Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 10
An application requires a specific key/value pair to be updated in order to process a batch job. The value should be either "true" or "false." However, when developers have been updating the value, sometimes they mistype the value or capitalize the value, causing the batch job not to run.
What feature of a Vault policy can be used to restrict entry to the required values?
-
A
add a
denystatement for all possible misspellings of the value -
B
use a
*wildcard at the end of the policy -
C
added an
allowed_parametersvalue to the policy -
D
change the policy to include the
listcapability
Reveal correct answer
Correct answer: C
Explanation
allowed_parameters can be used to permit a list of keys and values that are permitted on the given path. Setting a parameter with a value of the empty list allows the parameter to contain any value.
https://developer.hashicorp.com/vault/docs/concepts/policies#fine-grained-control
A. Adding a deny statement for all possible misspellings of the value can be cumbersome and error-prone, as it would require listing out every potential misspelling or variation of the allowed values. This approach is not efficient or scalable, especially if there are multiple values that need to be restricted.
B. Using a * wildcard at the end of the policy does not provide a specific restriction on the values that can be updated. It allows for any value to be entered, which does not address the issue of mistyped or capitalized values affecting the batch job.
C. Adding an allowed_parameters value to the policy allows you to specify the exact values that are permitted for the key/value pair. By defining "true" and "false" as the only allowed parameters, developers will be restricted to entering these values, preventing mistyped or capitalized values from causing issues with the batch job.
D. Changing the policy to include the list capability does not directly address the issue of restricting entry to specific values. The list capability allows for listing and reading the values stored in Vault, but it does not enforce restrictions on the values that can be updated. This capability alone does not provide a solution to prevent mistyped or capitalized values from affecting the batch job.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
