VA-003 Assess Vault tokens Practice Question
A security engineer needs to create a batch token that will be used by an external system for a one-time operation. The token must be self-contained and not stored in Vault's storage backend. Which token type should be used, and what is a key limitation of that token type?
⚠ Common exam trap
The trap here is assuming that batch tokens can be revoked like service tokens, when in fact they are not stored and thus cannot be individually revoked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Batch token; it cannot be renewed or revoked, and it is not stored in Vault's storage backend.
Batch tokens are designed to be lightweight and self-contained, meaning they are not persisted in Vault's storage backend. This makes them suitable for ephemeral use cases where the token will not be renewed or revoked. The key limitation is that they cannot be renewed or revoked individually, which is acceptable for a one-time operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Periodic token; it can be renewed indefinitely but is stored in Vault's storage backend.
Why it's wrong here
Periodic tokens are service tokens with unlimited renewals, but they are stored in Vault's storage backend. The scenario explicitly requires a token not stored in Vault, so a periodic token fails that criterion. Additionally, periodic tokens are designed for long-running services, not one-time operations.
- ✗
Root token; it is not stored in Vault's storage backend and can be used for any operation.
Why it's wrong here
Root tokens are highly privileged and are stored in Vault's storage backend when created. They are not self-contained and cannot be used for one-time operations without significant security risk. Using a root token for an external system is a severe security anti-pattern and does not align with the principle of least privilege.
- ✓
Batch token; it cannot be renewed or revoked, and it is not stored in Vault's storage backend.
Why this is correct
Batch tokens are self-contained, not persisted in Vault's storage, and therefore cannot be renewed or revoked individually. They are ideal for ephemeral, one-time operations where the client does not need to manage the token's lifecycle. This matches the requirement for a token that is not stored and used for a single operation.
- ✗
Service token; it cannot be renewed or revoked individually.
Why it's wrong here
Service tokens are stored in Vault's storage backend and can be renewed and revoked individually. They are the default token type. The scenario requires a self-contained token not stored in Vault, so a service token does not meet the requirement. Its renewability and revocability are strengths, not limitations in this context.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.