VA-003 Assess Vault tokens Practice Test 4 — 15 Questions

Question 1

A team needs to issue unique tokens to each of 100 microservices, each with its own policy, and ensure that revoking one token does not affect others. Which token feature should they use?

Accepted Answer

Token roles with distinct policies. Vault token roles allow you to define distinct policies per token, ensuring each microservice gets a unique token with its own policy. When a token is revoked, only that specific token is invalidated, leaving all others unaffected. This satisfies the requirement for independent revocation without impacting other services.

Answer

Periodic tokens

Answer

Orphan tokens

Answer

Token accessors

Question 2

Where can you view a list of all active tokens in Vault?

Accepted Answer

`vault list auth/token/accessors`. `vault list auth/token/accessors` retrieves token accessors, which are unique identifiers for active tokens. While you cannot directly list tokens for security reasons, listing accessors is the standard way to view active tokens. Option A is false because there is a way to list tokens via their accessors. Option B is false because `vault token list` is not a valid command. Option D is false because both A and B are not true.

Answer

There is no way to list all tokens.

Answer

`vault token list`

Answer

Both A and B

Question 3

An application uses a periodic token with period=24h. The application renews every 12h. After 48h, the token is still valid. After 72h, the token is still valid. What is the maximum lifetime of this periodic token?

Accepted Answer

Unlimited (as long as it keeps renewing). A periodic token with a defined period (e.g., 24h) has no maximum lifetime; it remains valid indefinitely as long as it is renewed before the period expires. In this scenario, the token is renewed every 12h (well within the 24h period), so after 48h and 72h it is still valid because each renewal resets the token's lifetime, effectively giving it an unlimited lifespan. This behavior is inherent to periodic tokens in Vault, which are designed for long-lived sessions with regular re-authentication.

Answer

72h

Answer

48h

Answer

24h

Question 4

Which TWO statements about batch tokens are true?

Accepted Answer

They are lightweight and support a high creation rate.. Batch tokens are designed to be lightweight and support a high creation rate, ideal for ephemeral workloads. Option B is correct because batch tokens cannot be used with a use-limit; use-limits are only supported by service tokens. Options C, D, and E are incorrect: batch tokens do not support explicit max TTL (C), they do not have a TTL as they derive their lifetime from the parent token (D), and they are not renewable (E).

Answer

They support explicit max TTL.

Answer

They have a TTL.

Answer

They are renewable.

Question 5

Which TWO methods can be used to revoke a token without knowing the token ID?

Accepted Answer

Using `vault token revoke -mode path` on the auth mount.. `vault token revoke -mode path` allows revocation of all tokens issued by a specific auth mount (e.g., `userpass/` or `ldap/`) without needing individual token IDs. This method uses the mount's accessor path to revoke all tokens associated with that mount, effectively cleaning up tokens in bulk when their IDs are unknown.

Answer

Using the token's role name if it has one.

Answer

Using the token's policy name.

Answer

Using the token's creation time.

Question 6

Which THREE factors influence the maximum TTL of a token?

Accepted Answer

The max TTL of the auth method or mount.. The maximum TTL of a token is capped by the max TTL configured on the auth method or mount path. Even if a role or system default allows a longer TTL, the auth mount's max TTL acts as an upper boundary that cannot be exceeded. This ensures that each mount path enforces its own security limits independent of role-level settings.

Answer

The TTL set on the token role.

Answer

The token's current TTL.

Question 7

Refer to the exhibit. A user attempts to renew the token after 20 hours. What will happen?

Accepted Answer

The token will be renewed for another 4h, after which it will expire.. The explicit max TTL is 24h. After 20h, the remaining time until max TTL is 4h. Renewal will set the token duration to the minimum of the requested TTL (12h) and the remaining max TTL (4h), resulting in a 4h TTL. After that, the token expires.

Answer

The renewal will fail because the token has exceeded its explicit max TTL.

Answer

The token will be renewed for another 12h and can be renewed indefinitely.

Answer

The token will be renewed for 12h, but the total lifetime cannot exceed 24h.

Question 8

Refer to the exhibit. A token has this policy. Which action can the token perform?

Accepted Answer

Read a secret at "secret/data/engineering/db-pass". The token's policy grants 'read' capability on 'secret/data/engineering/*' via the 'data' path. Since 'secret/data/engineering/db-pass' falls under that wildcard, the token can read it. The policy does not allow 'update', 'list', or 'delete' actions on the specified paths.

Answer

Update a secret at "secret/data/engineering/config"

Answer

List secrets at "secret/data/finance/"

Answer

Delete a secret at "secret/data/finance/budget"

Question 9

Refer to the exhibit. An admin wants to ensure this token can be used for 60 hours total. Which action should be taken?

Accepted Answer

Create a new token with explicit_max_ttl=60h.. The token's current `explicit_max_ttl` is set to 48h, and the `creation_ttl` (24h) cannot be increased beyond that bound. To achieve a total lifetime of 60 hours, a new token must be created with `explicit_max_ttl=60h`, which overrides the default or role-based TTL limits and sets the absolute maximum lifetime for the token.

Answer

Increase the creation_ttl to 60h.

Answer

The token will expire after 48h, so increase explicit_max_ttl to 60h on the current token.

Answer

The token already can be used for 60h because it is renewable.

Question 10

A developer needs a token that can be used only 5 times and must expire after 24 hours, regardless of the number of uses. Which token creation method should be used to enforce these constraints?

Accepted Answer

Use a token role with num_uses=5 and ttl=24h. A token role with both `num_uses=5` and `ttl=24h` enforces both constraints: the token can be used only 5 times and will expire after 24 hours, regardless of which limit is reached first. Creating a token directly with only `num_uses` or only `ttl` would miss one constraint, and a periodic token ignores the `num_uses` limit entirely.

Answer

Create a token directly with num_uses=5

Answer

Create a token directly with ttl=24h

Answer

Create a periodic token with period set to 24h

Question 11

A user's token was revoked by an administrator, but the user can still read secrets from a KV v1 secrets engine. What is the most likely reason?

Accepted Answer

The secrets were from a KV v1 engine that does not use leases. KV v1 secrets engines do not issue leases for read operations, so token revocation does not affect access to previously read secrets. The token itself was revoked, but the user's ability to read secrets from KV v1 persists because the engine does not enforce lease-based expiration or revocation checks on stored data.

Answer

The token had sudo capabilities on the path

Answer

The token was a root token and cannot be revoked

Answer

The token was an orphan token and therefore immune to revocation

Question 12

An organization uses Vault's token auth method to issue tokens for long-running services. They want to ensure that tokens are automatically revoked after 30 days, even if the service repeatedly renews them. Which token role configuration achieves this?

Accepted Answer

Set max_ttl to 720h on the token role. Setting `max_ttl` to 720h (30 days) on the token role enforces an absolute upper lifetime for the token, regardless of how many times it is renewed. This ensures the token is automatically revoked after 30 days, even if the service repeatedly renews it before the current TTL expires.

Answer

Set ttl to 720h without setting max_ttl

Answer

Set explicit_max_ttl to 720h on the token role

Answer

Set period to 720h without setting max_ttl

Question 13

A DevOps engineer needs to create a token that can only read secrets under the path 'secret/engineering'. What is the recommended approach?

Accepted Answer

Create a policy that allows read on secret/engineering/* and attach it to the token. Vault's recommended approach for granting least-privilege access is to create a policy that explicitly defines the allowed actions and paths, then attach that policy to the token. A policy with `path "secret/engineering/*" { capabilities = ["read"] }` ensures the token can only read secrets under that specific path, adhering to the principle of least privilege.

Answer

Create a token with a short TTL so it expires quickly

Answer

Create a token with the default policy only

Answer

Use the root token and restrict usage with a low TTL

Question 14

A token with a policy granting 'write' on 'secret/team-alpha/*' is unable to write to 'secret/team-alpha/db-creds' in a KV v2 engine. What is the most likely cause?

Accepted Answer

The policy path should be 'secret/data/team-alpha/*' for KV v2. D is correct because in Vault's KV v2 engine, the actual data path is prefixed with 'data/' after the mount path. A policy granting 'write' on 'secret/team-alpha/*' targets the metadata path, not the data path. To write secrets, the policy must use 'secret/data/team-alpha/*' to match the correct API endpoint.

Answer

The token is not a root token

Answer

The token's TTL has expired

Answer

The token has a conflicting policy from a parent token

Question 15

An administrator wants to audit token usage without exposing the actual token IDs to auditors. Which approach should they use?

Accepted Answer

Use token accessors in audit logs. Token accessors are non-sensitive, randomly generated identifiers that are mapped one-to-one with actual Vault tokens. By logging the accessor instead of the token ID, administrators can audit token usage (e.g., lookup, renewal, revocation) without exposing the token itself, which could be used to authenticate. This approach satisfies the requirement of auditing without compromising security.

Answer

Enable audit logging without any modifications

Answer

Use the token lookup API for each audit event

Answer

Use response wrapping to encapsulate tokens