HashiCorp Vault Associate (003) Question 57
Single answer2d Choose a Vault policy based on requirementsA platform team uses Vault KV v2 at the path secret/ to store application configuration. Developers in the payments team must be able to read the current value of any secret under secret/data/payments/*, but they must not be able to view older versions, soft-delete secrets, or permanently remove data. Which Vault policy best meets these requirements?
- A
path "secret/data/payments/*" { capabilities = ["read"] }
- B
path "secret/data/payments/" { capabilities = ["read", "list"] } path "secret/metadata/payments/" { capabilities = ["read"] }
- C
path "secret/*" { capabilities = ["read"] }
- D
path "secret/data/payments/" { capabilities = ["read"] } path "secret/delete/payments/" { capabilities = ["update"] } path "secret/destroy/payments/*" { capabilities = ["update"] }
Show answer and explanation
Correct answer: A
Explanation
The best choice is the policy that grants only read on secret/data/payments/*. In Vault, KV v2 uses distinct API paths for different operations: /data/ for reading and writing secret values, /metadata/ for listing and metadata operations, /delete/ for soft delete of versions, /undelete/ for restoring versions, and /destroy/ for permanent deletion of versions. Because the requirement is limited to reading current secret values, the policy should grant only the minimum capability on only the /data/ path for the payments subtree. This follows Vault's least-privilege best practice and aligns with the KV v2 policy model described in HashiCorp Vault documentation.
- A. Correct.
Correct. For KV v2, reading secret values uses the
/data/API path. Grantingreadonsecret/data/payments/*allows access to the current secret data without granting delete, destroy, undelete, or metadata access. This matches the requirement to read current values only. - B. Incorrect.
Incorrect. While
readonsecret/data/payments/*would allow reading secret values, adding access tosecret/metadata/payments/*lets users read metadata such as version information and deletion status. The requirement explicitly says they must not be able to view older versions, so this is broader than necessary.liston the data path is also not how KV v2 listing is typically granted; listing is performed against the metadata path. - C. Incorrect.
Incorrect. This policy is overly broad. It grants read access across all paths under the
secret/mount, not just thepaymentsteam secrets. It may also unintentionally include endpoints outside the intended scope. A good Vault policy should follow least privilege and target the exact KV v2 subpaths required. - D. Incorrect.
Incorrect. This policy grants the needed read access, but it also grants
updateon the KV v2 delete and destroy endpoints. Those endpoints allow soft-deleting versions and permanently removing versions, which directly violates the stated requirement.