VA-003 vault secrets enable -path Practice Question
Which TWO of the following are valid methods to enable a secrets engine at a non-default path in Vault?
⚠ Common exam trap
Vault's CLI supports two distinct methods for enabling secrets engines: the higher-level 'vault secrets enable' command and the lower-level 'vault write' on the sys/mounts endpoint. The exam often tests whether candidates know both methods and the correct flag names.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault write sys/mounts/my-aws type=aws
Options B and C are both valid methods to enable a secrets engine at a non-default path in Vault. Option B uses the raw API endpoint via 'vault write sys/mounts/my-aws type=aws', which is a valid low-level approach. Option C uses the higher-level 'vault secrets enable -path=my-aws aws' command, which is the standard CLI method. Option E ('vault secrets enable my-aws aws') is invalid because it incorrectly places the path before the engine type; the correct syntax for a default path is 'vault secrets enable aws', but for a non-default path the '-path' flag is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
vault secrets enable -custom-path=my-aws aws
Why it's wrong here
Invalid: the flag '-custom-path' does not exist; use '-path'.
- ✓
vault write sys/mounts/my-aws type=aws
Why this is correct
Correct: writing to 'sys/mounts/<path>' with 'type' parameter is a valid low-level method.
- ✓
vault secrets enable -path=my-aws aws
Why this is correct
Correct: the 'vault secrets enable -path=<path> <engine>' command is the standard CLI method.
- ✗
vault secrets enable -mount-path=my-aws aws
Why it's wrong here
Invalid: the flag '-mount-path' does not exist; use '-path'.
- ✗
vault secrets enable my-aws aws
Why it's wrong here
Invalid: placing the path before the engine type without the '-path' flag is incorrect syntax; the path must be specified with '-path'.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.