Create Vault policies →mediumMultiple ChoiceObjective-mapped

VA-003 Create Vault policies Practice Question

Exhibit

path "secret/data/engineering/*" {
  capabilities = ["read", "list"]
}
path "secret/data/engineering/projects/*" {
  capabilities = ["create", "update"]
}

Refer to the exhibit. Based on the policy shown, which statement is true?

⚠ Common exam trap

Vault often tests the distinction between 'read' and 'create'/'update' capabilities, where candidates mistakenly assume 'read' includes the ability to modify secrets.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A user can read all secrets under secret/data/engineering/.

The policy shown grants 'read' capability on the path 'secret/data/engineering/*'. In Vault, the 'read' capability allows listing and reading secrets at that path, but not creating, updating, or deleting them. Therefore, a user can read all secrets under secret/data/engineering/.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A user can create secrets under secret/data/engineering/.
Why it's wrong here
Incorrect: Create and update are only granted on the projects subpath, not on the parent path.
✓
A user can read all secrets under secret/data/engineering/.
Why this is correct
Correct: The policy grants read and list on secret/data/engineering/*, so all secrets under that path can be read.
✗
A user can delete secrets under secret/data/engineering/.
Why it's wrong here
Incorrect: The policy does not grant delete capability anywhere.
✗
A user can update secrets under secret/data/engineering/.
Why it's wrong here
Incorrect: Update is only granted on the projects subpath, not on the parent path.

Go deeper

VA-003 Create Vault policies Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question