Question 82 of 498
Userpass Authentication: Why Users Get Permission Denied Despite Policy Exists
A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?
Quick Answer
The answer is that the admin simply did not assign any policies to the user when creating the account. In Vault’s Userpass auth method, creating a user with a username and password only establishes the authentication identity; it does not automatically attach any policies. The token issued upon a successful login inherits only the policies explicitly associated with that user entry. Since the admin created 'dev1' without specifying the 'webapp-readonly' policy during user creation or update, the resulting token has zero capabilities, causing the permission denied error despite the policy existing elsewhere. This scenario tests your understanding that policy assignment is a separate, required step from user creation in the Userpass auth method—a common trap on the VA-003 exam where candidates assume a policy’s existence alone grants access. A reliable memory tip: “User creation is the lock; policy assignment is the key—without the key, the token opens nothing.”
⚠ Common exam trap
HashiCorp often tests the nuance that creating a user in Vault does not automatically assign any policies; candidates mistakenly assume that simply creating a user and a policy with the same name is sufficient, but the policy must be explicitly linked to the user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The admin did not assign any policies to the user.
The most likely issue is that the admin created the user 'dev1' but did not assign any policies to that user. In Vault's Userpass auth method, simply creating a user does not attach any policies; the admin must explicitly specify the policies when creating or updating the user. Without a policy attached, the token issued upon login has no capabilities, resulting in a permission denied error even if the policy 'webapp-readonly' exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy 'webapp-readonly' does not exist.
Why it's wrong here
The policy was created.
- ✓
The admin did not assign any policies to the user.
Why this is correct
Userpass requires explicit policy assignment; without it, no policies are attached.
- ✗
The user 'dev1' does not exist.
Why it's wrong here
The user was created.
- ✗
The password is incorrect.
Why it's wrong here
The password was set correctly.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VA-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?
hard- ✓ A.Migrate users to an external identity provider and use LDAP or OIDC auth.
- B.Switch to token-based authentication and issue tokens with TTL.
- C.Use Vault's password policy plugin with Userpass.
- D.Configure password policies in Vault's Userpass auth method.
Why A: The Userpass auth method in Vault does not natively support password complexity or expiration policies. Migrating to an external identity provider (IdP) via LDAP or OIDC allows the organization to enforce these policies externally, where they are natively supported, and then federate authentication into Vault. This approach leverages the IdP's mature password management capabilities while maintaining Vault's authorization and audit controls.
Last reviewed: Jun 30, 2026
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.