Compare authentication methods →hardMultiple ChoiceObjective-mapped

VA-003 Compare authentication methods Practice Question

Exhibit

Refer to the exhibit.

```
$ vault read auth/userpass/login/john
Key                 Value
---                 -----
token               s.abc123...
token_accessor      abc123...
token_duration      768h
token_renewable     true
identity_policies   ["default"]
policies            ["default"]
```

A user 'john' logs in via the userpass method. The output shows a token with a duration of 768 hours. However, the userpass mount is configured with `token_ttl=24h`. What is the most likely reason for the longer token duration?

⚠ Common exam trap

HashiCorp often tests the misconception that mount-level settings are absolute, when in fact per-user or per-role overrides can extend token lifetimes beyond the mount's default TTL.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user has a custom `ttl` set in the userpass configuration for user 'john'.

The userpass mount allows per-user TTL overrides via the `token_ttl` parameter when creating or updating a user. Even though the mount has a default `token_ttl=24h`, if user 'john' was configured with a specific `token_ttl` of 768 hours, that per-user setting takes precedence over the mount-level default. This is a common way to grant specific users longer token lifetimes without changing the mount's default policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The system backend is configured with a max_ttl that overrides the mount setting.
Why it's wrong here
max_ttl would cap, not extend.
✓
The user has a custom `ttl` set in the userpass configuration for user 'john'.
Why this is correct
Userpass allows per-user TTL settings that override the mount default.
✗
The mount token_ttl is only applied if the user does not specify a `token_policies` parameter.
Why it's wrong here
token_policies does not affect TTL.
✗
The token was issued with a periodic token and ignores the TTL.
Why it's wrong here
Periodic tokens are for limited use, not common for userpass.

Go deeper

VA-003 Compare authentication methods Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question