VA-003 Assess Vault tokens Practice Test 5 — 15 Questions

Question 1

A user forgets to renew their token before it expires. What happens to the token and its associated leases?

Accepted Answer

The token is revoked and all its leases are revoked. When a Vault token expires, it is immediately revoked by the system, and all associated leases (e.g., dynamic secrets, wrapped responses) are also revoked. There is no grace period for renewal after expiration; the token must be renewed before its TTL expires. This behavior is enforced by Vault's lease management system, which ties secret lifetimes directly to token validity.

Answer

The token becomes invalid but can be renewed within a grace period

Answer

The token is automatically renewed for another period

Answer

The token remains active but read-only

Question 2

A security team wants to issue tokens that can be used for exactly 10 API calls, after which they must be renewed. Which two token parameters should be set on the token role?

Accepted Answer

ttl and renewable. To meet the requirement that tokens can be used for exactly 10 API calls and then be renewed, you must avoid setting `num_uses` because tokens with `num_uses` set cannot be renewed. Instead, set `ttl` to a short duration (e.g., 1 minute) and `renewable` to true. This allows the token to be used for a limited time (though not exactly 10 calls) and be renewed repeatedly. While this does not enforce exactly 10 calls, it aligns with the constraint that `num_uses` prevents renewal, making this the only viable pair among the options.

Answer

period and num_uses

Answer

ttl and num_uses

Answer

num_uses and renewable

Question 3

A token with a policy that explicitly denies 'read' on 'secret/engineering/private' is issued. The same token also has another policy that grants 'read' on 'secret/engineering/*'. What is the result when the token tries to read 'secret/engineering/private'?

Accepted Answer

The read fails because the explicit deny on the specific path takes precedence. D is correct because Vault's policy evaluation uses a deny-overrides model: any explicit deny on a specific path takes precedence over any allow, even if the allow is more permissive or from a wildcard. The explicit deny on 'secret/engineering/private' blocks the read, regardless of the broader grant on 'secret/engineering/*'.

Answer

The read succeeds because the grant from the wildcard policy is more permissive

Answer

The read fails because the policies conflict and Vault defaults to deny

Answer

The read succeeds because the token has a separate policy that grants read

Question 4

An administrator needs to issue tokens that are automatically renewable by the client (so they can stay alive as long as renewed) but must expire no later than 30 days. Which TWO token parameters should be configured on the token role?

Accepted Answer

max_ttl. (max_ttl) is correct because it enforces the absolute maximum lifetime of the token, ensuring it expires no later than 30 days regardless of renewals. Option D (period) is correct because setting a period makes the token automatically renewable by the client, allowing it to stay alive as long as it is renewed before the period expires. Together, period enables automatic renewal behavior and max_ttl caps the total lifespan at 30 days.

Answer

renewable

Answer

ttl

Answer

num_uses

Question 5

Which THREE statements about token accessors are true?

Accepted Answer

They can be used to look up token metadata without the token ID. Token accessors have multiple capabilities. Option A is correct because accessors allow lookup of token metadata without the token ID via the lookup-accessor endpoint. Option B is correct because the renew-accessor endpoint allows token renewal using only the accessor. Option C is correct because the revoke-accessor endpoint allows token revocation using the accessor. Option E is correct because each token has a unique accessor generated at creation. Option D is incorrect because accessors are UUID strings, not human-readable.

Answer

They are human-readable strings

Question 6

A DevOps engineer is troubleshooting an issue where a token cannot read a secret from the KV v2 engine at path 'secret/team-alpha/db-creds'. The token's policy includes the following: path "secret/team-alpha/*" { capabilities = ["read"] }. Which TWO reasons could explain the failure?

Accepted Answer

The path in the policy needs to be 'secret/data/team-alpha/*'. KV v2 engine requires the path prefix 'data/' after the mount path to access the actual secret data. The policy path 'secret/team-alpha/*' only covers the metadata and sub-paths, not the data endpoint. To read a secret, the policy must specify 'secret/data/team-alpha/*' with 'read' capability, as the actual secret retrieval occurs via the 'data/' sub-path.

Answer

The user needs to use the token's accessor to read the secret

Answer

The secret engine is not tuned to allow reads

Answer

The token is not a child of the root token

Question 7

The token was created 12 hours ago and has not been used yet. What will happen if the token is not used or renewed?

Accepted Answer

It will expire in 12 hours. Vault tokens have a configurable Time-To-Live (TTL) and a maximum TTL. If a token is not used within its TTL, it will expire. Since the token was created 12 hours ago and has not been used, and the default TTL for many token types in Vault is 24 hours, the token will expire in 12 hours (the remaining TTL). This is because the token's TTL begins counting down from creation, not from first use.

Answer

It can be renewed indefinitely if used

Answer

It will expire when the number of uses reaches 0

Answer

It will expire immediately because it was not used within 12 hours

Question 8

A token with this policy attempts to read the secret at path 'secret/data/engineering/special'. Will the read succeed?

Accepted Answer

Yes, because the first path grants read on all secrets under 'secret/data/engineering/'. The first path grants read on secret/data/engineering/*, which includes 'special'. The second path grants create/update on a different path (without 'data' prefix) and does not deny read. Vault merges capabilities, so read is allowed. Option B is wrong because ACL merging does not cause one statement to override another unless there is an explicit deny. Option C is wrong because the token already has a policy covering that path. Option D is wrong because the second path does not grant read but also does not deny it.

Answer

No, because the token needs an additional policy to read from that specific path

Answer

Yes, because the second path implicitly allows read

Answer

No, because the second path is more specific and only allows create/update

Question 9

A user receives this error when trying to read a secret. What is the most likely cause?

Accepted Answer

The token's policy does not grant read on that path. Vault uses a policy-based authorization model. When a token attempts to read a secret, Vault checks the token's associated policies to determine if the action is permitted on that specific path. If the policy does not include a `read` capability (or a broader capability like `sudo` or `update` that implies read) for the secret's path, Vault denies the request with a permission denied error, regardless of the token's validity or the secret engine's status.

Answer

The secret engine is not enabled

Answer

The token is a root token

Answer

The token has expired

Question 10

An administrator creates a service token with a TTL of 1 hour and a max TTL of 24 hours. The token is renewed once after 55 minutes. What happens to the token after 24 hours from creation?

Accepted Answer

The token expires and cannot be renewed. The token's TTL was set to 1 hour with a max TTL of 24 hours. After the first renewal at 55 minutes, the token's TTL resets to 1 hour, but the max TTL remains 24 hours from creation. Once 24 hours have passed from creation, the token reaches its max TTL and expires permanently; it cannot be renewed because the max TTL is a hard upper limit enforced by Vault's token lifecycle logic.

Answer

The token is revoked by the system

Answer

The token's TTL is automatically extended by 1 hour

Answer

The token becomes an orphan token

Question 11

A CI/CD pipeline needs to generate thousands of short-lived tokens each day for jobs that run for at most 5 minutes. The tokens should not be renewable or revocable individually. Which token type should be used?

Accepted Answer

Batch tokens. Batch tokens are designed for high-volume, short-lived workloads where tokens are generated in batches and have a configurable TTL (time-to-live). They cannot be renewed or revoked individually, making them ideal for CI/CD pipelines that need thousands of tokens per day for jobs lasting at most 5 minutes.

Answer

Orphan tokens

Answer

Service tokens

Answer

Periodic tokens

Question 12

A root token creates token T1 with a TTL of 1 hour. T1 then creates token T2 with a TTL of 2 hours. After 30 minutes, T1 is revoked without using the 'cascade' option. What happens to T2?

Accepted Answer

T2 becomes an orphan token and continues to work until its TTL expires. When a root token creates T1 and T1 creates T2, T2 is a child token of T1. Revoking T1 without the 'cascade' option only revokes T1 itself and its immediate leases, but does not propagate revocation to descendant tokens. T2 becomes an orphan token, meaning it loses its parent but continues to function independently until its own TTL of 2 hours expires. This behavior is by design in Vault to allow token hierarchies without forced cascading revocation.

Answer

T2 expires immediately

Answer

T2 is also revoked immediately

Answer

T2's TTL is reduced to match T1's remaining TTL

Question 13

A Vault operator runs 'vault token lookup s.abc123' and sees that the token type is 'service', renewable is true, but the ttl is 30m and creation_ttl is 1h. The token has num_uses set to 0. What is the most likely explanation for the discrepancy between ttl and creation_ttl?

Accepted Answer

30 minutes have elapsed since the token was created. The token's current TTL (30m) is shorter than its creation_ttl (1h) because 30 minutes have already elapsed since the token was issued. The TTL dynamically decreases as time passes, while creation_ttl remains fixed at the original value set at token creation. This is normal behavior for a renewable service token with num_uses=0.

Answer

The token has renewable set to false

Answer

The token type is service, so it cannot be renewed

Answer

The token has been used and num_uses decremented

Question 14

A developer needs to manually revoke a token but only knows its accessor. Which Vault API endpoint can be used to revoke the token using only the accessor?

Accepted Answer

auth/token/revoke-accessor. The `auth/token/revoke-accessor` endpoint is specifically designed to revoke a token when only its accessor is known. The accessor is a non-sensitive identifier that Vault uses to perform token operations without exposing the actual token ID, making this endpoint the appropriate choice for revocation by accessor.

Answer

auth/token/accessors

Answer

auth/token/renew-accessor

Answer

auth/token/revoke

Question 15

A security policy requires that all tokens are revoked when a user leaves the organization. What is the most efficient way to revoke all tokens issued to that user?

Accepted Answer

Use the identity/entity endpoint to revoke all tokens associated with the user's entity. Vault associates all tokens issued to a user with their entity identity. Using the identity/entity endpoint to revoke the entity's tokens is the most efficient method, as it leverages Vault's identity system to revoke all tokens linked to that entity in a single API call, rather than requiring individual token lookups or path-based revocation.

Answer

Revoke each token individually using its accessor

Answer

Use the auth/token/revoke-prefix endpoint with the user's token path

Answer

Restart the Vault server