VA-003 Assess Vault tokens Practice Question
A large enterprise uses Vault with multiple namespaces for different business units. The security team has implemented a policy that requires all tokens to be created with a bounded set of allowed policies defined in a token role. The token role allows policies 'app-dev', 'app-staging', and 'app-prod' for the development namespace. The token role has token_type set to 'service'. A developer attempts to create a token using this role but specifies an additional policy 'admin' in the creation request. The Vault administrator expects this request to fail because 'admin' is not in the allowed policies list. However, the token is created successfully with only the allowed policies applied. Why did the request succeed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer added the 'admin' policy directly to the token role before creating the token.
In Vault, token roles enforce a strict policy: the policies requested during token creation must be a subset of the allowed policies (or match allowed_policies_glob). If a requested policy like 'admin' is not in the allowed list, the request should fail. The only way the developer's request could succeed is if the 'admin' policy was added to the token role's allowed policies before the request was made. Option D correctly identifies this: the developer added the 'admin' policy directly to the token role, making it allowed. Options A and C contradict Vault's known behavior, and option B's glob pattern 'app-*' does not match 'admin'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token role's 'token_type' was set to 'batch', which ignores policy restrictions.
Why it's wrong here
Incorrect. The token_type is 'service', not 'batch'. Batch tokens ignore policy restrictions, but that's not the case here.
- ✗
The token role had 'allowed_policies_glob' set to 'app-*', which matched 'admin' as well.
Why it's wrong here
Incorrect. The glob 'app-*' does not match 'admin'. Even if it did, Vault would apply the glob but still reject non-matching policies.
- ✗
Vault ignores the 'allowed_policies' list when the token creation request includes policies, as long as one of the requested policies is in the allowed list.
Why it's wrong here
Incorrect. Vault does not ignore allowed_policies; it strictly requires all requested policies to be in the list or matched by a glob.
- ✓
The developer added the 'admin' policy directly to the token role before creating the token.
Why this is correct
Correct. The developer must have added 'admin' to the token role's allowed policies before creating the token, which would then allow the request to succeed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.