VA-003 Utilize Vault CLI and API Practice Question
Exhibit
Refer to the exhibit. $ vault read -field=value database/creds/readonly Error reading database/creds/readonly: Error making API request. URL: GET http://127.0.0.1:8200/v1/database/creds/readonly Code: 403. Errors: * permission denied
The CLI command returns a 403 error. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the distinction between authentication (401) and authorization (403) errors, where candidates mistakenly attribute a 403 to a missing mount or nonexistent role instead of recognizing it as a policy/permission issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token does not have a policy allowing read on 'database/creds/readonly'
A 403 Forbidden error from Vault indicates that the request was authenticated (the token is valid) but the token's policies do not grant permission for the requested action. Since the command attempts to read from 'database/creds/readonly', the most likely cause is that the token lacks a policy allowing read access on that path. This is a standard authorization failure, not an authentication or configuration issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The role 'readonly' does not exist
Why it's wrong here
If the role didn't exist, the error would be 400 or 404, not 403.
- ✗
The database secrets engine is not mounted at 'database/'
Why it's wrong here
If not mounted, the error would be 404, not 403.
- ✓
The token does not have a policy allowing read on 'database/creds/readonly'
Why this is correct
403 is a permission denied error; the token's policy must grant read capability on that path.
- ✗
The field 'value' does not exist in the secret
Why it's wrong here
Even if the field doesn't exist, the API would return a 200 with no data, not 403.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.