VA-003 Assess Vault tokens Practice Question
A company runs multiple microservices in a Kubernetes cluster. Each microservice authenticates to Vault using a service token created via the token auth method. The tokens are created with a default TTL of 72h, a max TTL of 168h, and renewable set to true. The services are configured to renew their tokens when the remaining TTL drops below 24h. Recently, some tokens have been expiring prematurely, causing service outages. Upon investigation, you find that the expired tokens were created with a role that includes explicit_max_ttl = 72h. The services see the TTL decreasing normally, but then it jumps to zero even though the services attempted renewal. What is the most likely cause and correct action?
⚠ Common exam trap
In HashiCorp Vault, the distinction between `max_ttl` (which can be extended by renewal up to the mount's limit) and `explicit_max_ttl` (which is an absolute, non-renewable cap) is crucial. Candidates often overlook that `explicit_max_ttl` overrides the renewable property, causing premature token expiration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the explicit_max_ttl setting from the role or set it to 0.
The `explicit_max_ttl` setting on the role overrides the token's renewable property. When a token has an `explicit_max_ttl` of 72h, it cannot be renewed beyond that absolute lifetime, regardless of the `renewable = true` setting. The services attempt renewal, but Vault enforces the hard limit, causing the TTL to jump to zero at the 72-hour mark. Removing `explicit_max_ttl` or setting it to 0 allows the token to be renewed up to the system's `max_ttl` (168h), preventing premature expiration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the services to renew the token when TTL drops below 48h.
Why it's wrong here
Renewing earlier does not overcome the explicit_max_ttl hard cap; tokens will still be revoked at 72h.
- ✓
Remove the explicit_max_ttl setting from the role or set it to 0.
Why this is correct
Removing explicit_max_ttl allows tokens to be renewed up to the max TTL of 168h.
- ✗
Increase the default TTL on the token auth mount to 168h.
Why it's wrong here
The explicit_max_ttl is the hard limit; increasing the default TTL will not extend the token beyond 72h.
- ✗
Set max_ttl on the role to 72h.
Why it's wrong here
This would make tokens expire even sooner (max_ttl limits total lifetime) and not solve the premature expiry.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.