `database/creds/my-role` but does not include the 'list' capability on `database/roles/`. In Vault, listing requires an explicit 'list' capability in the policy, even if 'read' is allowed on sub-paths. Without 'list', the API call to `LIST database/roles/` returns a permission denied error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The path `database/roles/` is not a valid path for listing roles
Why it's wrong here
It is a valid path; the roles are listed under that path.
- ✗
The database secrets engine is not enabled
Why it's wrong here
If the engine were not enabled, reading credentials would also fail.
- ✓
The policy does not allow the 'list' capability on the path `database/roles/`
Why this is correct
The glob `database/roles/*` does not cover the exact path; need explicit `database/roles/` with list.
- ✗
The application needs the 'sudo' capability to list roles
Why it's wrong here
Sudo is not needed for listing roles; list capability is sufficient.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.