Skip to content
Cheat sheets

003 · Domain 5: Secrets engines · 20% of the exam

Task 5.8: Access Vault secrets using the CLI, API, and UI

vault kv get, put and patch with -mount and -field, KV v2's data path on the API, versions, reading dynamic credentials, and the UI secret view.

Study it

  • Reading and writing secrets: kv commands, API paths and versions

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

secret/app/config on a KV v2 mount holds the keys username and password. An operator runs vault kv put -mount=secret app/config password=n3w. What does the new current version contain?

  1. Ausername with its old value and password set to n3w
  2. BOnly the key password, set to n3w
  3. CNo new version, because put fails when the secret already exists
  4. Dusername and password with their old values, plus a note of the change
Show the answer and why

  • Ausername with its old value and password set to n3w

    Incorrect

    That is the result of vault kv patch, which merges the given keys into the current data.

  • BOnly the key password, set to n3w

    Correct

    kv put writes a complete new version made of the data given, so keys left out are not carried over.

  • CNo new version, because put fails when the secret already exists

    Incorrect

    put creates a new version of an existing secret unless check-and-set is required.

  • Dusername and password with their old values, plus a note of the change

    Incorrect

    put replaces the data; it does not keep the old values.

Use kv patch to change one key and keep the rest; kv put replaces the whole secret with a new version.

HashiCorp documentation

Task 5.8Report a problem with this question

Question 2 · choose 1

A script must read the password key from version 3 of the secret app/config on the KV v2 mount secret/ through the HTTP API. Which request and JSON field give it the value?

  1. AGET /v1/secret/app/config?version=3, then read .data.password
  2. BGET /v1/secret/metadata/app/config?version=3, then read .data.data.password
  3. CGET /v1/secret/data/app/config/3, then read .data.data.password
  4. DGET /v1/secret/data/app/config?version=3, then read .data.data.password
Show the answer and why

  • AGET /v1/secret/app/config?version=3, then read .data.password

    Incorrect

    That is the KV v1 layout; a KV v2 mount serves secret values under data/.

  • BGET /v1/secret/metadata/app/config?version=3, then read .data.data.password

    Incorrect

    The metadata path returns version information and custom metadata, not secret values.

  • CGET /v1/secret/data/app/config/3, then read .data.data.password

    Incorrect

    The version is a query parameter; /3 would name a different secret path.

  • DGET /v1/secret/data/app/config?version=3, then read .data.data.password

    Correct

    KV v2 reads go through the data/ path, a version is chosen with the version query parameter, and the values sit under data.data.

On KV v2 the response wraps the secret in data.data, next to data.metadata for the version that was read.

HashiCorp documentation

Task 5.8Report a problem with this question

Question 3 · choose 1

A script needs only the value of password from secret/app/db on a KV v2 mount, with no table around it. Which command prints just that?

  1. Avault kv get -mount=secret -format=table app/db
  2. Bvault kv get -mount=secret -key=password app/db
  3. Cvault kv get -mount=secret -field=password app/db
  4. Dvault kv list -mount=secret app/db
Show the answer and why

  • Avault kv get -mount=secret -format=table app/db

    Incorrect

    Table output wraps the values in a formatted table.

  • Bvault kv get -mount=secret -key=password app/db

    Incorrect

    There is no -key flag.

  • Cvault kv get -mount=secret -field=password app/db

    Correct

    -field prints only the named field.

  • Dvault kv list -mount=secret app/db

    Incorrect

    list returns key names under a path, not values.

-field and -format=json make kv get easy to use in scripts.

HashiCorp documentation

Task 5.8Report a problem with this question

Question 4 · choose 1

A bad change was written as version 5 of secret/app/config. The team wants version 3's data to be current again, keeping the history. Which command does that?

  1. Avault kv rollback -mount=secret -version=3 app/config
  2. Bvault kv delete -mount=secret app/config
  3. Cvault kv undelete -mount=secret -versions=3 app/config
  4. Dvault kv metadata put -mount=secret -max-versions=3 app/config
Show the answer and why

  • Avault kv rollback -mount=secret -version=3 app/config

    Correct

    rollback restores an older version's data as a new version.

  • Bvault kv delete -mount=secret app/config

    Incorrect

    This does not make version 3's data current.

  • Cvault kv undelete -mount=secret -versions=3 app/config

    Incorrect

    Version 3 was never deleted, so there is nothing to bring back.

  • Dvault kv metadata put -mount=secret -max-versions=3 app/config

    Incorrect

    Limiting versions changes retention, not which data is current.

Rolling back keeps every version, so the bad change stays visible in the history.

HashiCorp documentation

Task 5.8Report a problem with this question

Question 5 · choose 1

An engineer runs vault kv put -mount=secret app/db password=@Spring2026 and the command fails because a file named Spring2026 cannot be read. The password really does start with @. How should the value be passed?

  1. Apassword='@Spring2026', quoting the value for the shell
  2. Bpassword="\@Spring2026", escaping the @ with a backslash
  3. Cpassword=@@Spring2026, doubling the @ to escape it
  4. Dpassword=@Spring2026 with -field=password to mark it as a value
Show the answer and why

  • Apassword='@Spring2026', quoting the value for the shell

    Incorrect

    The shell removes the quotes before Vault sees the argument, which still starts with @.

  • Bpassword="\@Spring2026", escaping the @ with a backslash

    Correct

    Vault treats a leading @ as a file reference unless the @ is escaped with a backslash.

  • Cpassword=@@Spring2026, doubling the @ to escape it

    Incorrect

    The documented escape for a leading @ is a backslash; a doubled @ is not an escape Vault describes.

  • Dpassword=@Spring2026 with -field=password to mark it as a value

    Incorrect

    -field selects which output field to print; it does not change how input is read.

The CLI reads key=@file values from files, which is handy for certificates and long values; a value that really begins with @ needs the backslash escape.

HashiCorp documentation

Task 5.8Report a problem with this question

Question 6 · choose 1

Version 4 of secret/app/token was soft-deleted by mistake. Which command brings it back?

  1. Avault kv metadata delete -mount=secret app/token
  2. Bvault kv put -mount=secret -cas=4 app/token
  3. Cvault kv get -mount=secret -version=4 app/token
  4. Dvault kv undelete -mount=secret -versions=4 app/token
Show the answer and why

  • Avault kv metadata delete -mount=secret app/token

    Incorrect

    metadata delete permanently removes the key and every version.

  • Bvault kv put -mount=secret -cas=4 app/token

    Incorrect

    cas guards writes; it does not restore data.

  • Cvault kv get -mount=secret -version=4 app/token

    Incorrect

    A deleted version cannot be read until it is undeleted.

  • Dvault kv undelete -mount=secret -versions=4 app/token

    Correct

    undelete restores soft-deleted versions while their data still exists.

Soft deletes can be reverted while destroyed is false; destroyed versions are gone.

HashiCorp documentation

Task 5.8Report a problem with this question

Practice domain 5 →Practice all domains →