VAULT-ASSOCIATE-002 Question #9: Real Exam Question with Answer & Explanation

Question

To give a role the ability to display or output all of the end points under the /secrets/apps/* end point it would need to have which capability set?

Options

• Aupdate
• Bread
• Csudo
• Dlist
• ENone of the above

Explanation

To view or enumerate all endpoints or keys within a specific path in Vault, the list capability is required in the associated policy.

Common mistakes.

• A. The update capability allows an entity to modify data at a path, not to enumerate existing paths or keys.
• B. The read capability allows an entity to retrieve the content of a specific secret at a given path, but not to list all secrets or sub-paths within a directory-like structure.
• C. The sudo capability grants elevated privileges for specific operations, often to bypass other policy rules, but it's not the standard capability for simply listing paths.
• E. The list capability is indeed the correct one for this operation.

Concept tested. Vault policy capabilities (list)

Reference. https://www.vaultproject.io/docs/concepts/policies#capabilities

No community discussion yet for this question.