VA-003 Assess Vault tokens Practice Question
A company uses Vault to issue tokens for short-lived tasks. They have configured a token role with 'period' set to 30 minutes and 'explicit_max_ttl' set to 24 hours. Tokens are created using the role and are expected to be renewed every 30 minutes by the tasks. However, after a few renewals, the Vault audit logs show that a token was renewed but then immediately expired. The task that was using the token failed. What is the most likely reason for this behavior?
⚠ Common exam trap
Vault often tests the distinction between 'period' (renewal interval) and 'explicit_max_ttl' (absolute lifetime cap), leading candidates to mistakenly think that periodic renewal can continue indefinitely as long as the token is renewed within the period.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token reached its 'explicit_max_ttl' of 24 hours, and renewal is no longer possible.
The token role has an 'explicit_max_ttl' of 24 hours, which sets an absolute hard limit on the token's lifetime regardless of the shorter 'period' of 30 minutes. When the token is renewed, its total lifetime cannot exceed the explicit_max_ttl. Once that limit is reached, Vault rejects any further renewal, causing the token to expire immediately and the task to fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The token reached its 'explicit_max_ttl' of 24 hours, and renewal is no longer possible.
Why this is correct
Correct: Periodic tokens cannot exceed explicit_max_ttl; after 24 hours, renewal fails and token expires.
- ✗
The token was created by a root token and root tokens are not subject to periodic renewal.
Why it's wrong here
Incorrect: Root tokens are subject to period and max TTL settings if explicitly configured.
- ✗
The token was a batch token and batch tokens cannot be renewed at all.
Why it's wrong here
Incorrect: Batch tokens are not renewable, but the scenario states tokens are being renewed, so they must be service tokens.
- ✗
The token was an orphan token and cannot be renewed more than a few times.
Why it's wrong here
Incorrect: Orphan tokens can be renewed without limit as long as they are within their TTL and max TTL constraints.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.