HashiCorp Vault Associate (003) Question 35
Single answer2 Vault policiesYour team uses Vault's KV secrets engine v2 mounted at secret/. Application developers should be able to read only the current value of secrets under secret/data/apps/payments/*. They must not be able to list secret names, view metadata, read previous versions, or delete/destroy anything. Which policy stanza best meets this requirement?
- A
path "secret/apps/payments/*" { capabilities = ["read"] }
- B
path "secret/data/apps/payments/*" { capabilities = ["read"] }
- C
path "secret/metadata/apps/payments/*" { capabilities = ["read"] }
- D
path "secret/data/apps/payments/*" { capabilities = ["read", "list"] }
Show answer and explanation
Correct answer: B
Explanation
The key detail is that KV v2 uses different API paths for data and metadata. To read the current secret value, a policy must grant read on the /data/ path, such as secret/data/apps/payments/*. Listing keys and metadata access are separate concerns handled through /metadata/ paths, so omitting those permissions prevents users from enumerating secret names or viewing metadata. Likewise, previous-version management and destructive actions require other capabilities and endpoints that are not granted here. This follows Vault's least-privilege best practice and matches the KV v2 policy guidance in HashiCorp Vault documentation.
- A. Incorrect.
Incorrect. For KV v2, policy paths must target the API path structure, not just the human-friendly mount path. Reading secret data uses the
/data/endpoint, sosecret/apps/payments/*does not map to the correct path for KV v2 reads. This is a common mistake when administrators confuse the CLI shorthand with the underlying policy path. - B. Correct.
Correct. In KV v2, reading the current secret value requires
readcapability on thesecret/data/apps/payments/*path. Granting onlyreadallows access to the secret data itself while not grantingliston metadata paths or destructive capabilities such asdelete,update, ordestroy. This aligns with least-privilege access for current-value reads only. - C. Incorrect.
Incorrect. The
secret/metadata/...path is used for metadata operations in KV v2, such as listing keys or reading metadata, not for reading the secret's actual data value. Granting access here would not allow the application developers to read the secret contents they need. - D. Incorrect.
Incorrect. Although
readonsecret/data/apps/payments/*is required, addinglistexpands access beyond the stated requirement. In KV v2, listing keys is performed against metadata paths, and least privilege dictates not granting broader capabilities than necessary. This option also signals a misunderstanding thatlistis needed to read secret values.