Skip to content
Cheat sheets

003 · Domain 2: Vault policies · 13% of the exam

Task 2.1: Explain the value of Vault policies

Deny by default, policies attached by name to tokens, least privilege per path, the default and root policies, and changes that apply to existing tokens.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A token was issued an hour ago with the policies default and app-read. An operator now uses vault policy write to remove read on secret/data/app/* from app-read. The token has 20 minutes of TTL left. What happens to its next read of secret/data/app/config?

  1. AIt succeeds until the token is renewed, because rules are copied into the token at login
  2. BIt succeeds until the token expires, because policy changes apply only to new tokens
  3. CIt is denied only after the token is revoked and a new one is issued
  4. DIt is denied, because Vault evaluates the policy's current rules on every request
Show the answer and why

  • AIt succeeds until the token is renewed, because rules are copied into the token at login

    Incorrect

    Tokens hold policy names, not copies of the rules; nothing waits for a renewal.

  • BIt succeeds until the token expires, because policy changes apply only to new tokens

    Incorrect

    Policy changes take effect for existing tokens on their next request.

  • CIt is denied only after the token is revoked and a new one is issued

    Incorrect

    Revocation is needed to change which policies a token has, not to change what a policy contains.

  • DIt is denied, because Vault evaluates the policy's current rules on every request

    Correct

    Tokens reference policies by name, and policy contents are parsed whenever the token is used, so the change applies at once.

The set of policy names on a token is fixed at issue, but the rules behind those names are read on every call. Tightening a policy takes effect immediately for all tokens that carry it.

HashiCorp documentation

Task 2.1Report a problem with this question

Question 2 · choose 1

A token carries only the policy app-read, which mentions the single path secret/data/app/*. The token tries to read secret/data/billing/api. What happens?

  1. AThe read succeeds, because a token may read any path no policy denies
  2. BThe read succeeds, because read is granted on all paths by default
  3. CIt is denied, since the policies grant only the paths they name
  4. DThe read returns the path's metadata but not its values
Show the answer and why

  • AThe read succeeds, because a token may read any path no policy denies

    Incorrect

    Vault works the other way round: everything is denied unless a policy allows it.

  • BThe read succeeds, because read is granted on all paths by default

    Incorrect

    No capability is granted by default; the default policy covers only a few token and cubbyhole paths.

  • CIt is denied, since the policies grant only the paths they name

    Correct

    Policies are deny by default, so any path no attached policy allows is refused.

  • DThe read returns the path's metadata but not its values

    Incorrect

    A denied request returns a permission error, not partial data.

An empty policy grants no permission. Every allowed action must be named by a policy attached to the token.

HashiCorp documentation

Task 2.1Report a problem with this question

Question 3 · choose 1

An auditor notices that a token created with vault token create -policy=ci also lists the policy default. Why, and how could it be left out?

  1. Adefault is attached only to root tokens and cannot be left out
  2. Bdefault comes from the parent token and is dropped with -orphan
  3. Cdefault is added by the CLI only and disappears when the token is created through the API
  4. Ddefault goes on every token unless excluded, e.g. with -no-default-policy
Show the answer and why

  • Adefault is attached only to root tokens and cannot be left out

    Incorrect

    It is attached to tokens in general, and supporting methods allow excluding it.

  • Bdefault comes from the parent token and is dropped with -orphan

    Incorrect

    Making a token an orphan changes its parent, not its policies.

  • Cdefault is added by the CLI only and disappears when the token is created through the API

    Incorrect

    The API attaches it too unless no_default_policy is set.

  • Ddefault goes on every token unless excluded, e.g. with -no-default-policy

    Correct

    The built-in default policy is attached to tokens by default and can be excluded at token creation.

The default policy lets a token look itself up and use its cubbyhole. It can be edited, but not removed from Vault.

HashiCorp documentation

Task 2.1Report a problem with this question

Question 4 · choose 1

An operator wants to restrict what the root policy can do so that root tokens cannot delete audit devices. What is possible?

  1. ANothing; the root policy is immutable, and the answer is to limit root tokens
  2. BEdit the root policy with vault policy write root and remove the sys/audit rules
  3. CAdd a deny rule on sys/audit to the default policy, which root tokens also carry
  4. DDelete the root policy and replace it with a narrower one named root
Show the answer and why

  • ANothing; the root policy is immutable, and the answer is to limit root tokens

    Correct

    The root policy is built in and cannot be modified or removed; what can be controlled is who holds root tokens.

  • BEdit the root policy with vault policy write root and remove the sys/audit rules

    Incorrect

    The root policy cannot be modified.

  • CAdd a deny rule on sys/audit to the default policy, which root tokens also carry

    Incorrect

    Root tokens can do anything; a deny in another policy does not restrict them.

  • DDelete the root policy and replace it with a narrower one named root

    Incorrect

    The root policy cannot be removed.

Vault has two built-in policies: default, which can be changed, and root, which cannot. Control root access by limiting who can obtain a root token.

HashiCorp documentation

Task 2.1Report a problem with this question

Question 5 · choose 1

A token carries the policies eng, which allows read and update on eng/*, and ops, which allows read on ops/*. What can the token do?

  1. AOnly read under eng/ and ops/, the access the two policies share
  2. BRead and update under eng/, and read under ops/
  3. COnly what eng allows, because the first policy attached wins
  4. DRead and update under both eng/ and ops/
Show the answer and why

  • AOnly read under eng/ and ops/, the access the two policies share

    Incorrect

    Policies are not intersected; each one adds access.

  • BRead and update under eng/, and read under ops/

    Correct

    When policies are merged, the token gets the union of the access each policy allows.

  • COnly what eng allows, because the first policy attached wins

    Incorrect

    The order of policies plays no part; all of them apply.

  • DRead and update under both eng/ and ops/

    Incorrect

    update on eng/ does not extend to ops/; each grant applies to its own paths.

Several small policies can be combined on one token; the token can do what any of them allows, unless a deny applies.

HashiCorp documentation

Task 2.1Report a problem with this question

Practice domain 2 →Practice all domains →