VA-003 Assess Vault tokens Practice Question
An operator runs `vault token create -policy=app -ttl=1h -explicit-max-ttl=2h` and then checks the token's properties with `vault token lookup`. The token is renewable. A developer asks whether the token can be kept alive indefinitely by renewing it every 30 minutes. What should the operator tell the developer?
⚠ Common exam trap
The trap here is assuming that a renewable token can always be renewed forever, overlooking that an explicit max TTL creates an absolute expiration ceiling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token can be renewed only until its explicit max TTL of 2 hours is reached; after that, renewal fails and the token expires.
The token was created with an explicit max TTL, which acts as a hard cap on its total lifetime. Renewals are permitted only while the token's age is less than the explicit max TTL. Once that limit is reached, Vault refuses further renewals and the token expires. The developer cannot keep the token alive indefinitely by renewing it; they must obtain a new token. This behavior ensures that tokens cannot outlive their configured maximum lifetime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token can be renewed indefinitely because the default max TTL of 32 days overrides the explicit max TTL.
Why it's wrong here
The default max TTL of 32 days applies only when no explicit max TTL is set on the token or its parent. Here, the operator explicitly set -explicit-max-ttl=2h, which overrides the system default. Therefore, the 32-day default does not apply, and the token cannot be renewed beyond 2 hours. The developer's belief that the default overrides the explicit setting is incorrect.
- ✗
The token can be renewed indefinitely because it has a TTL and is renewable.
Why it's wrong here
A renewable token does not imply unlimited lifetime. When an explicit max TTL is set, Vault enforces a hard ceiling on the token's total lifetime regardless of renewals. The developer's assumption ignores that ceiling. Vault will reject renewal attempts beyond the explicit max TTL, and the token will expire once that window passes. Indefinite renewal is only possible when no explicit max TTL is configured and the token is renewed before each TTL expires.
- ✓
The token can be renewed only until its explicit max TTL of 2 hours is reached; after that, renewal fails and the token expires.
Why this is correct
The explicit max TTL sets a hard limit on the token's total lifetime. Even though the token is renewable, Vault will not allow renewal beyond that 2-hour window. The operator should tell the developer that renewing every 30 minutes works only until the explicit max TTL is reached; after that, the token cannot be renewed and must be replaced. This is the intended behavior for bounding token lifetime.
- ✗
The token cannot be renewed at all because an explicit max TTL disables renewal.
Why it's wrong here
Setting an explicit max TTL does not disable renewal; it only imposes a hard limit. The token remains renewable up to that limit. The operator can still renew the token multiple times, but each renewal cannot extend the token's lifetime beyond the explicit max TTL. Renewal is allowed until the token reaches that ceiling, after which it fails. The claim that renewal is completely disabled is false.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.