VA-003 Assess Vault tokens Practice Question
Exhibit
Refer to the exhibit. ``` $ vault token lookup -accessor 7c7f5d5c-5e5f-4a5b-8c8d-9e0f1a2b3c4d Key Value --- ----- accessor 7c7f5d5c-5e5f-4a5b-8c8d-9e0f1a2b3c4d creation_time 1625097600 creation_ttl 24h display_name my-token explicit_max_ttl 0s id s.abcdefghijklmnopqrstuvwxyz issue_time 2021-07-01T00:00:00Z meta map[user:alice] num_uses 0 orphan true path auth/token/create policies [default my-policy] ttl 12h type service ```
A token has the properties shown in the exhibit. A user attempts to use this token to write a secret to 'secret/data/myapp'. The token fails with a permission denied error. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that token properties like TTL, type, or parentage affect permissions, when in reality only the attached policies determine what operations a token can perform on a given path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token's policies do not grant write capability on the target path.
The token's policies define the access control rules for paths in Vault. Since the user received a permission denied error when attempting to write to 'secret/data/myapp', the most likely cause is that the token's attached policies do not include a 'write' or 'create' capability on that specific path. Policies are evaluated based on the path and the requested operation, and without the appropriate capability, the request is denied regardless of other token properties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token has an explicit max TTL of 0s, which prevents write operations.
Why it's wrong here
explicit_max_ttl of 0s means no explicit max, which does not block writes.
- ✓
The token's policies do not grant write capability on the target path.
Why this is correct
The token only has 'default' and 'my-policy' policies. Without a policy granting write on 'secret/data/myapp', the operation is denied.
- ✗
The token is a service token but the write operation requires a batch token.
Why it's wrong here
Service tokens can write secrets; batch tokens cannot.
- ✗
The token is orphaned, so it cannot be used for write operations.
Why it's wrong here
Orphan tokens can be used normally; they are just not revoked when the parent is revoked.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.