VA-003 Practice Test 12 — 15 Questions

Question 1

An organization uses Vault's token auth method to issue tokens for long-running services. They want to ensure that tokens are automatically revoked after 30 days, even if the service repeatedly renews them. Which token role configuration achieves this?

Accepted Answer

Set max_ttl to 720h on the token role. Option C is correct because setting max_ttl on the token role enforces an absolute lifetime; even if the token is renewed, it cannot exceed max_ttl. Option A is wrong because periodic tokens without max_ttl can be renewed indefinitely. Option B is wrong because setting ttl without max_ttl allows renewal beyond the initial ttl. Option D is wrong because explicit_max_ttl is not a parameter on the role; it is a role attribute, but the correct property is max_ttl.

Answer

Set ttl to 720h without setting max_ttl

Answer

Set explicit_max_ttl to 720h on the token role

Answer

Set period to 720h without setting max_ttl

Question 2

An application uses a periodic token with period=24h. The application renews every 12h. After 48h, the token is still valid. After 72h, the token is still valid. What is the maximum lifetime of this periodic token?

Accepted Answer

Unlimited (as long as it keeps renewing). Periodic tokens have no max TTL; they can be renewed indefinitely as long as renewal occurs within the period (24h). Thus, the token can last forever if renewed in time.

Answer

72h

Answer

48h

Answer

24h

Question 3

A DevOps engineer needs to create a token that can only read secrets under the path 'secret/engineering'. What is the recommended approach?

Accepted Answer

Create a policy that allows read on secret/engineering/* and attach it to the token. Option D is correct because creating a policy with the read capability on the specific path and issuing a token with that policy is the best practice. Option A is wrong because using a root token grants full access. Option B is wrong because the default policy allows extensive access. Option C is wrong because simply setting a TTL does not restrict access.

Answer

Create a token with a short TTL so it expires quickly

Answer

Create a token with the default policy only

Answer

Use the root token and restrict usage with a low TTL

Question 4

Which TWO methods can be used to revoke a token without knowing the token ID?

Accepted Answer

Using `vault token revoke -mode path` on the auth mount.. Using the token accessor allows revocation without the token ID, and using `vault token revoke -mode path` on the auth mount revokes all tokens created by that mount path.

Answer

Using the token's role name if it has one.

Answer

Using the token's policy name.

Answer

Using the token's creation time.

Question 5

An administrator wants to audit token usage without exposing the actual token IDs to auditors. Which approach should they use?

Accepted Answer

Use token accessors in audit logs. Option A is correct because token accessors are designed exactly for this purpose: they are references to tokens that can be used in audit logs without revealing the token ID. Option B is wrong because token lookup requires the token ID. Option C is wrong because enabling audit logging alone still logs the token ID. Option D is wrong because wrapping tokens is for secure delivery, not auditing.

Answer

Enable audit logging without any modifications

Answer

Use the token lookup API for each audit event

Answer

Use response wrapping to encapsulate tokens

Question 6

An administrator creates a service token with a TTL of 1 hour and a max TTL of 24 hours. The token is renewed once after 55 minutes. What happens to the token after 24 hours from creation?

Accepted Answer

The token expires and cannot be renewed. Option B is correct because the token reaches its max TTL and expires. Option A is wrong because revocation is an explicit action. Option C is wrong because tokens do not become orphan automatically. Option D is wrong because Vault does not extend max TTL automatically.

Answer

The token is revoked by the system

Answer

The token's TTL is automatically extended by 1 hour

Answer

The token becomes an orphan token

Question 7

Refer to the exhibit. A user attempts to renew the token after 20 hours. What will happen?

Accepted Answer

The token will be renewed for another 4h, after which it will expire.. The explicit max TTL is 24h. After 20h, the remaining time until max TTL is 4h. Renewal will set the token duration to the minimum of the requested TTL (12h) and the remaining max TTL (4h), resulting in a 4h TTL. After that, the token expires.

Answer

The renewal will fail because the token has exceeded its explicit max TTL.

Answer

The token will be renewed for another 12h and can be renewed indefinitely.

Answer

The token will be renewed for 12h, but the total lifetime cannot exceed 24h.

Question 8

A security team wants to issue tokens that can be used for exactly 10 API calls, after which they must be renewed. Which two token parameters should be set on the token role?

Accepted Answer

num_uses and renewable. Option D is correct: num_uses=10 restricts to 10 uses, and renewable=true allows renewal after the uses are exhausted (if the user requests renewal before the token expires). Option A is wrong because period is for periodic tokens, not for limited use. Option B is wrong because ttl alone does not limit uses. Option C is wrong because ttl and num_uses together would not allow renewal after uses exhausted without renewable being true.

Answer

period and num_uses

Answer

ttl and renewable

Answer

ttl and num_uses

Question 9

Refer to the exhibit. An admin wants to ensure this token can be used for 60 hours total. Which action should be taken?

Accepted Answer

Create a new token with explicit_max_ttl=60h.. The token's explicit max TTL is 48h, meaning it cannot last longer than 48h. To achieve 60h, a new token must be created with explicit_max_ttl set to at least 60h. The existing token cannot be modified.

Answer

Increase the creation_ttl to 60h.

Answer

The token will expire after 48h, so increase explicit_max_ttl to 60h on the current token.

Answer

The token already can be used for 60h because it is renewable.

Question 10

A developer needs a token that can be used only 5 times and must expire after 24 hours, regardless of the number of uses. Which token creation method should be used to enforce these constraints?

Accepted Answer

Use a token role with num_uses=5 and ttl=24h. Option B is correct because token roles allow setting num_uses and ttl, which can be used together to enforce both limits. Option A is wrong because using the root token is insecure and doesn't enforce limits. Option C is wrong because setting num_uses alone doesn't enforce time limit. Option D is wrong because setting ttl alone doesn't enforce use limit.

Answer

Create a token directly with num_uses=5

Answer

Create a token directly with ttl=24h

Answer

Create a periodic token with period set to 24h

Question 11

Which THREE statements about token accessors are true?

Accepted Answer

They can be used to look up token metadata without the token ID. Token accessors are unique identifiers that can be used to look up token metadata and revoke tokens without the token ID. However, they cannot be used to renew tokens (requires token ID) and are not human-readable (they are UUIDs).

Answer

They can be used to renew the token

Answer

They are human-readable strings

Question 12

A user forgets to renew their token before it expires. What happens to the token and its associated leases?

Accepted Answer

The token is revoked and all its leases are revoked. Option C is correct because when a token expires, Vault automatically revokes it and all leases created by it. Option A is wrong because the token is not automatically renewed. Option B is wrong because the token is revoked, not just deactivated. Option D is wrong because the token cannot be used after expiration.

Answer

The token becomes invalid but can be renewed within a grace period

Answer

The token is automatically renewed for another period

Answer

The token remains active but read-only

Question 13

A CI/CD pipeline needs to generate thousands of short-lived tokens each day for jobs that run for at most 5 minutes. The tokens should not be renewable or revocable individually. Which token type should be used?

Accepted Answer

Batch tokens. Option D is correct because batch tokens are non-renewable, non-revocable, and suitable for high-volume, short-lived scenarios. Option A is wrong because service tokens are renewable and revocable, adding overhead. Option B is wrong because periodic tokens never expire unless explicitly revoked, which is not desired. Option C is wrong because orphan tokens are a property, not a type.

Answer

Orphan tokens

Answer

Service tokens

Answer

Periodic tokens

Question 14

An administrator needs to issue tokens that are automatically renewable by the client (so they can stay alive as long as renewed) but must expire no later than 30 days. Which TWO token parameters should be configured on the token role?

Accepted Answer

max_ttl. Period allows automatic renewal by extending the token's TTL by the period value each renewal, while max_ttl caps the total lifetime. TTL is the initial lifetime, but with period set, the token's TTL is derived from period. Renewable must be true (default for periodic tokens), but it is not needed to set explicitly. Num_uses is unrelated.

Answer

renewable

Answer

ttl

Answer

num_uses

Question 15

Which THREE of the following are correct about using the Vault API to read a secret from KV v2 engine?

Accepted Answer

The response JSON contains a 'data' key with the secret values. Option A is correct because the KV v2 engine returns secret data nested under a 'data' key in the JSON response. This is a deliberate design to separate metadata (e.g., version, created_time) from the actual secret values, which are placed under 'data.data'. The Vault API always uses GET for reading secrets from KV v2, making option B correct. Option E is correct because the KV v2 engine requires the path to include '/data/' after the mount point (e.g., /v1/secret/data/mysecret) to distinguish read operations from metadata or delete operations.

Answer

The API path is /v1/secret/mysecret

Answer

The HTTP method used is POST