VA-003 Utilize Vault CLI and API Practice Question
An operator needs to create a token role named 'web-app' with a default TTL of 24 hours. Which API request is correct?
⚠ Common exam trap
HashiCorp often tests the distinction between creating a role (PUT /roles) and creating a token using a role (POST /create), and the trap here is that candidates mistakenly use the token creation endpoint or the wrong HTTP method for role creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}
Creating a token role in Vault requires a PUT request to the /v1/auth/token/roles/<role_name> endpoint, and the default_ttl parameter must be specified as a string with a time suffix (e.g., '24h'). The PUT method is used for creating or updating a role, and the path must include 'roles' (plural) followed by the role name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
POST /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}
Why it's wrong here
Incorrect. The endpoint for creating a token role uses PUT method, not POST. POST /auth/token/roles/<role_name> is not the correct syntax.
- ✗
POST /v1/auth/token/create/web-app with body {"default_ttl":"24h"}
Why it's wrong here
Incorrect. The endpoint /auth/token/create/<role_name> is used to create a token using an existing role, not to create the role itself.
- ✓
PUT /v1/auth/token/roles/web-app with body {"default_ttl":"24h"}
Why this is correct
Correct. PUT /auth/token/roles/<role_name> with body {"default_ttl":"24h"} creates or updates the token role named 'web-app' with a default TTL of 24 hours.
- ✗
PUT /v1/auth/token/role/web-app with body {"default_ttl":"24h"}
Why it's wrong here
Incorrect. The path uses 'role' (singular) instead of 'roles' (plural). The correct endpoint is /auth/token/roles/<role_name>.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.