HashiCorp Vault Associate (003) Question 50
Single answer2c Describe Vault policy syntax: capabilitiesA platform team stores application credentials at the KV v2 path secret/data/payments/api. A developer should be able to read the current secret value, but must not be able to create new versions, update existing data, or delete anything. You are reviewing candidate ACL policies to grant the minimum required access. Which policy stanza should you use?
- A
path "secret/data/payments/api" { capabilities = ["read"] }
- B
path "secret/payments/api" { capabilities = ["read"] }
- C
path "secret/data/payments/api" { capabilities = ["list"] }
- D
path "secret/data/payments/api" { capabilities = ["create", "read"] }
Show answer and explanation
Correct answer: A
Explanation
Vault ACL policies are path-based and grant specific capabilities such as create, read, update, delete, list, sudo, patch, and deny. In this scenario, the goal is minimum access: allow reading a secret and nothing else. For a KV v2 secrets engine mounted at secret/, reading secret data requires the policy path to include the data/ prefix, such as secret/data/payments/api. The read capability is sufficient to retrieve the secret value. Capabilities like create or update would allow writing data, and list only permits listing keys rather than reading contents. This aligns with HashiCorp Vault policy syntax and KV v2 path conventions documented in the ACL policy and KV secrets engine documentation.
- A. Correct.
Correct. For KV v2, reading a secret's data uses the /data/ path segment, so the policy must target secret/data/payments/api. The read capability allows the developer to retrieve the secret but does not permit writing, updating, or deleting data. This follows least-privilege best practice.
- B. Incorrect.
Incorrect. This path is a common mistake caused by using the mount path without the KV v2 API subpath. For KV v2, secret/payments/api is not the correct path for reading secret data in ACL policies; the policy must reference secret/data/payments/api for data reads.
- C. Incorrect.
Incorrect. The list capability allows listing keys on supported list endpoints, not reading the secret value itself. A user with only list cannot retrieve the contents of secret/data/payments/api. This distractor reflects the misconception that listing a path also grants access to the secret stored there.
- D. Incorrect.
Incorrect. Although this stanza includes read, it also grants create, which allows writing a new secret at the path. That exceeds the requirement because the developer must only read the current value and must not be able to create or update secret versions.