VA-003 Practice Test 11 — 15 Questions

Question 1

A DevOps engineer notices that a long-running application using a Vault token fails after 24 hours. The token was created with a TTL of 48h. The token role has a default TTL of 48h and a max TTL of 72h. What is the most likely cause of the failure?

Accepted Answer

The mount's max TTL for the token is 24h, overriding the role's setting.. The mount's max TTL for the token is likely set to 24h, which overrides the role's setting. Tokens cannot exceed the mount's max TTL, even if the role allows a longer TTL.

Answer

The token was manually revoked by an administrator.

Answer

The token was revoked due to a policy violation.

Answer

The token is a batch token and cannot be renewed.

Question 2

A periodic token is created with a TTL of 30 days. After 60 days, the token is still in use but suddenly stops working. What is the most likely reason?

Accepted Answer

The token was revoked manually or by an administrator. Periodic tokens have an explicit_max_ttl default of 0 (unlimited) but if the token role has a max_ttl set, it will enforce that. However, the common reason is that the token was revoked. Option A is wrong because periodic tokens do not have a default max TTL. Option B is wrong because explicit_max_ttl is typically 0 for periodic tokens unless set. Option D is wrong because there is no default max TTL for periodic tokens.

Answer

The token exceeded its max TTL of 60 days

Answer

The token reached its default max TTL of 32 days

Answer

The token's explicit_max_ttl was set to a value less than 60 days

Question 3

A security team wants to ensure that tokens can be revoked immediately if a compromised token is detected, even if the token ID is unknown. Which token feature should they use?

Accepted Answer

Token accessors. Token accessors allow revocation of a token without knowing the token ID. They are specifically designed for this purpose.

Answer

Periodic tokens

Answer

Batch tokens

Answer

Orphan tokens

Question 4

Which THREE factors influence the maximum TTL of a token?

Accepted Answer

The max TTL of the auth method or mount.. The maximum TTL is determined by the minimum of: the token role's max TTL, the auth method's max TTL, and the system's default max TTL. The role's default TTL and current TTL do not affect max TTL.

Answer

The TTL set on the token role.

Answer

The token's current TTL.

Question 5

An engineer wants to list all tokens associated with a specific token accessor. Which API endpoint should be used?

Accepted Answer

auth/token/lookup-accessor. The endpoint auth/token/lookup-accessor returns token information including the token's properties and policies, but not the token value. It can be used to look up token details by accessor. Option A is wrong because auth/token/lookup looks up by token value. Option C is wrong because auth/token/list lists accessors, not lookup by accessor. Option D is wrong because auth/token/accessors/ is not a valid path.

Answer

auth/token/accessors/

Answer

auth/token/lookup

Answer

auth/token/list

Question 6

An admin creates a token with TTL=48h and explicit_max_ttl=120h. The token is renewed every 24h. After 10 days, will the token still be valid?

Accepted Answer

No, because the total lifetime cannot exceed the explicit_max_ttl of 120h.. The token's total lifetime cannot exceed the explicit_max_ttl of 120h (5 days). After 10 days, it would have exceeded this limit and become invalid.

Answer

Yes, because TTL refreshes to 48h on each renewal.

Answer

Yes, if renewed before TTL expires, it can persist indefinitely.

Answer

No, because tokens cannot be renewed more than 5 times.

Question 7

A token is created with policies 'default' and 'web-app'. Later, a parent token's policy is updated to add 'logging'. The child token's policies are not updated. What will happen when the child token is used?

Accepted Answer

The child token will still have only 'default' and 'web-app' policies. Token policies are snapshotted at creation time; they do not inherit changes from parent tokens. Therefore, the child token still has only 'default' and 'web-app'. Option A is wrong because parent token changes do not propagate. Option C is wrong because Vault does not automatically refresh policy. Option D is wrong because the token is not invalidated.

Answer

The child token will be automatically renewed to pick up the new policy

Answer

The child token will automatically gain the 'logging' policy

Answer

The child token will be invalidated due to policy mismatch

Question 8

Which token type should be used for short-lived credentials that do not need to be renewed?

Accepted Answer

Batch tokens. Batch tokens are non-renewable and lightweight, ideal for short-lived credentials where renewal is unnecessary.

Answer

Service tokens

Answer

Periodic tokens

Answer

Orphan tokens

Question 9

Refer to the exhibit. A token has this policy. Which action can the token perform?

Accepted Answer

Read a secret at "secret/data/engineering/db-pass". The policy grants read and list on engineering/*, so reading secret/data/engineering/db-pass is allowed. It does not grant delete or list on finance, nor update on engineering.

Answer

Update a secret at "secret/data/engineering/config"

Answer

List secrets at "secret/data/finance/"

Answer

Delete a secret at "secret/data/finance/budget"

Question 10

A token with a policy that explicitly denies 'read' on 'secret/engineering/private' is issued. The same token also has another policy that grants 'read' on 'secret/engineering/*'. What is the result when the token tries to read 'secret/engineering/private'?

Accepted Answer

The read fails because the explicit deny on the specific path takes precedence. Option B is correct because Vault's ACL system uses a deny-first approach: if any policy explicitly denies a capability, it takes precedence over grants. Option A is wrong because the grant is overridden by the explicit deny. Option C is wrong because the token has both policies; one does not override the other unless there is an explicit deny. Option D is wrong because the deny is explicit, not a lack of permission.

Answer

The read succeeds because the grant from the wildcard policy is more permissive

Answer

The read fails because the policies conflict and Vault defaults to deny

Answer

The read succeeds because the token has a separate policy that grants read

Question 11

Which TWO of the following are true about token accessors?

Accepted Answer

Accessors should be used in audit logs instead of token values. Token accessors are non-sensitive references that can be used for token lifecycle operations. They are unique and can be used to revoke tokens without knowing the token value. Option A is incorrect because accessors cannot be used to renew tokens. Option C is incorrect because accessors are not the token value. Option D is incorrect because accessors can be used in audit logs, but that's a recommendation, not a limitation.

Answer

Accessors are the token value

Answer

Accessors can be used to renew the token

Question 12

A Vault cluster has a token with the following policy: path "secret/data/dev/*" { capabilities = ["read", "list"] }. The token is used to read a secret at "secret/data/dev/password". The read succeeds. Later, the token tries to read "secret/data/prod/password". What happens?

Accepted Answer

Fails because the token needs an explicit policy for "secret/data/prod/".. The token does not have permissions on the "secret/data/prod/" path, so the read fails with a permission denied error.

Answer

Fails with a system error.

Answer

Succeeds because token has read capability on all secrets.

Answer

Succeeds because the token can list and read any path.

Question 13

A team needs to issue unique tokens to each of 100 microservices, each with its own policy, and ensure that revoking one token does not affect others. Which token feature should they use?

Accepted Answer

Token roles with distinct policies. Token roles allow creating tokens with specific policies and settings. Each microservice can have its own token role with a distinct policy, ensuring isolation.

Answer

Periodic tokens

Answer

Orphan tokens

Answer

Token accessors

Question 14

A user's token was revoked by an administrator, but the user can still read secrets from a KV v1 secrets engine. What is the most likely reason?

Accepted Answer

The secrets were from a KV v1 engine that does not use leases. Option B is correct because KV v1 secrets do not issue leases, so token revocation does not invalidate previously read data. Option A is wrong because root tokens can still be revoked and would not persist after revocation. Option C is wrong because the token policy does not affect revocation behavior. Option D is wrong because orphan tokens are still subject to revocation.

Answer

The token had sudo capabilities on the path

Answer

The token was a root token and cannot be revoked

Answer

The token was an orphan token and therefore immune to revocation

Question 15

Where can you view a list of all active tokens in Vault?

Accepted Answer

Both A and B. Both `vault token list` and `vault list auth/token/accessors` list token accessors, which represent active tokens.

Answer

There is no way to list all tokens.

Answer

`vault token list`

Answer

`vault list auth/token/accessors`