VA-003 Vault token create command Practice Question
A security team needs to create a token with a custom TTL of 1 hour and associate it with a policy named 'read-only'. Which Vault CLI command accomplishes this?
⚠ Common exam trap
Candidates often confuse `vault token create` with `vault write auth/token/create`, which is a different method requiring different parameter syntax. Also, `vault create` is not a valid command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault token create -policy=read-only -ttl=1h
Both `vault token create -policy=read-only -ttl=1h` and `vault token create -policy=read-only -ttl 1h` are valid Vault CLI commands that create a token with the specified policy and TTL. The CLI parser accepts both the equals sign and space syntax for string flags. Therefore, both options A and C accomplish the task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
vault token create -policy=read-only -ttl=1h
Why this is correct
Correct. Uses the proper `vault token create` command with `-policy` and `-ttl=1h` flags.
- ✗
vault write auth/token/create policies=read-only ttl=1h
Why it's wrong here
Incorrect. `vault write auth/token/create` uses the API endpoint and expects different parameter syntax (e.g., `policies=["read-only"]`).
- ✓
vault token create -policy=read-only -ttl 1h
Why this is correct
Incorrect. Although logically correct, the Vault CLI requires `-ttl=1h` with an equals sign; `-ttl 1h` is not the standard syntax and may not work as expected.
- ✗
vault create token -policy=read-only -ttl=1h
Why it's wrong here
Incorrect. `vault create` is not a valid Vault command.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.