HashiCorp Certified - Vault Associate Course - Vault Policies—Capabilities

The video tutorial explains how to define paths and capabilities in Vault policies, focusing on the differences between create and update capabilities. It provides examples of policies for generating database credentials and managing access to specific paths. The tutorial also covers the importance of list privileges for accessing paths in the UI and CLI.

What is the primary function of the 'deny' capability in Vault policies?

• To allow all actions on a path

• To enable root access

• To override all other capabilities and disallow access

• To provide read-only access

When is the 'create' capability required in Vault?

• When updating an existing key

• When listing keys

• When writing a new key-value pair

• When deleting a key

Which capability allows you to view the keys at a particular path without reading their values?

• List

• Update

• Read

• Create

What is the correct capability to use when you want to overwrite an existing value in Vault?

• Create

• Read

• Update

• Delete

In the context of Vault, what does the 'sudo' capability allow?

• Reading of all secrets

• Listing of all paths

• Creation of new paths

• Access to root-protected paths

What capability is not valid in Vault policies?

• Read

• Write

• Update

• Create

How would you structure a policy to allow read access to all paths under 'web app' except 'super secret'?

• Allow read access to 'web app' only

• Deny all access to 'web app'

• Allow read access to 'super secret' and deny 'web app'

• Allow read access to 'web app' and deny 'super secret'

Which capability is needed to generate database credentials in Vault?

• Read

• Update

• Create

• Delete

What is the purpose of using wildcards in Vault policies?

• To deny access to all paths

• To specify exact paths only

• To provide access to multiple paths under a common prefix

• To allow access to all paths

Why are list privileges important when browsing paths in the Vault UI?

• They are not necessary for UI access

• They provide write access to paths

• They enable you to see the structure of paths leading to a secret

• They allow you to read all secrets