VA-003 Utilize Vault CLI and API Practice Question
An operator needs to perform token lifecycle operations. Which THREE API endpoints are valid for token-related actions?
⚠ Common exam trap
HashiCorp often tests the misconception that token revocation uses a DELETE HTTP method, but Vault's API consistently uses POST for all token lifecycle mutations, including revoke, renew, and create, to align with its idempotency and security design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
POST /v1/auth/token/renew
The `POST /v1/auth/token/renew` endpoint is the standard Vault API call to extend the Time-To-Live (TTL) of an existing token, which is a core token lifecycle operation. This endpoint accepts the token to renew in the request body and returns a new lease duration, adhering to Vault's token management design.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PUT /v1/auth/token/roles
Why it's wrong here
Incorrect. Token roles are managed via POST or GET on /v1/auth/token/roles/:name, not PUT without a role name. This endpoint does not perform a token lifecycle operation.
- ✓
POST /v1/auth/token/renew
Why this is correct
Correct. POST /v1/auth/token/renew is the standard call to extend a token's TTL, a core lifecycle operation.
- ✗
DELETE /v1/auth/token/revoke
Why it's wrong here
Incorrect. Token revocation uses POST /v1/auth/token/revoke, not DELETE. Vault uses POST for all token mutation operations.
- ✓
POST /v1/auth/token/create
Why this is correct
Correct. POST /v1/auth/token/create creates a new token, a fundamental lifecycle action.
- ✓
GET /v1/auth/token/lookup
Why this is correct
Correct. GET /v1/auth/token/lookup retrieves token metadata and properties, part of token lifecycle management.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.