VA-003 Assess Vault tokens Practice Question
A security team wants to enforce that all tokens created by a specific AppRole can only be used to read secrets from the path 'secret/data/team-a/*'. They have configured the AppRole with token_policies that include that path. However, a developer uses the token created from this AppRole to create a child token with broader policies, granting access to 'secret/data/team-b/*'. The security team wants to prevent such privilege escalation. Which action should be taken to ensure that child tokens cannot have broader policies than the parent?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the AppRole with 'token_allowed_policies' to restrict which policies child tokens can use
In Vault, when a token creates a child token, the child can be assigned any policies that the parent token has access to, including broader policies, unless the parent token has an `allowed_policies` metadata that restricts which policies the child can use. By configuring the AppRole with `token_policies` and setting `allowed_policies` on the generated token (or on the AppRole itself via `token_allowed_policies`), the parent token can only create child tokens with those specific policies, preventing privilege escalation. Option A is reactive and does not prevent escalation. Option C is incorrect because root tokens can create any token without restriction. Option D is incorrect because setting `orphan=true` makes the token independent but does not restrict child token policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Regularly audit and revoke tokens that violate policy
Why it's wrong here
Regularly auditing and revoking tokens that violate policy is reactive and does not prevent privilege escalation.
- ✓
Configure the AppRole with 'token_allowed_policies' to restrict which policies child tokens can use
Why this is correct
Configuring the AppRole's token_allowed_policies metadata restricts which policies a child token can be assigned. By setting allowed_policies on the parent token, or on the AppRole via token_allowed_policies, child tokens can only have those specific policies, preventing broader policy assignment.
- ✗
Use a root token to create all tokens and distribute them securely
Why it's wrong here
Using a root token to create all tokens does not restrict child token policies; root tokens can create any token without restriction.
- ✗
Set the parent token's 'orphan' property to 'true'
Why it's wrong here
Setting the parent token's 'orphan' property to 'true' makes the token independent but does not restrict child token policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.