HashiCorp HCVA0-003 Exam - Topic 3 Question 15 Discussion

Actual exam question for HashiCorp's HCVA0-003 exam

Question #: 15
Topic #: 3

Which of the following Vault policies will allow a Vault client to read a secret stored at secrets/applications/app01/api_key?

Apath 'secrets/applications/' { capabilities = ['read'] allowed_parameters = { 'certificate' = [] } }

Bpath 'secrets/*' { capabilities = ['list'] }

Cpath 'secrets/applications/+/api_*' { capabilities = ['read'] }

Dpath 'secrets/applications/app01/api_key/*' { capabilities = ['update', 'list', 'read'] }

Show Suggested Answer

Suggested Answer: C

Comprehensive and Detailed in Depth

This question requires identifying a policy that permits reading the secret at secrets/applications/app01/api_key. Vault policies use paths and capabilities to control access. Let's evaluate:

A: path 'secrets/applications/' { capabilities = ['read'] allowed_parameters = { 'certificate' = [] } }

This policy allows reading at secrets/applications/, but not deeper paths like secrets/applications/app01/api_key. The allowed_parameters restriction is irrelevant for reading secrets. Incorrect.

B: path 'secrets/*' { capabilities = ['list'] }

The list capability allows listing secrets under secrets/, but not reading their contents. Reading requires the read capability. Incorrect.

C: path 'secrets/applications/+/api_*' { capabilities = ['read'] }

The + wildcard matches one segment (e.g., app01), and api_* matches api_key. This policy grants read access to secrets/applications/app01/api_key. Correct.

D: path 'secrets/applications/app01/api_key/*' { capabilities = ['update', 'list', 'read'] }

This policy applies to subpaths under api_key/, not the exact path api_key. It includes read, but the path mismatch makes it incorrect for this specific secret.

Overall Explanation from Vault Docs:

''Wildcards (*, +) allow flexible path matching... read capability is required to retrieve secret data.'' Option C uses globbing to precisely target the required path.

by Arleen at Nov 24, 2025, 11:42 AM

Limited Time Offer

25%

Off

Get Premium HCVA0-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Elza

3 days ago

C is flexible, but D is definitely the safest choice.

upvoted 0 times

...

Janey

8 days ago

D gives full access, which is what we need for that secret.

upvoted 0 times

...

Destiny

13 days ago

I feel like B doesn't provide enough permissions.

upvoted 0 times

...

Aliza

19 days ago

A is too limited. It won't work for that path.

upvoted 0 times

...

Muriel

24 days ago

Seems a bit overkill for just reading a secret, right?

upvoted 0 times

...

Elfrieda

29 days ago

Totally agree with D, it covers all bases!

upvoted 0 times

...

Julene

1 month ago

Wait, why not A? It seems close enough.

upvoted 0 times

...

Timothy

2 months ago

I think C could work too, but not sure.

upvoted 0 times

...

Hubert

2 months ago

D is the correct choice! It has read access.

upvoted 0 times

...

Diane

2 months ago

Vault policies, huh? I just use a sticky note for my API keys. Much simpler.

upvoted 0 times

...

An

2 months ago

C is the way to go. Specific path, read access. Easy peasy.

upvoted 0 times

...

Louvenia

2 months ago

D looks good too, but it's a bit too broad. C is the way to go.

upvoted 0 times

...

Sheron

3 months ago

I’m a bit confused about the allowed parameters in A. Does that affect the ability to read the secret? I’m not sure if it’s relevant here.

upvoted 0 times

...

Marg

3 months ago

I feel like I saw a similar question in practice, and it was about the specific capabilities needed. D seems to cover everything needed.

upvoted 0 times

...

Devora

3 months ago

I'm not entirely sure, but I remember something about wildcard paths. Could option C be a possibility too?

upvoted 0 times

...

Kirk

3 months ago

I think option D might be the right choice since it explicitly mentions the exact path and includes "read" capability.

upvoted 0 times

...

Serita

3 months ago

I'm not entirely sure, but I think option C is the best choice here. The policy syntax looks correct, and it seems to grant the necessary permissions.

upvoted 0 times

...

Danilo

3 months ago

I feel pretty good about this one. The policy in option C seems to be the most targeted and appropriate for the given scenario.

upvoted 0 times

...

Ruthann

4 months ago

Okay, I've got a strategy for this. I'll break down each policy option and consider which one most specifically grants read access to the secrets/applications/app01/api_key path.

upvoted 0 times

...

Julie

4 months ago

C is the correct answer. It's a specific path that allows reading the API key.

upvoted 0 times

...

Tyra

4 months ago

I disagree, D seems more specific and allows read access.

upvoted 0 times

...

Laila

4 months ago

I think option C is the best. It covers the wildcard for app01.

upvoted 0 times

...

Hortencia

5 months ago

Hmm, I'm torn between C and D. Gotta think this one through.

upvoted 0 times

...

Alyce

5 months ago

Hmm, this looks tricky. I'm a bit confused about the difference between the policy options. I'll need to carefully read through each one to understand the implications.

upvoted 0 times

...

Celestina

5 months ago

I think the answer is C, but I'm not completely sure. I'll need to review the Vault policy syntax to be more confident.

upvoted 0 times

Cassie

4 months ago

I’m leaning towards D. It seems more specific.

upvoted 0 times

...