VA-003 Assess Vault tokens — 10 Questions

Question 1

A large enterprise runs a microservices architecture on Kubernetes. Each microservice authenticates to Vault using the Kubernetes auth method with a service account token. The Vault administrator configured a role 'microservice-role' with a TTL of 24h and a max TTL of 48h. The microservices renew their tokens every 12 hours via a sidecar. Recently, the security team noticed that some tokens are still valid after 72 hours, causing a security concern. The audit logs show that the tokens were renewed successfully multiple times. The administrator reviews the role configuration and sees that 'token_renewable' is set to true. What is the most likely reason the tokens are exceeding the intended 48h max TTL?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Kubernetes auth method's default TTL overrides the role's max TTL. In Vault, when using the Kubernetes auth method, the token's max TTL is determined by the minimum of the role's max TTL and the auth method's default max TTL. However, if the role's max TTL is not explicitly set to a value lower than the auth method's default max TTL, the auth method's default can effectively become the limiting factor. In this case, the administrator set the role's max TTL to 48h, but if the Kubernetes auth method's default max TTL is higher (e.g., 72h or unlimited), and the role's max TTL is not properly enforced due to a configuration oversight, the token may remain valid beyond 48h. Option B correctly identifies that the auth method's default TTL (specifically default TTL or max TTL) can override the role's intended max TTL if not carefully configured.

Answer

The sidecar renewal interval is too short, causing the token to be renewed before the max TTL is checked

Answer

The Vault role's max TTL is not propagated to the token because the token was created with a different policy

Answer

The Kubernetes service account token used for authentication is long-lived, allowing the Vault token to be renewed indefinitely

Question 2

A DevOps team is using Vault tokens for authentication in CI/CD pipelines. They notice that tokens are often expired before the pipeline completes, causing failures. Which Vault feature should they use to address this without manual intervention?

Accepted Answer

Use periodic tokens with a short period and allow renewal. Periodic tokens are designed for long-running processes like CI/CD pipelines. They have no maximum TTL and can be renewed indefinitely as long as the renewal occurs before the current token's TTL expires. By using a periodic token with a short period and enabling automatic renewal in the pipeline, the token stays valid without manual intervention, solving the expiration issue.

Answer

Use batch tokens for better performance

Answer

Create orphan tokens so they don't expire with the parent

Answer

Increase the default TTL on the token auth method

Question 3

An application uses a Vault token with a policy that grants read access to secrets. The security team wants to ensure that if the application is compromised, the token cannot be used after a certain time even if the attacker has the token. What is the best approach?

Accepted Answer

Set a short TTL on the token and do not allow renewal. Setting a short TTL on the token and disallowing renewal ensures that the token automatically expires after a fixed, short duration. Even if an attacker compromises the token, they cannot extend its lifetime, limiting the window of exposure. This directly meets the security requirement of preventing token use beyond a certain time without relying on external revocation mechanisms.

Answer

Use a revocation script that runs periodically

Answer

Set explicit max TTL on the token

Answer

Use a periodic token with a long period

Question 4

A developer created a token and wants to ensure that the token can only be used to read secrets from the 'secret/data/production' path. Which policy attachment approach should be used?

Accepted Answer

Create a policy with read capability on 'secret/data/production' and attach it to the token. Vault uses policies to define fine-grained access control, and the only way to restrict a token to read secrets from a specific path is to create a policy with the appropriate capabilities (e.g., 'read' on 'secret/data/production') and attach that policy to the token at creation time. Tokens themselves do not inherently carry path restrictions; they inherit permissions solely from attached policies.

Answer

Set the token's metadata to restrict access

Answer

Use a root token and restrict its use via a policy

Answer

Set the token type to service and it will automatically restrict access

Question 5

A Vault administrator wants to allow a CI/CD pipeline to create short-lived tokens for deployment jobs. The pipeline itself authenticates with a periodic token. Which token type should the pipeline use to create tokens for jobs, considering the jobs need to be independent and not affected by the pipeline token's lifecycle?

Accepted Answer

Orphan tokens. Orphan tokens are the correct choice because they allow the CI/CD pipeline to create child tokens that are not tied to the parent token's lifecycle. When a periodic token creates an orphan token, the child token remains valid even if the parent token is revoked or expires, ensuring deployment jobs are independent and not affected by the pipeline token's lifecycle.

Answer

Service tokens with explicit max TTL

Answer

Periodic tokens

Answer

Batch tokens

Question 6

An organization uses Vault with AWS IAM auth. After rotating the AWS IAM role credentials, users are unable to authenticate with Vault. The Vault audit logs show 'permission denied' for the AWS auth method. What is the most likely cause?

Accepted Answer

The AWS secret engine is disabled. After rotating AWS IAM role credentials, the most likely cause of authentication failure is that the AWS secret engine was disabled during the rotation process. The 'permission denied' error in audit logs indicates the auth method is not enabled. While credential rotation itself does not directly cause engine disablement, it is possible that maintenance activities disabled it. Options A, B, and C are unrelated: trust policies do not contain credentials, token TTL and revocation affect client tokens, not the auth method.

Answer

The IAM role trust policy was not updated after credential rotation

Answer

The Vault token TTL expired

Answer

The client token used for AWS auth is revoked

Question 7

A Vault user wants to check the capabilities of their token on a specific path. Which command should they use?

Accepted Answer

vault token capabilities <path>. The `vault token capabilities` command is specifically designed to check what operations (e.g., read, create, update, delete, list) a given token is allowed to perform on a particular path. It evaluates the token's attached policies against the path and returns the effective capabilities, making it the correct tool for this task.

Answer

vault token list

Answer

vault policy capabilities

Answer

vault token lookup <token>

Question 8

A security analyst discovers that a token used by a legacy application is still active long after the application was decommissioned. Which Vault feature should have been used to automatically expire tokens when the application is no longer running?

Accepted Answer

Set a TTL on the token. Setting a Time-To-Live (TTL) on the token ensures it automatically expires after a specified duration, even if the application is decommissioned. This prevents orphaned tokens from remaining active indefinitely, which is a security risk. Vault's TTL mechanism is designed to enforce token lifetime limits without requiring manual intervention.

Answer

Enable token renewal to keep it alive

Answer

Use a periodic token and revoke it manually

Answer

Use a batch token to limit its lifetime

Question 9

An administrator wants to ensure that a token created by a user cannot be used after 24 hours, even if the user tries to renew it. What should the administrator do?

Accepted Answer

Set explicit max TTL on the token to 24h. Setting an explicit max TTL on the token to 24h ensures that the token's lifetime cannot be extended beyond 24 hours, even if the user attempts to renew it. In Vault, the `explicit_max_ttl` parameter overrides any renewal requests, enforcing a hard upper limit on the token's validity. This directly addresses the requirement that the token cannot be used after 24 hours, regardless of renewal attempts.

Answer

Use a periodic token with a period of 24h

Answer

Create an orphan token with a TTL of 24h

Answer

Use a batch token

Question 10

Which TWO of the following are valid methods to revoke a Vault token?

Accepted Answer

vault token revoke . `vault token revoke ` is the direct command to revoke a specific Vault token by its token value. This invalidates the token immediately, preventing any further use. Option D is correct because `vault token revoke -accessor ` revokes a token using its accessor, which is a non-sensitive identifier that can be used to manage tokens without exposing the token itself.

Answer

vault secrets disable <path>

Answer

vault auth disable <path>

Answer

vault policy delete <name>