Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 9
Your supervisor has requested that you log into Vault and update a policy for one of the development teams. You successfully authenticated to Vault via OIDC but do not see a way to manage the Vault policies. Why are you unable to manage policies in the Vault UI?
-
A
policies are only available on Vault Enterprise
-
B
the policy associated with your login does not permit access to manage policies
-
C
the Vault node is sealed, and therefore you cannot manage policies
-
D
policies cannot be managed in the UI, only the CLI and API
Reveal correct answer
Correct answer: B
Explanation
In this case, your policy does not permit access to view policies in Vault, therefore the Policies tab is not shown in the Vault UI. To see the Policies tab, you need a policy that includes the following path (for Vault Community):
- path "sys/policy/*" {
- capabilities = ["read", "list"]
- }
Note that Vault Community and Vault Enterprise have different paths to manage policies. In Vault Enterprise, the path above would be sys/policies/acl/* . That's because Vault Enterprise has different types of policies, including traditional ACLs, Sentinel EGPs, and Sentinel RGPs. Because of that, Vault Enterprise changes the API endpoint.
The policy above will permit you access to just view the policies in Vault, but you will not be able to manage/edit them. In order to update policy, you would need update permissions on all policies, or at least the policies you need to manage. So if you have a policy called developers that you wanted to update, you would need a policy that included this permission:
- path "sys/policies/acl/developer" {
- capabilities = ["read", "list", "update"]
- }
Keep in mind that you would need the create permission if the policy didn't exist and you wanted to create it. Having the update permission only allows you to modify an existing policy.
More information about the Vault OSS endpoint for managing policies can be found here.
Information about the Vault Enterprise endpoint for policies can be found here.
A. This choice is incorrect. Policies are available in both Vault Open Source and Vault Enterprise editions. The availability of policies is not limited to Vault Enterprise; therefore, this is not the reason why you are unable to manage policies in the Vault UI.
B. The correct choice is that the policy associated with your login does not permit access to manage policies. Vault policies are used to control access to different resources within Vault, and if your policy does not have the necessary permissions to manage policies, you will not see the option in the UI.
C. This choice is incorrect. The Vault node being sealed does not impact your ability to manage policies in the UI. Sealing a Vault node is related to safeguarding the encryption keys, and it does not restrict policy management capabilities within the UI.
D. This choice is incorrect. Policies can be managed in the Vault UI, as well as through the CLI and API. The Vault UI provides a user-friendly interface for managing policies, allowing users to define access control rules visually.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
