HashiCorp Vault Associate (003) Question 63
Single answer2e Configure Vault policies using the UI and CLIA security team wants application operators to be able to read database credentials generated by the database secrets engine, but not modify the role configuration or rotate root credentials. An administrator already enabled the database secrets engine at the path db/. You need to create a policy and verify it using both the CLI and the Vault UI. Which policy stanza should you add to meet this requirement with least privilege?
- A
path "db/*" { capabilities = ["read", "list"] }
- B
path "db/creds/*" { capabilities = ["read"] }
- C
path "db/roles/*" { capabilities = ["read"] }
- D
path "db/config/*" { capabilities = ["read", "update"] }
Show answer and explanation
Correct answer: B
Explanation
In the database secrets engine, generated dynamic credentials are read from the creds endpoint beneath the mount path, for example db/creds/
- A. Incorrect.
Incorrect. Granting access to db/* is overly broad and violates least privilege. It would allow read and list operations across multiple database secrets engine endpoints, including role definitions or other metadata paths that operators do not need. A common mistake is to use a wildcard at the mount root for convenience, but Vault policies should scope access to the specific path pattern required.
- B. Correct.
Correct. Dynamic database credentials are typically retrieved from the database secrets engine under the creds endpoint, such as db/creds/app-role. Granting read on path "db/creds/*" allows users to fetch generated credentials for roles without permitting changes to role definitions, connection configuration, or root rotation endpoints. This is the narrowest policy among the options that satisfies the requirement.
- C. Incorrect.
Incorrect. The roles endpoint is used for role configuration and inspection, not for retrieving generated credentials. Allowing read on db/roles/* would let operators view role definitions, which is outside the stated requirement. Candidates often confuse the role configuration path with the credentials generation path because both include the role name in the URL structure.
- D. Incorrect.
Incorrect. The config endpoint is for database connection configuration, and update on that path is far more privilege than needed. It could allow modifying connection settings, and related administrative operations are explicitly outside the requirement. This option reflects a misunderstanding that reading credentials involves the config path.