VA-003 Assess Vault tokens Practice Question
A user's token was revoked by an administrator, but the user can still read secrets from a KV v1 secrets engine. What is the most likely reason?
⚠ Common exam trap
Many candidates assume token revocation immediately blocks all access to any previously read secrets, but KV v1's lack of leases means the client can continue using cached data without needing a valid token for the read operation itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The secrets were from a KV v1 engine that does not use leases
KV v1 secrets engines do not issue leases for read operations, so token revocation does not affect access to previously read secrets. The token itself was revoked, but the user's ability to read secrets from KV v1 persists because the engine does not enforce lease-based expiration or revocation checks on stored data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token had sudo capabilities on the path
Why it's wrong here
Incorrect. Sudo capabilities do not bypass revocation; they only grant additional privileges on paths. Even with sudo, if the token is revoked, it should not be able to read secrets. However, the question states the user can still read, which is not due to sudo.
- ✗
The token was a root token and cannot be revoked
Why it's wrong here
Incorrect. Root tokens can be revoked, but they are typically not revoked accidentally. Even if it were root, revocation would still invalidate the token. The ability to read persists because of KV v1's lack of leases, not because the token cannot be revoked.
- ✗
The token was an orphan token and therefore immune to revocation
Why it's wrong here
Incorrect. Orphan tokens are tokens that have no parent, but they are still subject to revocation. Revocation of an orphan token will invalidate it. The persistence of read access is due to the engine not checking leases.
- ✓
The secrets were from a KV v1 engine that does not use leases
Why this is correct
Correct. KV v1 does not use leases, so after reading a secret, the client may cache it or the engine does not require a valid token for subsequent reads of the same data. Token revocation only stops new lease-based operations, but KV v1 reads are not lease-based.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.