VA-003 Assess Vault tokens Practice Question
Exhibit
Refer to the exhibit. ``` $ vault token lookup -accessor 7c7f5d5c-5e5f-4a5b-8c8d-9e0f1a2b3c4d Key Value --- ----- accessor 7c7f5d5c-5e5f-4a5b-8c8d-9e0f1a2b3c4d creation_time 1625097600 creation_ttl 24h display_name my-token explicit_max_ttl 0s id s.abcdefghijklmnopqrstuvwxyz issue_time 2021-07-01T00:00:00Z meta map[user:alice] num_uses 0 orphan true path auth/token/create policies [default my-policy] ttl 12h type service ```
A token has the properties shown in the exhibit. A user attempts to use this token to write a secret to 'secret/data/myapp'. The token fails with a permission denied error. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that token properties like TTL, type, or parentage affect permissions, when in reality only the attached policies determine what operations a token can perform on a given path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token's policies do not grant write capability on the target path.
The token's policies define the access control rules for paths in Vault. Since the user received a permission denied error when attempting to write to 'secret/data/myapp', the most likely cause is that the token's attached policies do not include a 'write' or 'create' capability on that specific path. Policies are evaluated based on the path and the requested operation, and without the appropriate capability, the request is denied regardless of other token properties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token has an explicit max TTL of 0s, which prevents write operations.
Why it's wrong here
A max TTL of 0s means no explicit cap, so the token inherits the system default rather than being blocked from writing. It is tempting because zero values often disable features, but the permission denied stems from the token's policy lacking create or update capability on that path.
- ✓
The token's policies do not grant write capability on the target path.
Why this is correct
The token’s attached policies lack a `create` or `update` capability on `secret/data/myapp`, so Vault denies the write despite valid authentication. Vault authorises every request by evaluating the token’s policies against the exact path and operation; without a matching rule granting write, the request fails with permission denied.
- ✗
The token is a service token but the write operation requires a batch token.
Why it's wrong here
Batch tokens are simply non-renewable, non-expiring tokens designed for high-volume, short-lived operations; they are not required for writes, and a service token can write provided its policy permits. The denial stems from the token's attached policy lacking create/update capability on secret/data/myapp.
- ✗
The token is orphaned, so it cannot be used for write operations.
Why it's wrong here
Orphan tokens have no parent, so they survive parent revocation; they retain full policy-based capabilities, including writes. The permission denied arises because the token's policy does not grant create or update on secret/data/myapp, not because of its orphan status.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.