VA-003 Assess Vault tokens Practice Question
Exhibit
Error writing data to auth/token/renew: Error making API request. URL: PUT http://localhost:8200/v1/auth/token/renew Code: 400. Errors: * no matching lease for token
Refer to the exhibit. A developer tries to renew a token and receives this error. The token was created using 'vault token create -type=batch'. What is the most likely cause of this error?
⚠ Common exam trap
HashiCorp Vault often tests the distinction between batch and service tokens by presenting a renewal error, and the trap here is that candidates may assume all tokens can be renewed or confuse batch tokens with periodic tokens, which are a subtype of service tokens that do support renewal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token is a batch token
Batch tokens are non-persistent and do not have associated lease IDs, so they cannot be renewed. The error occurs because the developer attempted to renew a batch token using 'vault token renew', which is only valid for service tokens that have a lease and can be extended. The exhibit shows a renewal failure, and since the token was created with 'vault token create -type=batch', the most likely cause is that batch tokens are inherently non-renewable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token is a service token and has expired
Why it's wrong here
Service tokens are a distinct token type; the stem specifies batch, so expiry of a service token is not the mechanism. It is tempting because expired tokens commonly produce renewal errors, but service tokens are the correct choice when a long-lived token tied to an entity's lifecycle is required.
- ✓
The token is a batch token
Why this is correct
Batch tokens in HashiCorp Vault are not renewable: they carry a fixed, pre-computed lifetime and cannot be renewed via the renew-self endpoint, unlike service tokens. Since the stem specifies creation with `-type=batch`, the renewal attempt fails because that token type inherently lacks renewal capability.
- ✗
The token is a periodic token and its period has expired
Why it's wrong here
Periodic tokens are renewable by design, so an expired period is not the cause here; batch tokens cannot be renewed at all. It is tempting because periodic tokens also involve renewal timing, but periodic tokens are the correct choice when a token must be renewed indefinitely without re-authentication.
- ✗
The token is an orphan token
Why it's wrong here
Orphan status concerns parent token revocation, not renewal; batch tokens are non-renewable regardless of parentage. It is tempting because orphan tokens behave unusually in some lease operations, but orphan tokens are the correct choice when a token must survive revocation of its parent.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.