HashiCorp Vault Associate (003) Question 48
Single answer2b Describe Vault policy syntax: pathYour team stores application secrets in a KV v2 secrets engine mounted at secret/. Developers should be able to read and update secrets only under secret/data/apps/dev/*, but they must not be able to delete secrets or access metadata outside that subtree. You are reviewing policy stanzas that use Vault's path syntax. Which policy stanza correctly grants the required access with least privilege?
- A
path "secret/data/apps/dev/*" { capabilities = ["read", "update"] }
- B
path "secret/apps/dev/*" { capabilities = ["read", "update"] }
- C
path "secret/data/apps/dev" { capabilities = ["create", "read", "update", "delete", "list"] }
- D
path "secret/*" { capabilities = ["read", "update"] }
Show answer and explanation
Correct answer: A
Explanation
Vault policies use path stanzas to match API paths and assign capabilities such as create, read, update, delete, and list. In real deployments, writing correct policy paths is especially important with KV v2 because the API path includes prefixes like data/ and metadata/ under the mount. To grant access only to secret values under a subtree in KV v2, the policy should target secret/data/
- A. Correct.
Correct. For KV v2, access to secret values uses the data/ API path beneath the mount, so a policy must target secret/data/... rather than just the mount-relative logical folder name. This stanza grants only read and update on paths under apps/dev/, matching the requirement to read and modify existing secrets in that subtree without granting delete or broader access. The wildcard * correctly covers child paths beneath secret/data/apps/dev/.
- B. Incorrect.
Incorrect. This is a common mistake caused by confusing the mount path and the API path. For KV v2, secret/apps/dev/* is not the correct path for reading or writing secret data in policies; the data/ segment is required. A candidate might choose this if they are thinking in terms of the CLI shorthand rather than the underlying policy path syntax.
- C. Incorrect.
Incorrect. This option is too permissive and also too narrow in path matching. First, it grants delete and list, which violate the least-privilege requirement and would allow operations the scenario explicitly forbids. Second, without the trailing wildcard, it applies to the exact path secret/data/apps/dev, not all secrets under that subtree such as secret/data/apps/dev/api or secret/data/apps/dev/db.
- D. Incorrect.
Incorrect. Although this would likely match the intended subtree, it is far too broad because it grants access to all data and other endpoints under the entire secret/ mount. That includes applications and paths outside apps/dev/, which violates the requirement to restrict access to only that subtree. Broad wildcards at the mount level are a frequent over-permissioning error.