VA-003 Assess Vault tokens Practice Question
A Vault operator runs 'vault token lookup s.abc123' and sees that the token type is 'service', renewable is true, but the ttl is 30m and creation_ttl is 1h. The token has num_uses set to 0. What is the most likely explanation for the discrepancy between ttl and creation_ttl?
⚠ Common exam trap
HashiCorp often tests the distinction between creation_ttl (static) and ttl (dynamic), trapping candidates who confuse a reduced TTL with a non-renewable token or usage decrement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
30 minutes have elapsed since the token was created
The token's current TTL (30m) is shorter than its creation_ttl (1h) because 30 minutes have already elapsed since the token was issued. The TTL dynamically decreases as time passes, while creation_ttl remains fixed at the original value set at token creation. This is normal behavior for a renewable service token with num_uses=0.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token has renewable set to false
Why it's wrong here
The lookup output shows renewable is true, contradicting this claim; ttl is remaining lifetime, creation_ttl the original maximum, so 30m simply means 30 minutes have elapsed. It tempts because non-renewable tokens do expire, but that flag is not set here.
- ✗
The token type is service, so it cannot be renewed
Why it's wrong here
Service tokens are renewable when renewable is true, so type does not block renewal; the 30m ttl reflects elapsed time since issuance against the 1h creation_ttl. It tempts because periodic and batch tokens differ in renewability, but here renewable is already true.
- ✓
30 minutes have elapsed since the token was created
Why this is correct
The ttl field reports remaining time, while creation_ttl records the original lifetime. A ttl of 30m against a creation_ttl of 1h means 30 minutes have elapsed since issuance, so the token is simply counting down from its initial hour.
- ✗
The token has been used and num_uses decremented
Why it's wrong here
num_uses is 0, meaning unlimited uses, so no decrement occurred; ttl measures remaining time, not use count, and 30m against 1h creation_ttl indicates elapsed time. It tempts because limited-use tokens expire on exhaustion, but that setting is absent.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.