HashiCorp Vault Associate (003) Question 37
Single answer2 Vault policiesA platform team uses Vault KV v2 at the path secret/ to store application configuration. A developer should be able to read the current value of the database password stored at secret/data/payments/db, but must not be able to view metadata, list other secrets under secret/, or change anything. Which policy stanza best meets this requirement?
- A
path "secret/data/payments/db" { capabilities = ["read"] }
- B
path "secret/payments/db" { capabilities = ["read"] }
- C
path "secret/data/payments/" { capabilities = ["read", "list"] } path "secret/metadata/payments/" { capabilities = ["list"] }
- D
path "secret/data/payments/db" { capabilities = ["read"] } path "secret/metadata/payments/db" { capabilities = ["read"] }
Show answer and explanation
Correct answer: A
Explanation
The key applied concept is that Vault policies are evaluated against API paths, and KV v2 separates secret data from metadata. To read the contents of a KV v2 secret, the policy must target the data endpoint, for example secret/data/payments/db. Listing secrets in KV v2 is performed against metadata paths, such as secret/metadata/...; therefore, if a user must not list secrets or view metadata, the policy should avoid granting list or read capabilities on metadata paths. The best practice is to grant the minimum capability on the narrowest possible path. This aligns with Vault policy and KV v2 documentation, which distinguishes between /data/ and /metadata/ routes and recommends least-privilege access.
- A. Correct.
Correct. For KV v2, reading a secret's data uses the /data/ API path, so granting read on secret/data/payments/db allows the developer to retrieve the current secret value at that exact path. Because the policy is narrowly scoped to a single path and only includes the read capability, it does not grant list, update, create, delete, or access to metadata endpoints.
- B. Incorrect.
Incorrect. This is a common mistake caused by confusing the CLI-style logical path with the policy/API path. In KV v2, policies must typically reference the data endpoint for secret contents, such as secret/data/payments/db. Using secret/payments/db would be appropriate for KV v1-style layouts, not KV v2 reads.
- C. Incorrect.
Incorrect. This grants more access than required. The wildcard path would allow reading any secret under secret/data/payments/, not just the single db secret. It also grants list access and explicitly allows listing metadata under secret/metadata/payments/, which violates the requirement that the developer must not be able to view metadata or list other secrets.
- D. Incorrect.
Incorrect. The first stanza correctly allows reading the specific secret data, but the second stanza grants read on the metadata endpoint. That exposes secret metadata, which the scenario explicitly forbids. It is broader than necessary and does not follow least-privilege practice.