HashiCorp Vault Associate (003) Question 60
Single answer2e Configure Vault policies using the UI and CLIA security team wants application operators to read only the current database credentials generated by the database secrets engine at path database/creds/readonly, but they must not be able to list other roles, update configuration, or revoke leases. An administrator decides to create the policy in the Vault UI and then validate it from the CLI. Which policy configuration best meets this requirement?
- A
Create a policy that grants read on path "database/creds/readonly" and attach it to the operators' tokens.
- B
Create a policy that grants list on path "database/roles/" and read on path "database/config/" so operators can discover only the readonly role.
- C
Create a policy that grants sudo and read on path "database/creds/readonly" to ensure generated credentials can be accessed.
- D
Create a policy that grants update on path "database/creds/readonly" because dynamic credentials are generated on demand.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to grant only the read capability on the specific path database/creds/readonly. This follows Vault's least-privilege model and matches how ACL policies are written and applied whether created in the UI or via the CLI using commands such as vault policy write and vault token capabilities. A practical validation step from the CLI would be to check capabilities against the path and confirm the token has read but not list, update, or sudo. HashiCorp Vault documentation on ACL policies and path capabilities emphasizes assigning the minimum required capability on the exact path needed by the workflow.
- A. Correct.
Correct. In Vault ACL policies, access is granted per path and capability. To retrieve credentials from an existing database role endpoint such as database/creds/readonly, the required capability is read on that exact path. This gives operators the minimum access needed to fetch the current response from that endpoint without allowing them to list roles, change database configuration, or revoke leases.
- B. Incorrect.
Incorrect. Granting list on database/roles/* and read on database/config/* exposes additional information the scenario explicitly says operators should not have. Listing roles reveals other available database roles, and reading config paths can expose operational details. This violates least-privilege requirements.
- C. Incorrect.
Incorrect. The sudo capability is only needed for a small set of privileged system paths and is not required for normal access to database secrets engine credential endpoints. Adding sudo would be unnecessary and overly permissive. Read alone is sufficient for this use case.
- D. Incorrect.
Incorrect. The database/creds/
endpoint is accessed with the read capability in ACL policies, even though the backend generates dynamic credentials when the request is made. A common mistake is to assume generation implies update, but Vault policy capability mapping for this endpoint uses read.