HashiCorp Vault Associate (003) Question 163
Single answer5h Access Vault secrets using the CLI, API, and UIA development team stores application credentials in Vault using the KV v2 secrets engine enabled at path secret/. A teammate can view the secret in the Vault UI by browsing to secret/data/payroll/db, but when testing automation from their workstation they get errors. Which command will correctly read the latest version of the secret value for payroll/db using the Vault CLI?
- A
vault read secret/payroll/db
- B
vault kv get secret/payroll/db
- C
vault kv get secret/data/payroll/db
- D
vault read secret/data/payroll/db
Show answer and explanation
Correct answer: B
Explanation
For a KV v2 secrets engine, the UI and HTTP API expose paths that include /data/ for reading secret data, such as secret/data/payroll/db. However, the Vault CLI provides KV-aware commands that abstract that API detail. The standard way to read the latest version of a secret is vault kv get <mount>/<path>, in this case vault kv get secret/payroll/db. This distinction is important across the CLI, API, and UI: the UI often reveals KV v2 internal route structure, the HTTP API requires the /data/ segment, and the CLI vault kv commands should generally use the logical path without /data/. This behavior is documented in HashiCorp Vault KV secrets engine documentation and CLI command references for vault kv get.
- A. Incorrect.
Incorrect.
vault readis the generic low-level read command and this path is missing the KV v2 API structure. For a KV v2 engine mounted atsecret/, the data endpoint includes/data/, sosecret/payroll/dbis not the correct API path. A common mistake is assuming KV v1-style paths work the same way for KV v2. - B. Correct.
Correct.
vault kv get secret/payroll/dbis the recommended CLI command for reading from a KV v2 secrets engine. Thevault kvsubcommands understand the KV version and automatically translate the logical pathsecret/payroll/dbinto the correct underlying API request to the/data/endpoint. This is the practical command most operators use. - C. Incorrect.
Incorrect. This mixes the CLI's logical path format with the HTTP API path format. With
vault kv get, you should provide the mount and secret path as users think about them, such assecret/payroll/db, not the raw API endpoint path containing/data/. This error often happens when someone copies a path they saw in the UI or API docs directly into the CLI. - D. Incorrect.
Incorrect. Although
secret/data/payroll/dbis the correct API endpoint structure for KV v2,vault readreturns the raw API response rather than using the higher-level KV workflow. On Vault Associate exams and in day-to-day usage, the expected CLI command for reading a KV v2 secret isvault kv get secret/payroll/db. Someone might choose this because it resembles the UI path, but it is not the best answer to the question asking for the correct CLI command.