VAULT-ASSOCIATE-002 · Question #84
When creating a policy, an error was thrown: Which statement describes the fix for this issue?
The correct answer is A. Replace write with create in the capabilities list. If a policy operation fails with a permission error related to creating new data, the fix often involves replacing the write capability with create.
Question
Exhibit
Options
- AReplace write with create in the capabilities list
- BYou cannot have a wildcard ("*") in the path
- Csudo is not a capability
How the community answered
(25 responses)- A84% (21)
- B12% (3)
- C4% (1)
Why each option
If a policy operation fails with a permission error related to creating new data, the fix often involves replacing the `write` capability with `create`.
In Vault policies, the `write` capability allows modifying existing data at a path, while the `create` capability is specifically required to create *new* data at a path that does not yet exist. If the intent was to create a new secret or entry, `create` must be explicitly granted.
Wildcards (`*` or `+`) are a fundamental feature of Vault policy paths for matching multiple paths and are perfectly valid.
`sudo` is a valid capability in Vault policies, granting elevated permissions to bypass normal capability checks for specific operations.
Concept tested: Vault policy capabilities (create vs write)
Source: https://developer.hashicorp.com/vault/docs/concepts/policies#capabilities
Topics
Community Discussion
No community discussion yet for this question.