HashiCorp Vault Associate (003) Question 51
Single answer2c Describe Vault policy syntax: capabilitiesA security team wants an application token to read database credentials generated by the database secrets engine at the path database/creds/readonly, but they do not want the token to be able to create, update, or delete anything else. A teammate proposes the following policy stanza:
path "database/creds/readonly" { capabilities = ["read"] }
When the application uses this token to fetch credentials, the request succeeds. Later, another engineer suggests replacing read with list because the application is only "retrieving information." Which statement best describes the correct use of Vault policy capabilities in this scenario?
- A
Keep
read, because fetching generated credentials from an exact path requires thereadcapability;listis for listing keys at a path, not retrieving the secret value. - B
Replace
readwithlist, because all GET requests in Vault require only thelistcapability. - C
Use both
createandupdate, because dynamic secrets are generated on demand and therefore require write access to the endpoint. - D
Add
sudo, because reading from secrets engines that generate credentials requires elevated privileges even when the path is explicitly allowed.
Show answer and explanation
Correct answer: A
Explanation
Vault policies use capabilities such as create, read, update, delete, list, patch, and sudo to control what operations a token can perform on a path. In this scenario, the application needs to retrieve credentials from a specific secrets engine endpoint, so read is the appropriate capability. list is often misunderstood: it allows enumeration of keys or paths where supported, but it does not permit reading the underlying secret contents. Following least-privilege best practice, the policy should grant only read on database/creds/readonly and no broader write or administrative capabilities. This aligns with Vault ACL policy documentation and the documented meaning of capabilities in policy syntax.
- A. Correct.
Correct. In Vault ACL policies,
readallows reading data from a path, which is what the application is doing when it requests credentials fromdatabase/creds/readonly. Thelistcapability is used for listing entries, typically on paths that support listing, and does not grant permission to read the actual secret data. This is a common distinction in Vault policy syntax. - B. Incorrect.
Incorrect.
listdoes not mean "retrieve any information." In Vault,listis specifically for listing available keys or child paths where the endpoint supports that operation. A client that needs the actual credentials fromdatabase/creds/readonlyneedsread, not justlist. - C. Incorrect.
Incorrect. Although the database secrets engine generates credentials dynamically, the client operation against
database/creds/readonlyis still a read-style action from the policy perspective. The application is not configuring the engine or changing roles, socreateandupdateare unnecessary and would grant more access than required. - D. Incorrect.
Incorrect.
sudois only required for specific privileged operations on certain system paths and administrative endpoints. Reading generated credentials from an allowed database secrets path does not requiresudo. Adding it would violate least-privilege principles.