VA-003 Assess Vault tokens — 20 Questions

Question 1

An organization uses Vault with AWS IAM auth. After rotating the AWS IAM role credentials, users are unable to authenticate with Vault. The Vault audit logs show 'permission denied' for the AWS auth method. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The AWS secret engine is disabled. After rotating AWS IAM role credentials, the most likely cause of authentication failure is that the AWS secret engine was disabled during the rotation process. The 'permission denied' error in audit logs indicates the auth method is not enabled. While credential rotation itself does not directly cause engine disablement, it is possible that maintenance activities disabled it. Options A, B, and C are unrelated: trust policies do not contain credentials, token TTL and revocation affect client tokens, not the auth method.

Answer

The IAM role trust policy was not updated after credential rotation

Answer

The Vault token TTL expired

Answer

The client token used for AWS auth is revoked

Question 2

Which TWO of the following are valid methods to revoke a Vault token?

Accepted Answer

vault token revoke . Option A, `vault token revoke `, is correct because it is the canonical Vault CLI command that immediately revokes the specified token by its token ID, invalidating it and any child tokens. Option D, `vault token revoke -accessor `, is also correct because Vault supports revoking a token by its accessor ID, which is useful when the token value itself is unknown but its accessor is available. Option B, `vault secrets disable `, is wrong because it disables a secrets engine at a path, not a token, though it may revoke leases associated with that engine. Option C, `vault auth disable `, is wrong because it disables an auth method, which revokes tokens issued by that method but is not itself a token revocation command. Option E, `vault policy delete `, is wrong because it deletes a policy definition and does not revoke any tokens.

Answer

vault secrets disable <path>

Answer

vault auth disable <path>

Answer

vault policy delete <name>

Question 3

Which THREE of the following are true about batch tokens?

Accepted Answer

They have a TTL that must be set at creation. Option B is correct because batch tokens require a TTL to be specified at creation time; unlike service tokens, they cannot rely on a default or inherited TTL and must have an explicit lifetime. Option C is correct because batch tokens are non-renewable — once issued, their TTL cannot be extended via token renewal, and they simply expire at the end of their fixed lifetime. Option E is correct because batch tokens are lightweight: they are not persisted in Vault's storage backend, so they incur no storage cost and are ideal for high-volume, short-lived workloads. Option A is not correct because batch tokens cannot be created as orphan tokens; orphan tokens are a feature of service tokens, and batch tokens always have a parent. Option D is not correct because batch tokens are never root tokens; root tokens are a distinct, highly privileged type of service token, and batch tokens cannot carry root policy.

Answer

They can be created as orphan tokens

Answer

They are always root tokens

Question 4

Which TWO of the following are valid token states?

Accepted Answer

Revoked. In token lifecycle management, a token can be in an Active state (E), meaning it is currently valid and usable for authentication or authorization, and a Revoked state (D), meaning it has been explicitly invalidated before its natural expiration. These two states are standard in token state models such as those used by OAuth 2.0 token introspection (RFC 7662), where the 'active' field indicates whether a token is currently valid, and revocation is a defined operation in RFC 7009. Expired (A) describes a condition that occurs when a token's lifetime elapses, but it is typically treated as a sub-case of being inactive rather than a distinct managed state in most token state machines. Orphan (B) is not a recognized token state in standard token lifecycle models. Suspended (C) is not a standard token state; while accounts or sessions may be suspended, tokens themselves are typically active, revoked, or expired.

Answer

Expired

Answer

Orphan

Answer

Suspended

Question 5

Which THREE of the following are valid sources of token TTL?

Accepted Answer

System default TTL. In Vault, a token's TTL can come from three valid sources: the system default TTL (A), which applies when no other TTL is specified and is set via the mount tuning or the global default lease TTL; an explicit TTL set during token creation (D), which overrides other values when a client passes a ttl parameter to the token create API; and a role TTL in an auth method (E), such as the token_ttl configured on a Kubernetes, AppRole, or AWS auth role, which is applied when a token is issued through that role. Mount path configuration (B) is not a token TTL source — mount tuning controls lease TTLs for secrets engines, not tokens. Policy TTL (C) does not exist as a token TTL source; policies define permissions, not TTLs, and Vault has no policy-level TTL setting.

Answer

Mount path configuration

Answer

Policy TTL

Question 6

A large enterprise runs a microservices architecture on Kubernetes. Each microservice authenticates to Vault using the Kubernetes auth method with a service account token. The Vault administrator configured a role 'microservice-role' with a TTL of 24h and a max TTL of 48h. The microservices renew their tokens every 12 hours via a sidecar. Recently, the security team noticed that some tokens are still valid after 72 hours, causing a security concern. The audit logs show that the tokens were renewed successfully multiple times. The administrator reviews the role configuration and sees that 'token_renewable' is set to true. What is the most likely reason the tokens are exceeding the intended 48h max TTL?

Accepted Answer

The Kubernetes auth method's default TTL overrides the role's max TTL. In Vault, when using the Kubernetes auth method, the token's max TTL is determined by the minimum of the role's max TTL and the auth method's default max TTL. However, if the role's max TTL is not explicitly set to a value lower than the auth method's default max TTL, the auth method's default can effectively become the limiting factor. In this case, the administrator set the role's max TTL to 48h, but if the Kubernetes auth method's default max TTL is higher (e.g., 72h or unlimited), and the role's max TTL is not properly enforced due to a configuration oversight, the token may remain valid beyond 48h. Option B correctly identifies that the auth method's default TTL (specifically default TTL or max TTL) can override the role's intended max TTL if not carefully configured.

Answer

The sidecar renewal interval is too short, causing the token to be renewed before the max TTL is checked

Answer

The Vault role's max TTL is not propagated to the token because the token was created with a different policy

Answer

The Kubernetes service account token used for authentication is long-lived, allowing the Vault token to be renewed indefinitely

Question 7

Which TWO of the following scenarios require the use of a periodic token?

Accepted Answer

A batch job that must continue running even if the parent token is revoked.. Option C is correct because a periodic token in Vault is designed to survive the revocation of its parent token, allowing a batch job to keep running even if the parent token is revoked. Option E is correct because periodic tokens can be renewed indefinitely (up to a maximum TTL) as long as the token is renewed before expiration, which suits a long-running application that needs continuous renewal. Option A is incorrect because a token with TTL 0 and no expiration is a root or non-expiring token, not a periodic token. Option B is incorrect because multiple sessions for a human operator are typically handled by a token with a normal TTL or a token role, not specifically a periodic token. Option D is incorrect because the property of not being revoked when the parent is revoked is exactly what a periodic token provides, but the option as worded describes a general orphan token behavior; however, the question asks for scenarios requiring a periodic token, and D alone does not capture the renewal requirement that distinguishes periodic tokens.

Answer

A token that never expires and has a TTL of 0.

Answer

A human operator who needs a token that can be used for multiple sessions.

Answer

A token that should not be revoked when the token that created it is revoked.

Question 8

Your company uses Vault to manage secrets for a fleet of microservices running on Kubernetes. Each microservice has a service account that authenticates to Vault using the Kubernetes auth method and receives a token with a policy granting access to its secrets. Recently, the team noticed that some tokens are being revoked prematurely, causing services to lose access to secrets. The tokens are created with a TTL of 24 hours and are set to be renewable. The Vault servers are configured with a default max_ttl of 24 hours. The tokens are renewed by the client libraries every 12 hours. Despite this, tokens are sometimes invalid before 24 hours. What should the team do to prevent this issue?

Accepted Answer

Increase the max_ttl on the token role to 48 hours to allow renewal beyond 24 hours.. The tokens are being revoked prematurely due to the Vault server's default max_ttl of 24 hours. Even though the token TTL is 24 hours and the client renews every 12 hours, the max_ttl caps the total lifetime of the token, including renewals. By increasing the max_ttl on the token role to 48 hours, the token can be renewed beyond the initial 24-hour window, preventing premature invalidation.

Answer

Set the token's num_uses to a high number to prevent premature revocation.

Answer

Change the tokens to periodic tokens so they never expire.

Answer

Decrease the token TTL to 12 hours so that renewal happens before the max_ttl is reached.

Question 9

A DevOps team is troubleshooting token access in Vault. They need to determine which of the following token operations require sudo capability. Which TWO operations require sudo capability?

Accepted Answer

Revoke a token. Option D (Revoke a token) is correct because in Vault, revoking tokens—especially tokens other than your own—requires the sudo capability on the auth/token/revoke endpoint, since it is a privileged administrative action that can invalidate credentials belonging to other clients. Option E (Access a token's capabilities against a path) is correct because querying another token's capabilities via the sys/capabilities-accessor endpoint requires sudo, as it exposes the effective permissions of a token you do not own. Option A (Create a token) is incorrect because creating tokens is governed by the token creation policy (e.g., auth/token/create permissions) rather than requiring sudo. Option B (Renew a token) is incorrect because renewing a token only requires permission on the renew endpoint and does not need sudo. Option C (Read token accessor information) is incorrect because looking up token accessor metadata requires read permission on auth/token/accessors, not sudo.

Answer

Create a token

Answer

Renew a token

Answer

Read token accessor information

Question 10

A large enterprise runs Vault in a production environment with hundreds of applications. Each application uses a unique Vault token with a 30-day TTL. The tokens are created by a central CI/CD pipeline using Vault's token auth method. Recently, the security team noticed that several tokens with suspicious activity have been created with a 90-day TTL, and the tokens appear to be long-lived and not revoked after use. The CI/CD pipeline logs show no anomalies. The audit logs reveal that the tokens in question were created by a human user 'jdoe' using a token with the 'admin' policy. The 'admin' policy grants '*' capabilities on all paths. The Vault token accessor shows that the suspicious tokens have a 'creation_ttl' of 2160h (90 days) and 'explicit_max_ttl' of 0s. The Vault configuration uses a default lease TTL of 24h and a max lease TTL of 720h (30 days). Which action should the security team take to prevent such incidents in the future without breaking existing applications?

Accepted Answer

Create a dedicated token role with a max TTL of 720h (30 days) and restrict token creation to that role; revoke the 'admin' policy's create permission on auth/token/create.. The root cause is that the 'admin' policy grants unrestricted token creation permissions, allowing a human user to bypass the intended CI/CD pipeline controls and create tokens with a 90-day TTL. By creating a dedicated token role with a max TTL of 720h (30 days) and revoking the 'admin' policy's create permission on 'auth/token/create', the team enforces a maximum TTL of 30 days for all tokens created via the token auth method, matching the system's max lease TTL and preventing long-lived tokens without breaking existing applications that use the CI/CD pipeline.

Answer

Remove the 'admin' policy from all human users and require them to use a different authentication method.

Answer

Implement a Sentinel policy that blocks token creation by any user except the CI/CD pipeline.

Answer

Reduce the system max lease TTL to 720h (30 days) and enforce that all tokens must have explicit_max_ttl set.

Question 11

Match each Vault seal type to its description.

Accepted Answer

Shamir seal: Uses Shamir's secret sharing to split the master key into key shares distributed to operators. The correct matches are: Shamir seal uses secret sharing; AWS KMS seal uses AWS KMS; HSM seal uses a hardware module. Common confusions involve swapping cloud-based seals with Shamir or HSM.

Answer

Shamir seal: Uses AWS KMS to encrypt/decrypt the master key

Answer

AWS KMS seal: Uses Shamir's secret sharing to split the master key into shares

Question 12

A DevOps team generates a large number of short-lived tokens for automated deployments. They want to minimize storage overhead and avoid the need for token revocation. Which token type should they use?

Accepted Answer

Batch tokens. Batch tokens are the correct choice because they are designed for high-frequency, short-lived workloads where storage overhead and revocation are concerns. They are created by a parent token, have a configurable TTL (often minutes), and are never stored in Vault's storage backend, eliminating the need for revocation and reducing storage footprint.

Answer

Periodic tokens

Answer

Orphan tokens

Answer

Service tokens

Question 13

An application's token is failing to renew, and the logs show 'token not renewable'. The token was created with a TTL of 24h and no explicit max TTL. What is the most likely cause?

Accepted Answer

The token was created with the renewable flag set to false. The error 'token not renewable' occurs when a token is created with the `renewable` flag explicitly set to `false`. Even though the token has a TTL of 24h and no explicit max TTL, the absence of the renewable flag means the token cannot be renewed at all. Vault tokens are renewable by default, but if the application or operator sets `renewable=false` during creation, the token will expire after its TTL and cannot be extended.

Answer

The token has been renewed too many times, exceeding its TTL

Answer

The token accessor is invalid

Answer

The token's max TTL has been reached

Question 14

A development team needs tokens that can be renewed automatically as long as they are still in use, up to a maximum lifetime of 72 hours. Which token type and configuration should be used?

Accepted Answer

Service token with a TTL of 1h and max TTL of 72h. A service token with a TTL of 1 hour and a max TTL of 72 hours allows automatic renewal as long as the token is still in use, up to the maximum lifetime of 72 hours. This configuration ensures that the token's TTL is extended on each use, preventing expiration during active sessions while enforcing an absolute upper limit.

Answer

Periodic token with a TTL of 72h

Answer

Orphan token with a TTL of 1h

Answer

Batch token with a TTL of 72h

Question 15

A periodic token is created with a TTL of 30 days. After 60 days, the token is still in use but suddenly stops working. What is the most likely reason?

Accepted Answer

The token was revoked manually or by an administrator. The token's TTL (time-to-live) of 30 days determines how long it is valid from its creation or last renewal, but it does not set an absolute maximum lifetime. After 60 days, the token would have been renewed or used periodically, so it should still be valid unless an external action invalidated it. Manual revocation by an administrator or via a revocation endpoint is the most likely cause for a token that was working but suddenly stops, as it overrides any TTL-based expiration.

Answer

The token exceeded its max TTL of 60 days

Answer

The token reached its default max TTL of 32 days

Answer

The token's explicit_max_ttl was set to a value less than 60 days

Question 16

An engineer wants to list all tokens associated with a specific token accessor. Which API endpoint should be used?

Accepted Answer

auth/token/lookup-accessor. The correct endpoint is `auth/token/lookup-accessor`. This endpoint is used to retrieve the details of a single token given its accessor. A token accessor is a non-sensitive reference that allows operations like lookup and revocation without exposing the token ID. The other options are incorrect: `auth/token/accessors/` is not a valid Vault endpoint; `auth/token/lookup` retrieves token details using the token itself or its accessor, but not specifically by accessor; and `auth/token/list` lists all token accessors but does not retrieve details for a specific accessor.

Answer

auth/token/accessors/

Answer

auth/token/lookup

Answer

auth/token/list

Question 17

Which THREE of the following are valid parameters when creating a token via the API?

Accepted Answer

num_uses. When creating a token via the Vault API (POST /v1/auth/token/create), the valid parameters include num_uses (A), which sets the maximum number of times the token can be used before it is revoked; ttl (B), which specifies the token's time-to-live as a duration string such as "1h"; and policies (C), which is a list of policies to attach to the token. These three are all accepted fields in the token creation request body and directly control the token's usage limit, lifetime, and authorization scope. In contrast, accessor (D) is a read-only identifier generated by Vault and returned in the token lookup response, not a parameter that can be supplied at creation time. Likewise, max_ttl (E) is not a settable parameter on token creation; the token's maximum lifetime is governed by the system or mount max_ttl, not by a request field.

Answer

accessor

Answer

max_ttl

Question 18

Based on the exhibit, what is the maximum lifetime of this token?

Accepted Answer

The token will expire at expire_time unless renewed. The token will expire at the absolute timestamp shown in `expire_time` unless it is renewed before that time. While `max_ttl` (not displayed in the exhibit) defines the absolute maximum lifetime if the token is repeatedly renewed, the token's current expiration is `expire_time`. Therefore, given the options, the token will expire at that time unless renewed.

Answer

720 hours

Answer

The max TTL is shown as 'ttl' and cannot exceed that

Answer

The token is valid indefinitely because it is renewable

Question 19

An administrator creates a token role with 'allowed_policies' and tries to create a child token. What does this error indicate?

Accepted Answer

The token role's token_count_limit has been reached. The error 'token count per user (3) exceeded' indicates that the number of tokens issued for that entity (user or role) has exceeded the maximum allowed, which is controlled by the 'token_count_limit' parameter in the token role. Option D correctly identifies this limit as the cause. Option A is irrelevant because revocation count is not involved. Option B is incorrect because the error is about token count, not TTL. Option C is incorrect because the error is about quantity, not policy permissions.

Answer

The token has been revoked too many times

Answer

The token's TTL is too short

Answer

The token's policy is not allowed by the role

Question 20

A DevOps engineer notices that a long-running application using a Vault token fails after 24 hours. The token was created with a TTL of 48h. The token role has a default TTL of 48h and a max TTL of 72h. What is the most likely cause of the failure?

Accepted Answer

The mount's max TTL for the token is 24h, overriding the role's setting.. The most likely cause is that the mount's max TTL for the token is set to 24h, which overrides the role's max TTL of 72h. In Vault, the effective TTL of a token is the minimum of the role's TTL, the mount's max TTL, and the system's max TTL. Since the token fails exactly after 24 hours, the mount's max TTL of 24h is the limiting factor, causing the token to expire even though the role allows up to 48h.

Answer

The token was manually revoked by an administrator.

Answer

The token was revoked due to a policy violation.

Answer

The token is a batch token and cannot be renewed.