Explain encryption as a service →hardMultiple ChoiceObjective-mapped

VA-003 Explain encryption as a service Practice Question

Exhibit

path "transit/keys/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
path "transit/encrypt/*" {
  capabilities = ["update"]
}
path "transit/decrypt/*" {
  capabilities = ["update"]
}

Refer to the exhibit. Based on this policy, which actions can the associated token perform? (Assume all paths exist.)

⚠ Common exam trap

HashiCorp often tests the distinction between 'manage' (which implies full CRUD on keys) and individual capabilities like 'create' or 'read', leading candidates to underestimate the scope of the 'manage' capability.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create, read, update, delete keys; encrypt and decrypt data.

The exhibit shows a policy that grants the 'manage' capability on a key, which in Vault (the implied technology) includes create, read, update, and delete operations. Additionally, the policy includes 'encrypt' and 'decrypt' capabilities, allowing the token to perform both key management and cryptographic operations. Therefore, the token can create, read, update, delete keys, and encrypt/decrypt data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Only encrypt and decrypt data.
Why it's wrong here
It has additional key management permissions.
✗
Create and read keys, encrypt and decrypt data.
Why it's wrong here
It also allows update and delete on keys.
✗
Only manage keys, not encrypt/decrypt.
Why it's wrong here
It also has encrypt/decrypt capabilities.
✗
Create keys only.
Why it's wrong here
It has read, update, delete, and encrypt/decrypt as well.
✓
Create, read, update, delete keys; encrypt and decrypt data.
Why this is correct
All listed capabilities are granted.

Go deeper

VA-003 Explain encryption as a service Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question