HashiCorp Vault Associate (003) Question 39
Single answer2 Vault policiesA platform team uses Vault KV v2 at the path secret/ to store application secrets. Developers on the payments team should be able to read only the current values under secret/data/payments/*, but they must not be able to view metadata, list other secret names, or manage versions. An administrator is reviewing the following policy stanzas to attach to the team's token. Which policy best meets the requirement with the least privilege?
- A
path "secret/data/payments/*" { capabilities = ["read"] }
- B
path "secret/payments/*" { capabilities = ["read"] }
- C
path "secret/data/payments/*" { capabilities = ["read", "list"] }
- D
path "secret/metadata/payments/*" { capabilities = ["read"] }
Show answer and explanation
Correct answer: A
Explanation
In Vault, policies are written against API paths, so for a KV v2 secrets engine mounted at secret/, secret data is accessed under secret/data/... and metadata operations use secret/metadata/.... To allow a team to read only current secret values under payments without listing names or managing versions, the policy should grant only read on the data path: path "secret/data/payments/*" { capabilities = ["read"] }. This follows least-privilege best practice by avoiding extra capabilities such as list, create, update, delete, or access to metadata endpoints. HashiCorp documentation for KV v2 and Vault policies emphasizes that policy paths must match the underlying API path and that capabilities should be minimized to only what the client needs.
- A. Correct.
Correct. For KV v2, reading secret values uses the data path, such as secret/data/payments/app1. Granting only the read capability on that path allows retrieval of current secret data while avoiding broader access such as listing keys or interacting with metadata endpoints. This is the least-privilege option that matches the scenario.
- B. Incorrect.
Incorrect. This looks like a KV v1-style path. In KV v2, API paths for secret values include /data/, so a policy on secret/payments/* will not match requests to read data from secret/data/payments/*. A common mistake is forgetting that policy paths must align with the actual API path, not just the mount name and logical folder structure.
- C. Incorrect.
Incorrect. This would allow reading values, but it grants more access than required. The list capability is not needed to read a known secret and would enable enumeration on list-capable paths when separately permitted. The scenario explicitly says developers must not be able to list other secret names, so adding list violates least privilege.
- D. Incorrect.
Incorrect. In KV v2, the metadata path is used for metadata operations, such as reading secret metadata or listing keys, not for retrieving the secret value itself. Granting read on secret/metadata/payments/* would expose metadata-related access rather than the current secret data requested in the scenario.