VA-003 Assess Vault tokens Practice Test 2 — 15 Questions

Question 1

An engineer wants to list all tokens associated with a specific token accessor. Which API endpoint should be used?

Accepted Answer

auth/token/lookup-accessor. The correct endpoint is `auth/token/lookup-accessor`. This endpoint is used to retrieve the details of a single token given its accessor. A token accessor is a non-sensitive reference that allows operations like lookup and revocation without exposing the token ID. The other options are incorrect: `auth/token/accessors/` is not a valid Vault endpoint; `auth/token/lookup` retrieves token details using the token itself or its accessor, but not specifically by accessor; and `auth/token/list` lists all token accessors but does not retrieve details for a specific accessor.

Answer

auth/token/accessors/

Answer

auth/token/lookup

Answer

auth/token/list

Question 2

Which THREE of the following are valid parameters when creating a token via the API?

Accepted Answer

num_uses. When creating a token via the Vault API (POST /v1/auth/token/create), the valid parameters include num_uses (A), which sets the maximum number of times the token can be used before it is revoked; ttl (B), which specifies the token's time-to-live as a duration string such as "1h"; and policies (C), which is a list of policies to attach to the token. These three are all accepted fields in the token creation request body and directly control the token's usage limit, lifetime, and authorization scope. In contrast, accessor (D) is a read-only identifier generated by Vault and returned in the token lookup response, not a parameter that can be supplied at creation time. Likewise, max_ttl (E) is not a settable parameter on token creation; the token's maximum lifetime is governed by the system or mount max_ttl, not by a request field.

Answer

accessor

Answer

max_ttl

Question 3

Based on the exhibit, what is the maximum lifetime of this token?

Accepted Answer

The token will expire at expire_time unless renewed. The token will expire at the absolute timestamp shown in `expire_time` unless it is renewed before that time. While `max_ttl` (not displayed in the exhibit) defines the absolute maximum lifetime if the token is repeatedly renewed, the token's current expiration is `expire_time`. Therefore, given the options, the token will expire at that time unless renewed.

Answer

720 hours

Answer

The max TTL is shown as 'ttl' and cannot exceed that

Answer

The token is valid indefinitely because it is renewable

Question 4

An administrator creates a token role with 'allowed_policies' and tries to create a child token. What does this error indicate?

Accepted Answer

The token role's token_count_limit has been reached. The error 'token count per user (3) exceeded' indicates that the number of tokens issued for that entity (user or role) has exceeded the maximum allowed, which is controlled by the 'token_count_limit' parameter in the token role. Option D correctly identifies this limit as the cause. Option A is irrelevant because revocation count is not involved. Option B is incorrect because the error is about token count, not TTL. Option C is incorrect because the error is about quantity, not policy permissions.

Answer

The token has been revoked too many times

Answer

The token's TTL is too short

Answer

The token's policy is not allowed by the role

Question 5

A DevOps engineer notices that a long-running application using a Vault token fails after 24 hours. The token was created with a TTL of 48h. The token role has a default TTL of 48h and a max TTL of 72h. What is the most likely cause of the failure?

Accepted Answer

The mount's max TTL for the token is 24h, overriding the role's setting.. The most likely cause is that the mount's max TTL for the token is set to 24h, which overrides the role's max TTL of 72h. In Vault, the effective TTL of a token is the minimum of the role's TTL, the mount's max TTL, and the system's max TTL. Since the token fails exactly after 24 hours, the mount's max TTL of 24h is the limiting factor, causing the token to expire even though the role allows up to 48h.

Answer

The token was manually revoked by an administrator.

Answer

The token was revoked due to a policy violation.

Answer

The token is a batch token and cannot be renewed.

Question 6

A team needs to issue unique tokens to each of 100 microservices, each with its own policy, and ensure that revoking one token does not affect others. Which token feature should they use?

Accepted Answer

Token roles with distinct policies. Vault token roles allow you to define distinct policies per token, ensuring each microservice gets a unique token with its own policy. When a token is revoked, only that specific token is invalidated, leaving all others unaffected. This satisfies the requirement for independent revocation without impacting other services.

Answer

Periodic tokens

Answer

Orphan tokens

Answer

Token accessors

Question 7

Which TWO statements about batch tokens are true?

Accepted Answer

They are lightweight and support a high creation rate.. Batch tokens are lightweight, non-persistent tokens designed for high-volume, high-creation-rate scenarios, so option A is correct because they avoid the storage overhead of service tokens and can be created at scale. Option B is also correct because batch tokens cannot be used with a use-limit; use limits apply to service tokens, and batch tokens are not tracked for limited uses. Options C, D, and E are incorrect because batch tokens do not support an explicit max TTL, do not have a TTL in the same way service tokens do, and are not renewable; they have a fixed lifetime determined by the batch token's TTL setting and cannot be renewed.

Answer

They support explicit max TTL.

Answer

They have a TTL.

Answer

They are renewable.

Question 8

Which TWO methods can be used to revoke a token without knowing the token ID?

Accepted Answer

Using `vault token revoke -mode path` on the auth mount.. Option B is correct because `vault token revoke -mode path` revokes all tokens issued by a specific auth method mount path (for example, `auth/userpass`), and this operation does not require knowing any individual token ID. Option E is correct because every token has an accessor, a unique identifier that can be used with `vault token revoke <accessor>` to revoke the token without exposing or knowing the token ID itself. Option A is incorrect because a role name identifies a role, not a specific token, and Vault does not provide a revoke-by-role-name operation. Option C is incorrect because policies are attached to tokens but are not unique token identifiers, so they cannot be used to revoke a single token. Option D is incorrect because creation time is metadata, not a revocable token identifier, and Vault has no command to revoke tokens by creation time.

Answer

Using the token's role name if it has one.

Answer

Using the token's policy name.

Answer

Using the token's creation time.

Question 9

Which THREE factors influence the maximum TTL of a token?

Accepted Answer

The max TTL of the auth method or mount.. The maximum TTL of a token is bounded by the max TTL configured on the auth method or mount (option B), because tokens issued through that mount cannot outlive the mount's own max lease/TTL ceiling. It is also bounded by the max TTL set on the token role (option D), since the role's max_ttl caps how long tokens created under that role may be renewed or remain valid. Finally, the system's default max TTL (option E), typically 32 days, acts as the global upper bound when no more specific max TTL overrides it, so it can limit the token's maximum lifetime. Option A is incorrect because the role's TTL (not max TTL) sets the initial lease duration, not the maximum ceiling. Option C is incorrect because the token's current TTL is a remaining-lifetime value, not a factor that determines the maximum TTL.

Answer

The TTL set on the token role.

Answer

The token's current TTL.

Question 10

Refer to the exhibit. An admin wants to ensure this token can be used for 60 hours total. Which action should be taken?

Accepted Answer

Create a new token with explicit_max_ttl=60h.. The token's current `explicit_max_ttl` is set to 48h, and the `creation_ttl` (24h) cannot be increased beyond that bound. To achieve a total lifetime of 60 hours, a new token must be created with `explicit_max_ttl=60h`, which overrides the default or role-based TTL limits and sets the absolute maximum lifetime for the token.

Answer

Increase the creation_ttl to 60h.

Answer

The token will expire after 48h, so increase explicit_max_ttl to 60h on the current token.

Answer

The token already can be used for 60h because it is renewable.

Question 11

A developer needs a token that can be used only 5 times and must expire after 24 hours, regardless of the number of uses. Which token creation method should be used to enforce these constraints?

Accepted Answer

Use a token role with num_uses=5 and ttl=24h. A token role with both `num_uses=5` and `ttl=24h` enforces both constraints: the token can be used only 5 times and will expire after 24 hours, regardless of which limit is reached first. Creating a token directly with only `num_uses` or only `ttl` would miss one constraint, and a periodic token ignores the `num_uses` limit entirely.

Answer

Create a token directly with num_uses=5

Answer

Create a token directly with ttl=24h

Answer

Create a periodic token with period set to 24h

Question 12

An organization uses Vault's token auth method to issue tokens for long-running services. They want to ensure that tokens are automatically revoked after 30 days, even if the service repeatedly renews them. Which token role configuration achieves this?

Accepted Answer

Set max_ttl to 720h on the token role. Setting `max_ttl` to 720h (30 days) on the token role enforces an absolute upper lifetime for the token, regardless of how many times it is renewed. This ensures the token is automatically revoked after 30 days, even if the service repeatedly renews it before the current TTL expires.

Answer

Set ttl to 720h without setting max_ttl

Answer

Set explicit_max_ttl to 720h on the token role

Answer

Set period to 720h without setting max_ttl

Question 13

A security team wants to issue tokens that can be used for exactly 10 API calls, after which they must be renewed. Which two token parameters should be set on the token role?

Accepted Answer

ttl and renewable. To meet the requirement that tokens can be used for exactly 10 API calls and then be renewed, you must avoid setting `num_uses` because tokens with `num_uses` set cannot be renewed. Instead, set `ttl` to a short duration (e.g., 1 minute) and `renewable` to true. This allows the token to be used for a limited time (though not exactly 10 calls) and be renewed repeatedly. While this does not enforce exactly 10 calls, it aligns with the constraint that `num_uses` prevents renewal, making this the only viable pair among the options.

Answer

period and num_uses

Answer

ttl and num_uses

Answer

num_uses and renewable

Question 14

An administrator needs to issue tokens that are automatically renewable by the client (so they can stay alive as long as renewed) but must expire no later than 30 days. Which TWO token parameters should be configured on the token role?

Accepted Answer

max_ttl. (max_ttl) is correct because it enforces the absolute maximum lifetime of the token, ensuring it expires no later than 30 days regardless of renewals. Option D (period) is correct because setting a period makes the token automatically renewable by the client, allowing it to stay alive as long as it is renewed before the period expires. Together, period enables automatic renewal behavior and max_ttl caps the total lifespan at 30 days.

Answer

renewable

Answer

ttl

Answer

num_uses

Question 15

Which THREE statements about token accessors are true?

Accepted Answer

They can be used to look up token metadata without the token ID. Option A is correct because a token accessor is a value that lets you look up a token's metadata (such as its policies, TTL, and creation time) via the token accessor API without ever exposing or knowing the token ID itself. Option B is correct because Vault's token accessor supports renewing the associated token through the auth/token/renew-accessor endpoint, allowing renewal without possessing the actual token. Option C is correct because the accessor can also revoke the token via auth/token/revoke-accessor, which is useful for administrators to invalidate tokens they don't directly hold. Option E is correct because each token is issued a unique accessor value that is distinct from the token ID, so it serves as a unique identifier for that token. Option D is not correct because token accessors are randomly generated opaque strings (e.g., a UUID-like value), not human-readable or descriptive strings.

Answer

They are human-readable strings