VA-003 Assess Vault tokens Practice Test 3 — 15 Questions

Question 1

A periodic token is created with a TTL of 30 days. After 60 days, the token is still in use but suddenly stops working. What is the most likely reason?

Accepted Answer

The token was revoked manually or by an administrator. The token's TTL (time-to-live) of 30 days determines how long it is valid from its creation or last renewal, but it does not set an absolute maximum lifetime. After 60 days, the token would have been renewed or used periodically, so it should still be valid unless an external action invalidated it. Manual revocation by an administrator or via a revocation endpoint is the most likely cause for a token that was working but suddenly stops, as it overrides any TTL-based expiration.

Answer

The token exceeded its max TTL of 60 days

Answer

The token reached its default max TTL of 32 days

Answer

The token's explicit_max_ttl was set to a value less than 60 days

Question 2

An engineer wants to list all tokens associated with a specific token accessor. Which API endpoint should be used?

Accepted Answer

auth/token/lookup-accessor. The correct endpoint is `auth/token/lookup-accessor`. This endpoint is used to retrieve the details of a single token given its accessor. A token accessor is a non-sensitive reference that allows operations like lookup and revocation without exposing the token ID. The other options are incorrect: `auth/token/accessors/` is not a valid Vault endpoint; `auth/token/lookup` retrieves token details using the token itself or its accessor, but not specifically by accessor; and `auth/token/list` lists all token accessors but does not retrieve details for a specific accessor.

Answer

auth/token/accessors/

Answer

auth/token/lookup

Answer

auth/token/list

Question 3

A token is created with policies 'default' and 'web-app'. Later, a parent token's policy is updated to add 'logging'. The child token's policies are not updated. What will happen when the child token is used?

Accepted Answer

The child token will still have only 'default' and 'web-app' policies. In Vault, child tokens inherit the policies of their parent at the time of creation, but subsequent changes to the parent's policies do not propagate to existing child tokens. The child token retains its original policy set ('default' and 'web-app') because policies are evaluated based on the token's own metadata, not the parent's current state. This behavior is by design to ensure token immutability and prevent unintended privilege escalation.

Answer

The child token will be automatically renewed to pick up the new policy

Answer

The child token will automatically gain the 'logging' policy

Answer

The child token will be invalidated due to policy mismatch

Question 4

Which TWO of the following are true about token accessors?

Accepted Answer

Accessors should be used in audit logs instead of token values. Token accessors are designed to be used in audit logs as a safe alternative to the actual token value. This prevents sensitive token data from being exposed in logs while still allowing correlation of events to a specific token. Option C is correct because an accessor is a unique identifier that references a token without revealing the token's secret value.

Answer

Accessors are the token value

Answer

Accessors can be used to renew the token

Question 5

Which THREE of the following are valid parameters when creating a token via the API?

Accepted Answer

num_uses. When creating a token via the Vault API, valid parameters include `num_uses` to set the number of times the token can be used, `ttl` to set the time-to-live, and `policies` to attach policies. `max_ttl` is not a direct input parameter; it is a property that may be inherited from the role or mount configuration. `accessor` is a read-only field returned in the response, not an input parameter.

Answer

accessor

Answer

max_ttl

Question 6

Which TWO statements are true about batch tokens?

Accepted Answer

Batch tokens cannot be renewed or revoked. Batch tokens are designed to be lightweight and do not support renewal or revocation. They are not persisted in Vault's storage backend; instead, they are generated on-the-fly using a keyed hash (HMAC) and validated by the server without storing them. This makes them ideal for high-frequency, short-lived workloads where the overhead of managing a full token lifecycle is undesirable.

Answer

Batch tokens can be renewed to extend their lifetime

Answer

Batch tokens can be looked up using the lookup endpoint

Question 7

Based on the exhibit, what is the maximum lifetime of this token?

Accepted Answer

The token will expire at expire_time unless renewed. The token will expire at the absolute timestamp shown in `expire_time` unless it is renewed before that time. While `max_ttl` (not displayed in the exhibit) defines the absolute maximum lifetime if the token is repeatedly renewed, the token's current expiration is `expire_time`. Therefore, given the options, the token will expire at that time unless renewed.

Answer

720 hours

Answer

The max TTL is shown as 'ttl' and cannot exceed that

Answer

The token is valid indefinitely because it is renewable

Question 8

An administrator creates a token role with 'allowed_policies' and tries to create a child token. What does this error indicate?

Accepted Answer

The token role's token_count_limit has been reached. The error 'token count per user (3) exceeded' indicates that the number of tokens issued for that entity (user or role) has exceeded the maximum allowed, which is controlled by the 'token_count_limit' parameter in the token role. Option D correctly identifies this limit as the cause. Option A is irrelevant because revocation count is not involved. Option B is incorrect because the error is about token count, not TTL. Option C is incorrect because the error is about quantity, not policy permissions.

Answer

The token has been revoked too many times

Answer

The token's TTL is too short

Answer

The token's policy is not allowed by the role

Question 9

A token with the above policy attempts to look up its own token by calling the accessor endpoint. What will happen?

Accepted Answer

The operation fails with a permission denied error. The policy grants sudo on 'auth/token/lookup', but the endpoint for lookup by accessor is 'auth/token/lookup-accessor', which is a different path. Therefore, this policy does not allow that operation. Option A is wrong because the path is different. Option C is wrong because the policy does not have read or create on the correct path. Option D is wrong because the token has capabilities, just not on the required path.

Answer

The operation succeeds because the token can read its own token

Answer

The operation succeeds because sudo allows all accessor operations

Answer

The operation fails because the token lacks any capabilities

Question 10

A DevOps engineer notices that a long-running application using a Vault token fails after 24 hours. The token was created with a TTL of 48h. The token role has a default TTL of 48h and a max TTL of 72h. What is the most likely cause of the failure?

Accepted Answer

The mount's max TTL for the token is 24h, overriding the role's setting.. The most likely cause is that the mount's max TTL for the token is set to 24h, which overrides the role's max TTL of 72h. In Vault, the effective TTL of a token is the minimum of the role's TTL, the mount's max TTL, and the system's max TTL. Since the token fails exactly after 24 hours, the mount's max TTL of 24h is the limiting factor, causing the token to expire even though the role allows up to 48h.

Answer

The token was manually revoked by an administrator.

Answer

The token was revoked due to a policy violation.

Answer

The token is a batch token and cannot be renewed.

Question 11

A security team wants to ensure that tokens can be revoked immediately if a compromised token is detected, even if the token ID is unknown. Which token feature should they use?

Accepted Answer

Token accessors. Token accessors allow revocation of a token without knowing the token ID. They are specifically designed for this purpose.

Answer

Periodic tokens

Answer

Batch tokens

Answer

Orphan tokens

Question 12

An admin creates a token with TTL=48h and explicit_max_ttl=120h. The token is renewed every 24h. After 10 days, will the token still be valid?

Accepted Answer

No, because the total lifetime cannot exceed the explicit_max_ttl of 120h.. The token's total lifetime is capped by the `explicit_max_ttl` of 120 hours (5 days). Even though the token is renewed every 24 hours, the cumulative time since creation cannot exceed the explicit maximum TTL. After 10 days (240 hours), the token will have long surpassed the 120-hour limit and will be invalid.

Answer

Yes, because TTL refreshes to 48h on each renewal.

Answer

Yes, if renewed before TTL expires, it can persist indefinitely.

Answer

No, because tokens cannot be renewed more than 5 times.

Question 13

Which token type should be used for short-lived credentials that do not need to be renewed?

Accepted Answer

Batch tokens. Batch tokens in HashiCorp Vault are designed for short-lived, non-renewable credentials. They have a fixed Time-to-Live (TTL) and cannot be renewed or revoked individually; once the TTL expires, the token is automatically invalidated. This makes them ideal for batch jobs or one-time tasks where credential renewal is unnecessary.

Answer

Service tokens

Answer

Periodic tokens

Answer

Orphan tokens

Question 14

A Vault cluster has a token with the following policy: path "secret/data/dev/*" { capabilities = ["read", "list"] }. The token is used to read a secret at "secret/data/dev/password". The read succeeds. Later, the token tries to read "secret/data/prod/password". What happens?

Accepted Answer

Fails because the token needs an explicit policy for "secret/data/prod/".. Vault policies are path-based and deny by default. The token's policy only grants 'read' and 'list' capabilities on paths matching 'secret/data/dev/*', so any attempt to access 'secret/data/prod/password' is not covered by that policy. Without an explicit policy allowing access to the 'prod' path, the request is denied by Vault's default deny behavior.

Answer

Fails with a system error.

Answer

Succeeds because token has read capability on all secrets.

Answer

Succeeds because the token can list and read any path.

Question 15

What is the purpose of a token's "period" attribute?

Accepted Answer

It is the starting TTL for a periodic token and is refreshed on each renewal.. The 'period' attribute in Vault tokens defines the starting TTL (time-to-live) for a periodic token. When a periodic token is renewed, its TTL is reset to this period value, allowing the token to exist indefinitely as long as it is renewed before the period expires. This is distinct from a non-periodic token, which has a fixed maximum TTL that cannot be extended beyond its original lifetime.

Answer

It defines the maximum lifetime of a token.

Answer

It defines the number of uses before token expires.

Answer

It is the time after which the token is revoked if not used.