Create Vault policies practice questions

Change the path to 'secret/data/app/+' and use 'list' capability.

Why wrong: Using '+' matches a single segment; this would still allow reading 'secret/data/app/team' if it exists.

Change the path to 'secret/data/app/*' and add 'deny' capability for other paths.

Why wrong: Adding deny to other paths is not a Vault policy best practice; policies are additive.

Keep the path as 'secret/data/app/*' but add a policy with path 'secret/data/team/*' and 'deny' capability.

Why wrong: Vault does not support deny capabilities; policies are additive and first-match wins.

The policy also needs 'read' capability on 'transit/keys/*'.

Why wrong: Read on key metadata is not required for encrypt/decrypt operations.

The application token has expired.

Why wrong: The team has already verified the token is not expired.

The transit engine requires the 'create' capability on the key to perform encryption.

Why wrong: Create is for generating keys, not for encryption operations.

path "secret/dev/*" { capabilities = ["create", "read", "update", "delete", "list"] }

Why wrong: This allows delete on all secrets, not just the user's own.

path "secret/dev/*" { capabilities = ["read", "list"] }

Why wrong: This only allows read and list, not write or delete.

path "secret/dev/+/{{identity.entity.name}}" { capabilities = ["create", "read", "update", "delete"] }

Why wrong: The '+' wildcard matches a single directory level, but the path pattern may not cover all desired paths; also missing 'list'.

write

Why wrong: 'write' is not a valid capability; use 'create' or 'update'.

sudo

Why wrong: 'sudo' is not a capability; it's a parameter for root-protected paths.

rename

Why wrong: 'rename' is not a valid capability.

The token does not have the 'app-policy' policy attached due to a misconfiguration in the role.

Why wrong: The token's metadata shows 'app-policy' is attached.

There is an explicit deny rule in the policy that denies access to 'db-creds'.

Why wrong: The policy shown does not contain any deny rules.

The token is periodic and does not have the correct capabilities for the path.

Why wrong: Periodic tokens are not required for AppRole; the policy is attached correctly.

write

Why wrong: Incorrect. 'write' is a generic capability that is not required; it is not used for generating dynamic credentials (which use 'read') or for authentication.

create

Why wrong: Incorrect. 'create' is not needed because the pipeline does not create AppRole roles or database roles; it only uses existing ones.

sudo

Why wrong: Incorrect. 'sudo' is not required for any of the given tasks.

update

Why wrong: Incorrect. 'update' is not needed because the pipeline does not modify existing secrets; it only reads them and generates dynamic creds.

The policy requires the 'sudo' capability for reading secrets.

Why wrong: 'sudo' is not required for reading secrets.

The secret does not exist because the path is incorrect.

Why wrong: The path appears correct for KV v2 secrets engine.

The path uses a glob that does not match the exact secret path.

Why wrong: The glob '*' matches any number of characters, so it should match the secret path.

Generate token, create role, use token, renew periodically

Why wrong: This is incorrect because the role must exist before a token can be generated from it; you cannot generate a token without a role.

Create role, use token, renew periodically, generate token

Why wrong: This is incorrect because using a token must occur after generating it, and generating the token must happen before it can be used or renewed.

Generate token, use token, renew periodically, create role

Why wrong: This is incorrect because the role must be created first; generating a token without a role is not possible in Vault.

vault kv get: Lists all secrets at a given path.

Why wrong: This describes vault kv list, not vault kv get.

vault kv list: Retrieves a secret from a specified path.

Why wrong: This describes vault kv get, not vault kv list.

vault write: Stores a secret at a specified path in the KV secret engine.

Why wrong: While vault write can write to KV, the dedicated command is vault kv put.

path "secret/data/app" { capabilities = ["read"] }

Why wrong: This allows reading all keys under the path, not just db_password.

path "secret/data/app/db_password" { capabilities = ["read"] }

Why wrong: This path is incorrect; KV v2 stores data under secret/data/app, not secret/data/app/db_password.

path "secret/data/app" { capabilities = ["read"]; required_parameters = ["db_password"] }

Why wrong: This requires the parameter but does not restrict to only db_password; other keys could also be read.

path "auth/token/renew-self" { capabilities = ["create"] }; path "auth/token/lookup-self" { capabilities = ["read"] }

Why wrong: Renew-self requires update, not create; also lookup-self is not the same as capabilities.

path "auth/token/renew-self" { capabilities = ["update"] }; path "auth/token/capabilities-self" { capabilities = ["update"] }

Why wrong: Using update for capabilities-self is incorrect; it should be read.

path "auth/token/renew" { capabilities = ["update"] }; path "auth/token/capabilities" { capabilities = ["read"] }

Why wrong: These are non-self endpoints, which would allow renewing or checking capabilities for any token, violating least privilege.

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["create", "update", "delete"] }

Why wrong: Delete capability is not required for writing build artifacts, violating least privilege.

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd/*" { capabilities = ["create", "update"] }

Why wrong: The glob * would also write to any subpath, which is broader than necessary.

path "database/creds/my-role" { capabilities = ["read"] }; path "secret/data/ci-cd" { capabilities = ["write"] }

Why wrong: 'write' is not a valid Vault capability; use create and update instead.

modify

Why wrong: modify is not a standard capability; use create/update instead.

patch

Why wrong: patch is not a standard Vault policy capability.

encrypt

Why wrong: encrypt is an operation on the transit engine, not a policy capability.

encrypt

Why wrong: encrypt is an operation on the transit engine, not a policy capability.

patch

Why wrong: patch is not a standard Vault policy capability.

path "auth/token/renew" { capabilities = ["update"] }

Why wrong: This would allow renewing any token, which is too broad.

path "secret/data/app/*" { capabilities = ["read"] }

Why wrong: This would also allow reading subkeys, which is not necessary and may be too permissive.

path "sys/auth" { capabilities = ["read"] }

Why wrong: This is not required for reading the secret or renewing the token.

The read fails because the path does not exist.

Why wrong: The path exists; the failure is due to policy denail.

The read succeeds because the first path grants read.

Why wrong: The deny overrides the grant, so read fails.

The read succeeds because deny only applies to write operations.

Why wrong: Deny applies to all operations, not just writes.

The policy allows both encryption and decryption, but the capabilities should be "read" and "write" instead.

Why wrong: 'create' and 'update' are the correct capabilities for transit operations.

The policy allows encryption but not decryption, which is sufficient.

Why wrong: The policy includes both encrypt and decrypt endpoints, so decryption is also allowed.

The policy incorrectly uses "create" and "update" for transit operations; it should use "read" and "write".

Why wrong: 'create' and 'update' are correct; 'read' and 'write' are not used for transit.

The write succeeds if the secret already exists.

Why wrong: Even if it exists, update requires the update capability, which is not granted.

The write succeeds because the path matches.

Why wrong: Matching path is not enough; the capabilities must allow the operation.

The write fails because the user does not have list capability.

Why wrong: List is not required for write; the issue is missing create/update.

["read", "update"]

Why wrong: Adds read capability which is not required.

["write"]

Why wrong: 'write' is not a standard Vault capability.

["create", "update"]

Why wrong: Includes create, which would allow creating new secrets, violating the requirement.

path "sys/auth" { capabilities = ["read", "list"] }

Why wrong: Read is not needed for simply listing auth methods.

path "sys/auth" { capabilities = ["read"] }

Why wrong: Read provides details about a specific auth method, not a list.

path "auth/*" { capabilities = ["list"] }

Why wrong: This would list items under each auth method, not the methods themselves.