Task 2.3: Describe Vault policy syntax: capabilities

• Aread on database/creds/report

  Correct

  Generating credentials is an HTTP GET, and capabilities map to the verb, so it needs read.

• Bcreate on database/creds/report

  Incorrect

  Although credentials are created in the database, the request is a GET, which create does not cover.

• Cupdate on sys/leases/renew

  Correct

  The renew endpoint takes a POST or PUT, which maps to update.

• Dsudo on sys/leases/renew

  Incorrect

  sudo is for root-protected paths; renewing a lease is not one of them.

• Elist on database/creds/report

  Incorrect

  list allows LIST requests that return keys; it does not generate credentials.

Capabilities follow the HTTP verb, not the effect: reading a dynamic secret path creates a credential but needs only read.

• Apath "sys/leases/revoke-prefix/aws/creds" { capabilities = ["update"] }

  Incorrect

  sys/leases/revoke-prefix is a root-protected path, so update alone is refused.

• Bpath "sys/leases/revoke-prefix/aws/creds" { capabilities = ["update", "sudo"] }

  Correct

  revoke-prefix revokes a whole prefix in one call, is root-protected so it needs sudo with update, and this path covers only aws/creds.

• Cpath "sys/leases/revoke-prefix/aws/creds" { capabilities = ["sudo"] }

  Incorrect

  sudo grants access to a root-protected path only together with the capability for the operation, here update.

• Dpath "sys/leases/revoke/aws/creds/*" { capabilities = ["update", "sudo"] }

  Incorrect

  This endpoint revokes one lease ID per call, so it cannot clear every aws/creds lease at once.

Root-protected endpoints need sudo in addition to the capability for the verb. Scoping the path to the prefix keeps the grant to aws/creds only.

• Acreate only

  Incorrect

  create alone does not cover overwriting an existing value.

• Bcreate and update

  Correct

  Few parts of Vault distinguish create from update, so most writes need both.

• Cupdate and sudo

  Incorrect

  sudo is only for root-protected paths.

• Dwrite and read

  Incorrect

  There is no write capability; writes map to create and update.

Capabilities follow HTTP verbs: POST and PUT map to create and update, GET to read, DELETE to delete and LIST to list.

• AYes, because sudo overrides deny

  Incorrect

  sudo does not override deny.

• BYes, because the policy with more capabilities wins

  Incorrect

  The count of capabilities is irrelevant; deny is absolute.

• COnly with a root token, which deny does not affect

  Incorrect

  The question is about this token, whose deny applies.

• DNo, because deny takes precedence over all other capabilities

  Correct

  deny always wins, regardless of any other capability, including sudo.

Use deny to carve exceptions out of broad grants; nothing in the same token can undo it.

• AEvery key name under it, since list results are not filtered by policy

  Correct

  Keys returned by a list are not filtered, so sensitive data must not be encoded in key names.

• BOnly the one key the token can read, since Vault trims lists to readable keys

  Incorrect

  Vault does not trim list results to readable keys.

• CAn error, because list requires read on every key under the prefix

  Incorrect

  list needs only the list capability on the prefix.

• DThe keys with their values masked

  Incorrect

  list returns names only, never values.

Treat key names as visible to anyone with list on the prefix.

• Avault kv patch -mount=secret app/config port=8443

  Incorrect

  kv patch sends an HTTP PATCH, which the patch capability allows.

• Bvault kv get -mount=secret app/config

  Incorrect

  Reading the latest version needs read on the data path, which is granted.

• Cvault kv put -mount=secret app/config port=8443

  Correct

  put writes a whole new version, which patch does not cover, and the policy grants nothing else that writes.

• Dvault kv get -mount=secret -version=1 app/config

  Incorrect

  Reading an older version goes through the same data path with read.

The patch capability covers partial updates only; a full kv put needs other capabilities, while read covers reading any version.